New AirSnitch attack techniques disclosed at NDSS 2026 break WPA2/WPA3-Enterprise client isolation, enabling full MitM positioning without cryptographic key compromise. Affects major OS/hardware vendors; requires urgent mitigation via VLANs, MAC/IP spoofing prevention, and MACsec.

In brief - AirSnitch exploits protocol-infrastructure gaps in WPA2/3-Enterprise to bypass client isolation, enabling traffic interception across access points. Mitigations include VLAN segmentation, GTK hardening, and device-to-device encryption.

Technically - AirSnitch leverages three primitives: Gateway Bouncing (router MAC + victim IP to bypass L2 isolation), Port Stealing (MAC spoofing across BSSIDs to redirect PTK-encrypted traffic), and Broadcast Reflection (unicast payloads in broadcast frames re-encrypted via GTK). GTK misuse allows insider attackers to spoof broadcast/multicast frames. Cross-AP attacks hijack MAC-to-port mappings at distribution switches, enabling RADIUS brute-forcing, rogue APs, and DTLS exploitation.

Source: https://unit42.paloaltonetworks.com/air-snitch-enterprise-wireless-attacks/

#Cybersecurity #ThreatIntel