Off-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets
summary
Claims a new timing side channel in half‑duplex IEEE 802.11 that enables off-path TCP injection by measuring uplink/downlink contention from a device reachable by malicious JavaScript. Attack works against macOS Windows Linux, requires only a router‑connected victim and an attacker server, and the authors build working exploits including a web cache poisoning demo that completes in 30 seconds under realistic conditions. Experiments span about 16 setups with multiple routers and show measurable RTT shifts (~2 ms locally, up to ~5 ms remotely).
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:25Demo
- 1:55Explanation
- 2:41History
- 5:44Passive Attack
- 6:26CPU Delay
- 7:15Half Duplex
- 8:20Interesting Errors
- 9:37Timing Difference
- 10:41Results
- 11:35Distance
- 11:56Penumbra Inference
- 14:06TCP Injection Results
- 14:35Web Poisoning Demo
- 16:23Real World Challenges
- 18:00Conclusions
- 18:47RFC 6013
related talks
30mOff-Path TCP Exploits: Global Rate Limit Considered Dangerous
34mPractical Side-Channel Attacks Against WPA-TKIP
50mOverTime: Remote Timing Attacks Against IoT Devices
27mWIFI-Important Remote Attack Surface: Threat is Expanding
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
38mTunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables
31mD1T1 - Covert Data Exfiltration Channel
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices