New 'AirSnitch' Attack Shows Wi-Fi Client Isolation Could be a False Sense of Security

"Wi-Fi client isolation, also known as Access Point (AP) isolation or station isolation, is the security feature that ensures Wi-Fi clients cannot intercept, transmit, or inject traffic from or to other clients within the same wireless local area network. If client isolation is active, the primary role of the AP device in switching traffic from source to destination is no longer allowed."

"We believe that a root cause of these vulnerabilities is the missing standardization of client isolation. This defense was added by vendors without proper public review. The lack of standardization leads to inconsistent, ad hoc, and often incomplete implementations of isolation across vendors."

"The Wi-Fi keys that protect broadcast frames are improperly managed and can be abused to bypass client isolation. Most Wi-Fi implementations used a shared group temporal key to protect broadcast or multicast traffic, which represents a fundamental weakness in the isolation mechanism."

UC Riverside researchers and a collaborator from KU Leuven identified vulnerabilities in Wi-Fi client isolation, a security feature designed to prevent devices on the same network from intercepting or injecting traffic to each other. Every router and network tested was vulnerable to at least one attack. Client isolation normally blocks direct connections between devices, allowing only upstream traffic to the router, which prevents malware spread, snooping, port scanning, and ARP spoofing. The researchers attribute these vulnerabilities to the lack of standardization in client isolation implementations across vendors. Without proper public review during development, vendors created inconsistent and incomplete implementations. Three primary weaknesses were identified, including the abusing GTK attack, which exploits improper management of Wi-Fi keys protecting broadcast frames.

Read at SecurityWeek