Researchers Discover SSID Confusion Vulnerability in Wi-Fi

Security researchers have identified a vulnerability in the Wi-Fi IEEE 802.11 standard, known as SSID Confusion (CVE-2023-52424). This flaw allows attackers to trick victims into connecting to a less secure wireless network, enabling them to intercept and monitor the victim’s network traffic. The vulnerability affects all operating systems and Wi-Fi clients, including home and mesh networks using WEP, WPA3, 802.11X/EAP, and AMPE protocols.

How the SSID Confusion Attack Works

The core of the attack is to force the victim to downgrade and switch to a less secure network by spoofing the name (SSID) of a trusted network. This allows the attacker to intercept traffic or launch further attacks. According to a report by Top10VPN, created in collaboration with Professor Mathy Vanhoef from KU Leuven, the attack can also cause any VPN with an auto-disconnect feature on trusted networks to disconnect, leaving the victim’s traffic unprotected.

The underlying issue is that the Wi-Fi standard does not require the SSID to always be authenticated—authentication is only required when a device joins a specific network. As a result, an attacker can trick a user into connecting to an untrusted Wi-Fi network instead of the intended one, carrying out an adversary-in-the-middle (AitM) attack.

“In our attack, when the victim tries to connect to the TrustedNet network, we trick them into connecting to another network—WrongNet—which uses similar credentials,” the researchers explained. “As a result, the victim’s client will think and display to the user that they are connected to TrustedNet, when in reality they are connected to WrongNet.”

In other words, even if passwords and other credentials are mutually verified when connecting to a secure Wi-Fi network, there is no guarantee that the user is actually connected to the intended network.

Conditions Required for an SSID Confusion Attack

• The victim intends to connect to a trusted Wi-Fi network.
• A fraudulent network with the same authentication credentials as the real one is available to the victim.
• The attacker is in a position to perform an AitM attack between the victim and the trusted network.

How to Protect Against SSID Confusion

To defend against SSID Confusion, researchers recommend updating the Wi-Fi 802.11 standard to include the SSID in the four-way handshake used when connecting to secure networks. They also suggest improving the protection of beacons so that “the client can store a reference beacon containing the network’s SSID and verify its authenticity during the four-way handshake.”

Beacons are management frames periodically sent by wireless access points to announce their presence. They contain information about the SSID, network capabilities, and more.

“Networks can protect themselves from this attack by avoiding the reuse of credentials across different SSIDs,” the researchers add. “Corporate networks should use separate CommonNames for RADIUS servers, and home networks should use a unique password for each SSID.”