The dozen vulnerabilities affect all Wi-Fi security protocols since the wireless networking technology debuted in 1997, from WEP up through WPA3. One design flaw is in the frame aggregation functionality, and another two are in the frame fragmentation functionality, explains Vanhoef in his paper. These design flaws enable an adversary to forge encrypted frames in various ways, which in turn enables exfiltration of sensitive data.
He also identified flaws in the way frame aggregation – combining multiple network data frames – and frame fragmentation – splitting network data frames into smaller pieces – are implemented that magnify the impact of potential attacks.
The 802.11 frame aggregation flaw involves flipping an unauthenticated flag in a frame header, which allows the encrypted data payload to get parsed as if it were multiple aggregated frames instead of a simple network packet.
aggregation
attacks) which is a collection of new security vulnerabilities that affect Wi-Fi devices. An adversary that is within range of a victim s Wi-Fi network can abuse these vulnerabilities to steal user information or attack devices. Three of the discovered vulnerabilities are design flaws in the Wi-Fi standard and therefore affect most devices. On top of this, several other vulnerabilities were discovered that are caused by widespread programming mistakes in Wi-Fi products. Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities. The discovered vulnerabilities affect all modern security protocols of Wi-Fi, including the latest WPA3 specification.