Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack

Ziqiang Wang, Xuewei Feng, Qi Li, Kun Sun, Yuxiang Yang, Mengyuan Li, Ganqiu Du, Ke Xu, Jianping Wu

TL;DR

A fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks is unveiled and responsibly disclosed to the Wi-Fi Alliance.

Abstract

In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. Despite the various security mechanisms (e.g., WEP and WPA2/WPA3) implemented to safeguard Wi-Fi networks, our study reveals that an off path attacker can still extract sufficient information from the frame size side channel to hijack the victim's TCP connection. Our side channel attack is based on two significant findings: (i) response packets (e.g., ACK and RST) generated by TCP receivers vary in size, and (ii) the encrypted frames containing these response packets have consistent and distinguishable sizes. By observing the size of the victim's encrypted frames, the attacker can detect and hijack the victim's TCP connections. We validate the effectiveness of this side channel attack through two case studies, i.e., SSH DoS and web traffic manipulation. Precisely, our attack can terminate the victim's SSH session in 19 seconds and inject malicious data into the victim's web traffic within 28 seconds. Furthermore, we conduct extensive measurements to evaluate the impact of our attack on real-world Wi-Fi networks. We test 30 popular wireless routers from 9 well-known vendors, and none of these routers can protect victims from our attack. Besides, we implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 75 (93.75%) evaluated Wi-Fi networks. We have responsibly disclosed the vulnerability to the Wi-Fi Alliance and proposed several mitigation strategies to address this issue.

Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack

TL;DR

A fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks is unveiled and responsibly disclosed to the Wi-Fi Alliance.

Abstract

In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. Despite the various security mechanisms (e.g., WEP and WPA2/WPA3) implemented to safeguard Wi-Fi networks, our study reveals that an off path attacker can still extract sufficient information from the frame size side channel to hijack the victim's TCP connection. Our side channel attack is based on two significant findings: (i) response packets (e.g., ACK and RST) generated by TCP receivers vary in size, and (ii) the encrypted frames containing these response packets have consistent and distinguishable sizes. By observing the size of the victim's encrypted frames, the attacker can detect and hijack the victim's TCP connections. We validate the effectiveness of this side channel attack through two case studies, i.e., SSH DoS and web traffic manipulation. Precisely, our attack can terminate the victim's SSH session in 19 seconds and inject malicious data into the victim's web traffic within 28 seconds. Furthermore, we conduct extensive measurements to evaluate the impact of our attack on real-world Wi-Fi networks. We test 30 popular wireless routers from 9 well-known vendors, and none of these routers can protect victims from our attack. Besides, we implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 75 (93.75%) evaluated Wi-Fi networks. We have responsibly disclosed the vulnerability to the Wi-Fi Alliance and proposed several mitigation strategies to address this issue.
Paper Structure (21 sections, 9 figures, 4 tables)

This paper contains 21 sections, 9 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Threat Model
  3. TCP Hijacking with Encrypted Frame
  4. Attack Overview
  5. Identifying Victim and Detecting TCP Connections
  6. Inferring Sequence and Acknowledgment Numbers
  7. Verifying TCP Segment
  8. Inferring the Exact Sequence Number
  9. Inferring an Acceptable Acknowledgment Number
  10. Practical Considerations
  11. Case Study Attacks
  12. TCP DoS Attack
  13. TCP Manipulation Attack
  14. Real-world Attacks
  15. Analysis of AP Routers
  16. ...and 6 more sections

Figures (9)

  • Figure 1: The threat model.
  • Figure 2: Outline of our off-path TCP hijacking attack.
  • Figure 3: Sequence number window illustration.
  • Figure 4: Acknowledgment number window illustration.
  • Figure 5: Snapshot of obtaining the victim's IP address via DHCP.
  • ...and 4 more figures