FYI AirSnitch doesn't break encryption, but it bypasses it. (wifi vulnerabilities affects all)

Article:

New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises

That guest network you set up for your neighbors may not be as secure as you think.

arstechnica.com

Whitepaper and Slides:

AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks - NDSS Symposium

www.ndss-symposium.org

AirSnitch tool is available at:

https://github.com/zhouxinan/airsnitch

Mirror:

GitHub - vanhoefm/airsnitch: Generalized Wi-Fi Client Isolation Bypasses

Generalized Wi-Fi Client Isolation Bypasses. Contribute to vanhoefm/airsnitch development by creating an account on GitHub.

github.com

AirSnitch is a wireless attack, it does not require the person snooping to have physical access to the wifi equipment or ethernet lines. AirSnitch bypasses client isolation protections intended to keep wifi users isolated from one another. It allows the attacker to be a hidden “machine‑in‑the‑middle to eavesdrop and alter the data being sent over the network traffic.

The attacker can be on the same SSID, a separate one, or even a separate network segment.

The attack works against small wifi networks in both homes and offices and large networks in enterprises.

Various forms of AirSnitch attacks worked across a broad range of routers, including those from Netgear, D-Link, Lancom, Ubiquiti, Tenda, Cisco,TP-Link, Asus and those running DD-WRT and OpenWrt.

Quotes from the article:

...some router makers have already released updates that mitigate some of the attacks, and more updates are expected in the future. But he also said some manufacturers have told him that some of the systemic weaknesses can only be addressed through changes in the underlying chips they buy from silicon makers.

The hardware manufacturers face yet another challenge: The client isolation mechanisms vary from maker to maker. With no industry-wide standard, these one-off solutions are splintered and may not receive the concerted security attention that formal protocols are given.

Some of the threat can be mitigated by using VPNs, but this remedy has all the usual drawbacks that come with them. For one, VPNs are notorious for leaking metadata, DNS queries, and other traffic that can be useful to attackers, making the protection limited. And for another, finding a reputable and trustworthy VPN provider has historically proven to be vexingly difficult, though things have improved more recently. Ultimately, a VPN shouldn’t be regarded as much more than a bandage.

Another potential mitigation is using wireless VLANs to isolate one SSID from another. Zhou said such options aren’t universally available and are also “super easy to be configured wrong.” Specifically, he said VLANs can often be implemented in ways that allow “hopping vulnerabilities.” Further, Moore has argued why “VLANs are not a practical barrier” against all AirSnitch attacks

The most effective remedy may be to adopt a security stance known as zero trust, which treats each node inside a network as a potential adversary until it provides proof it can be trusted. This model is challenging for even well-funded enterprise organizations to adopt, although it’s becoming easier. It’s not clear if it will ever be feasible for more casual Wi-Fi users in homes and smaller businesses.

VLAN Hopping:

VLAN hopping - Wikipedia

en.wikipedia.org

Moore has argued why “VLANs are not a practical barrier” against all AirSnitch attacks:

New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and enterprises

That guest network you set up for your neighbors may not be as secure as you think. See full article...

arstechnica.com

 

[Lonesium]

Edited post to mention the presentation slides and added links to the tool on GitHub for educational purposes to evaluate your wifi network for client isolation vulnerabilities.

 

[GreenWine]

Hopefully this will make it onto the show, sounds quite interesting. Especially as VLAN's have been recommended by Steve for IoT isolation.

 

[mdwnn]

"Another potential mitigation is using wireless VLANs to isolate one SSID from another. Zhou said such options aren’t universally available and are also “super easy to be configured wrong.” Specifically, he said VLANs can often be implemented in ways that allow “hopping vulnerabilities.” Further, Moore has argued why “VLANs are not a practical barrier” against all AirSnitch attacks"

That is a blunt statement, but actually sounds more like the sales bingo card to sell expensive zero trust solutions (which are also super easy to be configured wrong).

Funny enough they also blog about the benefits of vlan segmentation. And no mention of hopping vulnerabilities (which are actually very hard to "implement" on modern network hardware).

Using runZero to verify network segmentation

Learn how runZero helps with effective network segmentation by reducing misconfigurations and improperly defined network boundaries, subnets and VLANS.

www.runzero.com