Full Report
Unit 42 research reveals AirSnitch attacks bypass WPA2/3 Wi-Fi encryption and client isolation, exposing critical infrastructure vulnerabilities. The post When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks appeared first on Unit 42.
Analysis Summary
# Vulnerability: AirSnitch Wi-Fi Encryption Bypass and Client Isolation Vulnerabilities
## CVE Details
- **CVE ID:** CVE-2024-52551, CVE-2024-52552
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-311 (Missing Encryption of Sensitive Data), CWE-668 (Exposure of Resource to Wrong Sphere)
## Affected Systems
- **Products:** Various Enterprise-grade Access Points (APs) and Wireless Controllers from multiple vendors.
- **Versions:** Impact depends on vendor-specific implementations of the IEEE 802.11 standards.
- **Configurations:** High-density Wi-Fi environments, specifically those utilizing WPA2/WPA3-Enterprise and Peer-to-Peer (P2P) communication / Client Isolation features.
## Vulnerability Description
AirSnitch is a collection of vulnerabilities that exploit how modern Wi-Fi devices handle **A-MSDU (Aggregated MAC Service Data Unit)** frames. The core flaw resides in the lack of cryptographic integrity protection for subframe headers within an encrypted A-MSDU.
An attacker can intercept an encrypted packet and, without knowing the encryption key, modify the source or destination MAC addresses within the subframe header. This allows for two primary attack types:
1. **Encryption Bypass (Downlink):** Forcing the AP to decrypt a packet for the attacker by manipulating the destination address.
2. **Client Isolation Bypass (Uplink):** Forcing the AP to bridge a packet to another client on the same network, even when "Client Isolation" or "Private VLAN" settings are enabled.
## Exploitation
- **Status:** Proof of Concept (PoC) developed by researchers; no known widespread exploitation in the wild.
- **Complexity:** Medium (Requires specialized equipment to perform frame injection/manipulation within the timing constraints of Wi-Fi protocols).
- **Attack Vector:** Adjacent (Attacker must be within radio range of the target Wi-Fi network).
## Impact
- **Confidentiality:** High (Ability to intercept and decrypt sensitive traffic directed at other clients).
- **Integrity:** Medium (Ability to inject or redirect packets within the wireless medium).
- **Availability:** Low (Primarily a data exposure/security control bypass).
## Remediation
### Patches
- Users must check with their specific wireless infrastructure vendors (e.g., Cisco, Aruba, Ruckus, Ubiquiti) for firmware updates addressing CVE-2024-52551 and CVE-2024-52552.
- Update wireless client drivers (Windows, Linux, Android, iOS) to the latest versions to ensure proper A-MSDU parsing.
### Workarounds
- **Disable A-MSDU:** If the vendor allows, disabling A-MSDU support on the Access Point can mitigate the attack vector, though this may result in a performance decrease.
- **Enhanced Encryption:** Transitioning to WPA3 with **Management Frame Protection (MFP)** required, although some AirSnitch variants can still bypass certain WPA3 implementations.
- **Network Segmentation:** Implement strict wired-side firewall rules and Zero Trust Network Access (ZTNA) to ensure that even if client isolation is bypassed, lateral movement is restricted at the network layer.
## Detection
- **Indicators of Compromise:** Unusual MAC address behavior where a single MAC address appears to be communicating via multiple encrypted sessions simultaneously.
- **Detection methods and tools:**
- Wireless Intrusion Prevention Systems (WIPS) can be configured to detect anomalous A-MSDU frame structures.
- Security researchers use modified versions of `scapy` or `aircrack-ng` suites to audit for vulnerability.
## References
- Unit 42 Research: hxxps[://]unit42[.]paloaltonetworks[.]com/air-snitch-enterprise-wireless-attacks/
- IEEE 802.11 Standard Documentation: hxxps[://]standards[.]ieee[.]org/standard/802_11-2020[.]html