Don't go welding free Wi-Fi, it's okay. 🚨

Security researchers have revealed a new Wi-Fi network vulnerability called AirSnitch that could allow attackers to eavesdrop on or modify data running through the network despite the use of encrypted standards like WPA2 or WPA3. This vulnerability does not directly decrypt the security system, but evades the Wi-Fi protection mechanism used by routers to extract the communication of each device.

.

Wi-Fi is now the base technology in use around the world. The Wi-Fi Alliance states that there are over 48 billion Wi-Fi-compatible devices produced and about 6 billion users worldwide. But because of the nature of wireless networks that communicate via radio signals, people within the range can always try to intercept data, encryption and user isolation systems are required to prevent spying.

.

Recent research has shown that AirSnitch uses weaknesses in the structural levels of the network (Layer 1 and Layer 2) that are the most basic levels of the network, allowing attackers to evade a system called Client Isolation that routers use to prevent devices in the same network from accessing each other directly.

.

The main method of attack is to falsify the MAC Address of the target device and instead mislead the network system that the device is connected through the attacker, resulting in the information that should have gone to the actual user being sent to the attacker first. This technique allows the attacker to Machine-in-the-Middle or insert a communication intermediate to view or edit the information before forwarding it to the actual destination.

.

If the connection does not use encryption, the attacker can clearly see all information such as passwords, login cookies, credit card information, or other personal information. While even using HTTPS, the attacker can also view DNS and IP requests of the user-visited website, and may use techniques like DNS cache poisoning to trick the user into fake websites.

.

Tests revealed that routers from several manufacturers were vulnerable to this attack; whether Netgear, D-Link, ASUS, TP-Link, Cisco and Ubiquiti, as well as devices using DD-WRT and OpenWrt firmware.

.

However, the AirSnitch attack has an important condition: the attacker must first be able to connect to the same Wi-Fi network to launch the attack. This makes the network that sets passwords strong and restricts users lower risk. On the other hand, public Wi-Fi networks such as cafes, hotels or airports may be more vulnerable because anyone can connect to the same network.

.

Experts therefore recommend that if public Wi-Fi is required, VPNs should be used to increase the encryption of data, or avoid major transactions over such networks to reduce security risks.

.

Source: hkepc, arstechnica

# IT should know # IT News # Includes IT matters # IT