Sweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
summary
Two novel attacks abuse Wi‑Fi power‑save: one forces APs to buffer frames, then removes or changes keys so buffered traffic is sent under an undefined context — some APs leak frames in plaintext, others encrypt with an all‑zero key or the group key; tested vulnerable on Linux, NetBSD and several open‑source firmwares. The second attack spoofs sleep in association requests to bypass 802.11w and perform a client isolation bypass via MAC spoofing, intercepting pending replies; a GitHub tool and demos exist, Ubiquity shows a partial mitigation, VLANs and dropping buffered frames or authenticating the sleep bit are recommended fixes.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:37Background on WiFi security
- 4:21First attack
- 11:09Second attack
- 20:20What is client isolation
- 22:36Target
- 24:24Attack
- 29:36Fix
- 33:46Testing
- 34:21Root Cause
- 35:56Conclusion
related talks
27mWIFI-Important Remote Attack Surface: Threat is Expanding
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
34mPractical Side-Channel Attacks Against WPA-TKIP
27mPredicting, Decrypting, and Abusing WPA2/802.11 Group Keys
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
35mKr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices
33mWi-Fi Brokering
22mWhat really happens when you connect to public Wi-Fi?