Loading story…
Researchers from the University of California, Riverside disclosed AirSnitch, a set of Wi‑Fi weaknesses that allow an attacker who is already connected to a network to impersonate another client and divert traffic in ways that defeat common assumptions behind client isolation. The technique exploits a lack of cryptographic binding between a client’s MAC address, Wi‑Fi encryption keys, and IP address across the lower layers of the networking stack, enabling what Ars Technica describes as cross‑layer identity desynchronization that can be leveraged for full bidirectional machine‑in‑the‑middle (MitM) interception and modification of traffic.
Both reports emphasize that AirSnitch is not a classic break of Wi‑Fi ciphers like WEP/WPA; instead, it targets overlooked behavior in Layers 1–2 and how identity is tracked across layers and network names (e.g., SSIDs). The researchers warned that these primitives could enable higher-level follow-on attacks such as cookie theft, DNS poisoning, and cache poisoning, and noted the work was presented at the 2026 Network and Distributed System Security Symposium (NDSS); the practical risk is highest where adversaries can gain any foothold on the same Wi‑Fi infrastructure (including scenarios involving multiple SSIDs or segments tied to the same access point).
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A Hacker News post shared 'AirSnitchAlerter,' a Raspberry Pi cloud-init configuration using Kismet, webhook, and email alerting to detect indicators associated with the newly disclosed AirSnitch attack. The author presented it as an interim defensive measure while awaiting vendor and standards-based mitigations.
Public reporting on the disclosure described four AirSnitch techniques, including abuse of shared group keys, gateway bouncing, and MAC spoofing to capture uplink or downlink traffic even when client isolation is enabled. The researchers said the attack can work on home, office, and enterprise Wi-Fi networks and is not limited to clients on the same SSID.
Lead author Xin’an Zhou presented the AirSnitch research at the 2026 Network and Distributed System Security Symposium. The presentation described how the technique can enable full bidirectional machine-in-the-middle attacks, traffic interception, and follow-on attacks such as cookie theft and DNS/cache poisoning.
Researchers from the University of California, Riverside found a class of Wi-Fi weaknesses they call AirSnitch, rooted in cross-layer identity desynchronization that lets attackers assume identities and divert traffic across Layers 1–3. They reported the issue across multiple consumer routers, open-source firmware distributions, and two university enterprise networks, indicating the problem is architectural rather than vendor-specific.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
news.ycombinator.com
Open sourcetomshardware.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported **AirSnitch**, a set of attack techniques that **bypass Wi‑Fi client isolation**—a common router/access point feature intended to prevent devices on the same network (e.g., guest Wi‑Fi) from communicating directly. The work indicates the issue is not a simple “Wi‑Fi encryption is broken” narrative; rather, an attacker who is already connected to the network can **impersonate other devices and intercept or manipulate traffic** that isolation controls were expected to block, undermining assumptions used in home, office, and enterprise deployments. The described methods enable **man-in-the-middle**, **traffic injection**, and **data interception** against both wireless and wired devices, leveraging weaknesses across areas such as group key handling and network forwarding/routing behavior. Reported techniques include **abuse of shared group keys**, **gateway bouncing**, **port stealing via MAC spoofing**, and **broadcast reflection**; testing found **all evaluated routers** were vulnerable to at least one technique, with potential follow-on impacts such as **cookie theft**, **DNS poisoning**, and broader session compromise. Recommended mitigations emphasize treating client isolation as insufficient as a primary boundary and prioritizing **network segmentation** and **strong end-to-end encryption**, alongside improvements to group key management.
Jun 29, 2026
Researchers disclosed two major Wi‑Fi weaknesses that undermined protections widely assumed to be provided by WPA2. The **KRACK** attack, discovered by Mathy Vanhoef, abused the WPA2 four-way handshake to force key reinstallation, allowing a nearby attacker to replay, decrypt, or forge traffic and in some cases hijack TCP sessions or inject malicious content. Because the flaw targeted the protocol rather than a single product, it affected home, office, and public Wi‑Fi environments across many vendors and platforms, with **Android 6.0 and Linux** described as especially exposed due to implementations that could reset encryption keys to all zeros; Windows and iOS were considered harder to exploit. Security agencies and vendors, including CERT/CC, NCSC, Microsoft, and Google, issued warnings and began releasing patches. A later disclosure, **KrØØk** (`CVE-2019-15126`), showed that unpatched **Broadcom** and **Cypress** Wi‑Fi chipsets could encrypt some packets with an all-zero key after disassociation, letting nearby attackers decrypt portions of wireless traffic. ESET said the bug affected more than **one billion devices**, including smartphones, laptops, IoT products, routers, and access points from vendors such as Amazon, Apple, Google, Samsung, Asus, Huawei, Xiaomi, and Raspberry Pi. Although KrØØk was related to KRACK, it was a distinct flaw, and both incidents reinforced the same operational guidance: changing a Wi‑Fi password does not fix protocol or chipset weaknesses, while timely firmware and OS updates, plus relying on **HTTPS**, **VPNs**, or other end-to-end encryption for sensitive activity, materially reduce exposure.
Jun 29, 2026
Researchers at the CISPA Helmholtz Center for Information Security disclosed six proximity-based vulnerabilities in Apple AirDrop and Google/Samsung Quick Share that could be exploited by attackers within wireless range or on the same local network. The issues include three denial-of-service flaws in AirDrop affecting privileged sharing and parsing components on macOS and iOS, two authentication and encryption bypass flaws in Samsung's Quick Share on Android, and a use-after-free bug in Google's Quick Share client for Windows that could potentially be exploitable. The findings show that both ecosystems expose significant pre-authentication attack surfaces despite using different implementations. Apple has reportedly fixed one AirDrop flaw and assigned a non-public `CVE`, while Google has patched the Windows Quick Share bug and issued a bounty, with its `CVE` still pending. The remaining Apple issues and the Samsung Quick Share flaws are still under coordinated disclosure or investigation, and no in-the-wild exploitation has been reported. Researchers also released a custom fuzzer, crash scripts, and protocol notes to help validate the bugs and support further testing across nearby-sharing features used on roughly five billion devices.
Jul 12, 2026