New Wi-Fi ‘SSID Confusion’ Attack Let Attackers Connect To Malicious Network

A design flaw in the IEEE 802.11 standard allows for SSID spoofing in WPA2 and WPA3 networks.

While authentication protocols prevent unauthorized access points, they don’t guarantee that the SSID displayed on the client device matches the actual network’s SSID. 

The vulnerability enables attackers to create a rogue access point with a spoofed SSID, tricking clients into connecting while believing they are on a legitimate network.

Researchers demonstrated the attack’s effectiveness on various devices and proposed solutions, including improved standard protocols and backward-compatible defensive measures. 

A vulnerability in the 802.11 Wi-Fi standard allows attackers to spoof the SSID (network name) broadcasted by access points, which tricks client devices into connecting to a malicious network (WrongNet) while believing they are connected to a trusted one (TrustedNet).

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Even though credentials are encrypted and authenticated during connection, the SSID itself is not validated, which is particularly dangerous when trusted networks reuse credentials across different frequency bands (e.g., 2.4 GHz and 5 GHz). 

By spoofing the trusted SSID on the less secure 2.4 GHz band, attackers can potentially downgrade the connection and intercept traffic, especially if the victim’s VPN is automatically disabled upon connecting to a trusted network based solely on SSID recognition. 

Wi-Fi access points often broadcast two networks, one on 2.4 GHz and another on 5 GHz, to accommodate devices with varying Wi-Fi capabilities. 

The 2.4 GHz band may lack advanced security features and be more vulnerable to attacks due to potentially older access points, raising security concerns, especially when users rely on trusted network detection features of VPN services to automatically disable VPN connections. 

The research by Top10vpn identified a Wi-Fi attack exploiting identical enterprise authentication settings across different networks.

By scraping eduroam profiles, researchers found universities that shared RADIUS servers with eduroam, allowing them to impersonate those universities’ Wi-Fi and potentially intercept user traffic. 

The attack extends to public hotspots that share authentication with enterprise networks, enabling attackers to create fake hotspots that steal user data, it also identified vulnerable institutions based on Eduroam profile scraping, including universities and companies sharing authentication with public hotspots. 

A design flaw (CVE-2023-52424) in the 802.11 WiFi standard allows attackers to trick clients into connecting to malicious networks despite WPA3 protections by exploiting the fact that the network name (SSID) isn’t always authenticated during the connection process. 

Beacon framing, which transmits SSID information, can be spoofed to lure a client onto a rogue network.

To mitigate this, clients can verify beacon authenticity and SSID before data exchange or the standard can be updated to mandate SSID authentication during connection.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free