Abstract:Modern Wi-Fi networks are commonly protected by the security mechanisms, e.g., WPA, WPA2 or WPA3, and thus it is difficult for an attacker (a malicious supplicant) to hijack the traffic of other supplicants as a man-in-the-middle (MITM). In traditional Evil Twins attacks, attackers may deploy a bogus wireless access point (AP) to hijack the victim supplicants' traffic (e.g., stealing credentials). In this paper, we uncover a new MITM attack that can evade the security mechanisms in Wi-Fi networks by spoofing the legitimate AP to send a forged ICMP redirect message to a victim supplicant and thus allow attackers to stealthily hijack the traffic from the victim supplicant without deploying any bogus AP. The core idea is to misuse the vulnerability of cross-layer interactions between WPAs and ICMP protocols, totally evading the link layer security mechanisms enforced by WPAs. We resolve two requirements to successfully launch our attack. First, when the attacker spoofs the legitimate AP to craft an ICMP redirect message, the legitimate AP cannot recognize and filter out those forged ICMP redirect messages. We uncover a new vulnerability (CVE-2022-25667) of the Network Processing Units (NPUs) in AP routers that restrict the AP routers from blocking fake ICMP error messages passing through the router. We test 55 popular wireless routers from 10 well-known AP vendors, and none of these routers can block the forged ICMP redirect messages due to this vulnerability. Second, we develop a new method to ensure the forged ICMP redirect message can evade the legitimacy check of the victim supplicant and then poison its routing table. We conduct an extensive measurement study on 122 real-world Wi-Fi networks, covering all prevalent Wi-Fi security modes. The experimental results show that 109 out of the 122 (89%) evaluated Wi-Fi networks are vulnerable to our attack. Besides notifying the vulnerability to the NPU manufacturers and the AP vendors, we develop two countermeasures to throttle the identified attack.

A Review of Man-in-the-Middle Attacks

Unveiling Vulnerabilities of Web Attacks Considering Man in the Middle Attack and Session Hijacking

Man in The Middle Attacks Against SSL/TLS: Mitigation and Defeat

Timing Analysis of SSL/TLS Man in the Middle Attacks

IoT and Man-in-the-Middle Attacks

Detection of man-in-the-middle attacks using physical layer wireless security techniques

Research on User Authentication Scheme against the Man-in-the-Middle Attack.

The Principle and Prevention of SSL Man-in-the-middle Attack

Analysis of Man-In-The-Middle of Attack on Bitcoin Address.

Study on Man-in-the-Middle Attack and Defending Techniques in IPv6 Network

An Overview of Network Confrontation in MANETs

Man-in-the-Middle Attacks Without Rogue AP: when WPAs Meet ICMP Redirects.

A Precise Model to Secure Systems on Ethernet Against Man-In-The-Middle Attack

Can MPTCP Secure Internet Communications from Man-in-the-Middle Attacks?

Seeing the Unseen: The REVEAL protocol to expose the wireless Man-in-the-Middle

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks

A Review: An Efficient and Reliable Secure Routing Mechanism with the Prevention of Attacks in Mobile Ad-Hoc Network (MANET)

Novel Mitm Attacks On Security Protocols In Sdn: A Feasibility Study

Prevention of Man-In-The-Middle Attack in Diffie-Hellman Key Exchange under Specific Environment

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

A Review of Techniques to Mitigate Sybil Attacks