AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks

AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks

Speakers: Xin'an Zhou

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=XiJQTQf5Jv4

Overview

Wi-Fi client isolation is widely assumed to prevent devices on the same network from intercepting each other's traffic. This talk introduces the AirSnitch framework, which demonstrates that client isolation can be bypassed across all WPA2 and WPA3 configurations -- including enterprise deployments -- by exploiting fundamental design flaws in how Wi-Fi protocols interact with the underlying network infrastructure. The vulnerabilities span from legacy WEP to modern WPA3 and enterprise standards, affecting mainstream operating systems including macOS, iOS, Android, Ubuntu, and Windows.

Presented by Xin'an Zhou, a senior staff researcher at Palo Alto Networks (OT Threat Research team) and UC Riverside PhD graduate, the research was a collaborative effort with KU Leuven. The core insight is that while WPA encryption protocols themselves are secure, the interaction between these protocols and the underlying infrastructure layer creates what the researchers call "ether" -- a hidden substrate formed by low-level protocol infrastructure interactions that has been obscured since Wi-Fi's inception. The AirSnitch tool is open-sourced on GitHub for researchers to measure their own networks.

Background

▶ Watch: Fundamental question: can two hosts share a MAC address on the same subnet? (0:00)

Client isolation in Wi-Fi networks is not a single mechanism but a composite of multiple layers: Wi-Fi encryption at the link layer, Layer 2 switching, and Layer 3 routing. An important finding is that while WPA enterprise prevents over-the-air sniffing, it notably fails to protect traffic beyond the link layer.

The isolation mechanisms include: WPA1/2/3 enterprise preventing over-the-air sniffing; intra-BSS ID isolation (the "AP isolate = 1" option in hostapd); inter-BSS ID isolation that blocks traffic between different BSS IDs connected to the same or different APs; and guest network configurations that separate untrusted SSIDs from the main network.

The researchers pose a fundamental question: can two hosts sharing the same MAC address coexist in the same subnet? Conventionally, this is considered a configuration error or impossible. However, the research shows that an adversary can manipulate the low-level "ether" to make this possible, and modern Wi-Fi inherits this fundamental design flaw from Ethernet.

Key Findings

▶ Watch: Three shared key abuse techniques: machine-on-the-side, rogue AP, GTK abuse (4:00)

The researchers developed multiple bypass techniques organized around three attack strategies:

Shared key abuse (three techniques): The machine-on-the-side attack works for WPA2 Personal by calculating the victim's PTK using the shared passphrase and observed randomness, allowing the attacker to read or write over-the-air traffic. The rogue AP bypass clones the AP using the shared passphrase to bypass client isolation on real APs. The GTK abuse technique exploits the Group Temporary Key in both personal and enterprise environments to deliver frames directly to victims over the air.

Ether exploitation via BSS ID virtualization: Wi-Fi treats every BSS ID on an AP as a virtualized hardware port, allowing two hosts with identical MAC addresses to coexist in the infrastructure's view. There is no strong synchronization between identities across protocol layers (Wi-Fi keys, MAC addresses, and IP addresses). By injecting spoofed frames using a valid PTK on a different BSS ID, the attacker confuses the AP's internal MAC-to-PTK mapping, redirecting traffic intended for the victim.

Gateway bouncing: When Layer 2 communication is restricted, the adversary encapsulates traffic so that the gateway inadvertently routes packets back to the victim, effectively circumventing Layer 3 isolation policies.

These vulnerabilities enable cross-AP attacks where the attacker intercepts traffic from a victim on another AP entirely, serving as primitives for TCP hijacking, DNS cache poisoning, and RADIUS passphrase guessing.

Technical Deep Dive

▶ Watch: BSS ID virtualization exploit: confusing AP's MAC-to-PTK mapping (4:45)

The BSS ID exploitation is the most technically novel finding. Before spoofing, the AP maintains a consistent mapping of MAC addresses to specific PTKs and physical ports. The attacker's goal is to inject spoofed frames using a valid PTK on a different BSS ID than the victim's BSS ID. This triggers Layer 2 learning on the AP, causing the AP to update its internal mapping and redirect the victim's traffic to the attacker's controlled interface.

The key requirement is that spoofed frames must use correct Wi-Fi keys on another BSS ID to trigger the Layer 2 learning mechanism. This works because the AP treats each BSS ID as an independent virtualized hardware port, and there is no cross-layer identity verification between the Wi-Fi key association and the MAC address table.

The gateway bouncing technique exploits the fact that even when direct peer-to-peer communication is blocked by the AP, traffic can still reach the victim indirectly through the gateway. The attacker crafts packets that the gateway processes and routes back into the wireless network toward the victim, bypassing the AP's isolation policy entirely.

The evaluation demonstrated that traffic interception and injection are highly prevalent on commercial off-the-shelf access points. Physical barriers or distance do not block attackers -- the attacks can succeed end-to-end regardless of physical separation. All mainstream operating systems are equally vulnerable.

Demo / Proof of Concept

▶ Watch: Multi-layered defense recommendations and open-source AirSnitch tool (6:30)

The evaluation covered commercial off-the-shelf access points across all WPA2 and WPA3 configurations. The researchers demonstrated successful traffic interception and injection across multiple operating systems: macOS, iOS, Android, Ubuntu, and Windows. The cross-AP attack capability was verified, showing that an attacker can intercept traffic from a victim connected to a completely different access point.

The practical exploit chain enables higher-layer attacks including TCP hijacking, DNS cache poisoning, and RADIUS passphrase guessing. The AirSnitch tool has been open-sourced on GitHub, allowing network administrators and researchers to assess the vulnerability of their own Wi-Fi deployments.

Defensive Implications

▶ Watch: Q&A: enterprise NAC considerations and beyond-WiFi implications (8:00)

The researchers recommend a multi-layered defense approach:

1. Improve client isolation at the AP level with more robust mechanisms that account for cross-BSS ID attacks
2. Deploy robust spoofing prevention at the networking layer
3. Randomize group keys to maximize isolation between clients
4. Standardize client isolation across the Wi-Fi specification rather than leaving it as a vendor-specific feature
5. Adopt device-to-device encryption to protect Wi-Fi traffic end-to-end rather than relying on the infrastructure's "ether"

The speaker acknowledged that in real enterprise networks with active monitoring and Network Access Control (NAC) systems, some attacks are harder to execute. Palo Alto Networks' own network, for example, uses intranet VPN that prevents attackers from accessing protected resources even if they bypass Wi-Fi isolation. However, the fundamental protocol-level vulnerability means the attacks may extend beyond Wi-Fi and Ethernet to other network architectures.

The core message is that building a secure door (WPA encryption) is useless if the architectural interaction allows someone to simply walk around it. True protection requires device-to-device encryption rather than reliance on infrastructure-level isolation.

Key Takeaways

• Wi-Fi client isolation can be bypassed across all WPA2 and WPA3 configurations, including enterprise deployments
• WPA encryption protocols are cryptographically secure, but their interaction with infrastructure creates exploitable gaps at Layers 2 and 3
• Two hosts with identical MAC addresses can coexist on the same network by exploiting BSS ID virtualization -- a scenario conventionally considered impossible
• Cross-AP attacks enable traffic interception across physically separate access points
• The bypasses enable practical higher-layer attacks: TCP hijacking, DNS cache poisoning, and RADIUS passphrase guessing
• The AirSnitch tool is open-sourced on GitHub for network vulnerability assessment
• Device-to-device encryption, not infrastructure-level isolation, is the proper defense

About the Speaker(s)

Xin'an Zhou received his PhD in Computer Science from UC Riverside and currently serves as a Senior Staff Researcher at Palo Alto Networks within the OT Threat Research team. His primary research focus is on the security of communication protocols. The research was conducted in collaboration with KU Leuven. Zhou demonstrated practical knowledge of both academic protocol analysis and real-world enterprise network deployments, noting that Palo Alto Networks' own network uses intranet VPN as an additional defense layer.