Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack

TL;DR

This paper uncovers a side channel in Wi-Fi networks based on frame size, enabling off-path TCP hijacking attacks that can compromise sessions despite existing security measures.

Contribution

The study reveals a novel side channel attack exploiting frame size variations to hijack TCP connections in Wi-Fi networks, demonstrating its effectiveness across multiple routers and real-world networks.

Findings

Attack can hijack TCP sessions in 93.75% of tested Wi-Fi networks.

Attack terminates SSH sessions in 19 seconds and injects data within 28 seconds.

None of the tested routers could prevent the attack.

Abstract

In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. Despite the various security mechanisms (e.g., WEP and WPA2/WPA3) implemented to safeguard Wi-Fi networks, our study reveals that an off path attacker can still extract sufficient information from the frame size side channel to hijack the victim's TCP connection. Our side channel attack is based on two significant findings: (i) response packets (e.g., ACK and RST) generated by TCP receivers vary in size, and (ii) the encrypted frames containing these response packets have consistent and distinguishable sizes. By observing the size of the victim's encrypted frames, the attacker can detect and hijack the victim's TCP connections. We validate the effectiveness of this side channel attack through two case studies, i.e., SSH DoS and web traffic manipulation. Precisely, our attack can terminate the victim's SSH session in 19 seconds and inject malicious data into the victim's web traffic within 28 seconds. Furthermore, we conduct extensive measurements to evaluate the impact of our attack on real-world Wi-Fi networks. We test 30 popular wireless routers from 9 well-known vendors, and none of these routers can protect victims from our attack. Besides, we implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 75 (93.75%) evaluated Wi-Fi networks. We have responsibly disclosed the vulnerability to the Wi-Fi Alliance and proposed several mitigation strategies to address this issue.