Pierluigi Paganini July 02, 2015

Researchers discovered a vulnerability in the 802.11n wireless networking standard that could be exploited by a remote attacker to target wireless networks.

According to researchers from the Expertise Centre for Digital Media at the Hasselt University in Belgium, the frame aggregation mechanism implemented by the 802.11n wireless networking standard is affected by a security a vulnerability that can be exploited by a remote attacker.

The 802.11n standard is designed to increase the improve network throughput of wireless networks, their reliability and of course their security. The standard extends the range of wireless transmissions and implements a frame aggregation mechanism to the media access control (MAC) layer that reduces the overheads and increases throughput by sending two or more data frames in a single transmission.

The researchers illustrated a technique dubbed Packet-In-Packet (PIP) to inject arbitrary frames into wireless networks and interact with services on the internal network.

“The idea is this: Layer 1 radio protocols are vulnerable injections similar to those that plague naively implemented SQL websites. You can place one packet inside of another packet and have the inner packet drop out to become a frame of its own. We call the technique Packet-in-Packet, or PIP for short. ” wrote Travis Goodspeed in a blog Post.

The researchers published a research paper and a proof-of-concept (PoC) for the attack.

By exploiting the vulnerability an attacker implementing the Packet-In-Packet (PIP) technique can perform a number of malicious activities, including inject malicious beacon frames, bypass firewall rules, deauthenticate clients, scan host and ports, and execute Address Resolution Protocol (ARP) spoofing. The unique information requested to the attackers, in some attack scenarios, is the MAC address of the targeted access point.

The researchers explained that by exploiting the Packet-In-Packet (PIP) technique it is possible to inject malicious frame in every kind of payload, including images and videos.

“Author of the paper here. One of the more important improvements compared to other methods is that you can inject the frames remotely and without a Wi-Fi device. As a practical example, you could upload an image to imgur (as long as the service does not compress the images; this would change the data) and send a link of the image to a victim. Downloading the image would then result in frames being injected on the network as long as the network is open and supports aggregation. In the paper I provide an example how you could do a host scan in this manner, but that’s more tricky to pull off because many firewalls block egress traffic when there is no matching incoming request.” explained one of the experts in a discussion on Reddit. 

The attack works against almost any Wi-Fi chipset if the victims are connected to an open network and most important is that the attack can be launched without being in proximity of the targeted wireless networks and without requiring a wireless interface card.