When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks
Researchers have disclosed AirSnitch, a novel set of attack techniques that bypass WPA2 and WPA3-Enterprise Wi-Fi encryption and client isolation. By exploiting vulnerabilities in protocol-infrastructure interactions such as MAC address tables and routing layers, attackers can achieve Meddler-in-the-Middle (MitM) capabilities to intercept and inject traffic across enterprise networks.
Authors: Unit 42
Key Takeaways
- AirSnitch attacks bypass WPA2 and WPA3-Enterprise encryption and client isolation by exploiting low-level network state handling.
- Attackers can achieve Meddler-in-the-Middle (MitM) capabilities to intercept or inject traffic across enterprise networks.
- Novel attack primitives include Gateway Bouncing, Port Stealing, and Broadcast Reflection.
- Attacks can be launched across different BSSIDs, multiple APs, or even from the internet, breaking traditional physical isolation assumptions.
- Mitigation requires robust network segmentation (VLANs), MAC/IP spoofing prevention, and device-to-device encryption (MACsec).
Affected Systems
- WPA2
- WPA3-Enterprise
- Android
- macOS
- iOS
- Windows
- Ubuntu Linux
- Wi-Fi Access Points
Attack Chain
An attacker initiates an AirSnitch attack by targeting the wireless infrastructure's low-level state handling, such as MAC-to-port mappings. Using techniques like Port Stealing, Gateway Bouncing, or Broadcast Reflection, the attacker bypasses Layer 2 client isolation. This allows them to intercept downlink traffic, inject spoofed packets using extracted Group Temporal Keys (GTKs), and establish a bi-directional Meddler-in-the-Middle (MitM) position. Finally, the attacker leverages this position to launch higher-layer attacks, such as RADIUS brute-forcing, DTLS decryption, or DNS/DHCP poisoning.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but lists behavioral indicators of compromise related to MAC/port mapping anomalies and broadcast traffic spikes.
Detection Engineering Assessment
EDR Visibility: Low — The attacks occur at the network infrastructure layer (OSI Layers 1-3) and exploit Wi-Fi protocol handling, which is generally invisible to host-based EDRs. Network Visibility: High — Network sensors, wireless intrusion prevention systems (WIPS), and AP logs are required to detect MAC spoofing, port mapping changes, and anomalous broadcast traffic. Detection Difficulty: Hard — Differentiating malicious gateway bouncing or port stealing from legitimate network roaming or complex enterprise topologies requires deep baseline understanding and specialized wireless monitoring.
Required Log Sources
- Wireless AP Logs
- Switch Forwarding Tables
- RADIUS Authentication Logs
- WIPS Alerts
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for rapid or unexpected changes in MAC-to-port mappings on distribution switches or APs, which may indicate Port Stealing. | Switch/AP logs | Collection/MitM | Medium |
| Search for a high volume of multicast or broadcast frames that encapsulate unicast payloads originating from internal Wi-Fi clients. | Network packet captures | Execution/Injection | Low |
| Identify unexpected re-negotiations of session keys or Group Temporal Key (GTK) updates outside of standard periodic intervals. | Wireless AP logs | Credential Access/MitM | Medium |
Control Gaps
- Standard WPA2/WPA3-Enterprise client isolation
- Layer 2 AP isolation (ap_isolate=1)
Key Behavioral Indicators
- MAC address-to-port mapping changes
- Spoofed gateway MAC addresses
- Anomalous GTK updates
- Unicast payloads in broadcast frames
False Positive Assessment
- Medium. Behavioral indicators like MAC address changes or key re-negotiations can occur naturally in environments with high client mobility, roaming between APs, or unstable wireless connections.
Recommendations
Immediate Mitigation
- Ensure strict separation of guest SSIDs from WPA2/WPA3-Enterprise SSIDs.
- Audit and remove legacy or orphaned APs physically uplinked to the core network.
Infrastructure Hardening
- Implement VLANs to logically separate network segments and untrusted BSSIDs.
- Configure APs and switches to prevent MAC spoofing across multiple BSSIDs.
- Enable IP spoofing prevention to block gateway bouncing.
- Configure APs to use per-client randomized GTKs or disable downstream group-addressed forwarding (DGAF).
User Protection
- Update endpoint operating systems to the latest patched versions.
- Enforce robust VPN solutions for all intranet access, even when on the corporate Wi-Fi.
- Adopt device-to-device encryption such as MACsec (IEEE 802.1AE) where supported.
Security Awareness
- Educate network administrators on the limitations of standard Wi-Fi client isolation and the necessity of defense-in-depth for wireless networks.
MITRE ATT&CK Mapping
- T1557 - Adversary-in-the-Middle
- T1040 - Network Sniffing
- T1565.002 - Transmitted Data Manipulation
- T1110.001 - Password Guessing
- T1557.002 - ARP Cache Poisoning
