AirSnitch Wi-Fi attack breaks client isolation in about 2 seconds

Why does Wi-Fi client isolation fail?

There is no industry-wide standard for client isolation. Each manufacturer built its own version, and the researchers found gaps in all of them. They describe three main routes.

The first abuses the group temporal key (GTK), a shared encryption key used to broadcast to every device on the network. An attacker can hide a packet meant for one victim inside what looks like a router broadcast, and the victim accepts it.

The second is called gateway bouncing. Many devices block direct device-to-device traffic at the MAC layer (hardware addresses) but not at the IP layer. So the attacker addresses data to the router and names the victim as the final IP destination. The router simply forwards it.

The third is port stealing. A modern access point has several connection points (BSSIDs) for different bands and for main and guest networks, each treated as a separate virtual port internally. If an attacker connects through, say, the guest network while spoofing the victim's MAC address, the access point believes the victim has moved and sends the victim's incoming traffic to the attacker.

What can an attacker actually do?

On an open guest network with no password, this leaks the victim's traffic without its usual encryption. Spoofing the router's own MAC address also captures traffic heading out to the internet.

Combining interception with re-injection gives a man-in-the-middle position that the victim barely notices. In tests, the team listened in from a guest network on a device on the main Wi-Fi without delay. They also sniffed a company's RADIUS authentication server traffic, cracked a password, and set up a rogue access point that captured traffic and credentials.