supernetworks
the router sniffed plaintext http to grab HTTP User agents to put them into a curl bash command line string. Nice RCE from the browser.
Router manufacturers competing into involution that ship RCE (much of which is triggerable from a web page) have created a substantial risk to consumers, in this case with a lens on the US market. The events of the FCC are not in isolation and have to do with not being able to boot actors out of many critical infrastructure networks. You can follow along with CISA on the various alerting that they do. https://www.cisa.gov/news-events/cybersecurity-advisories
We tackle hardware & software and prioritized network isolation as the first thing to resolve. We have tons on our blog and page about network security and have open source software.
It might be interesting to go and apply some of the sneaky packet injection mechanisms in this paper actually to try to bypass ARP spoofing defenses.
Ironically one of the main pain points is Apple. keychain sync means all the apple devices on the same sync account should share a password for wireless. Secondly the MAC randomization timeouts require reassignment.
The trouble with SAE per device passwords is that the commit makes it difficult to evaluate more than one password per pairing without knowing the identity of a device (the MAC) a-priori, which is why it's harder to find this deployed in production. It's possible for an AP to cycle through a few attempts but not many, whereas in WPA2 an AP could rotate through all the passwords without a commit. The standard needs to adapt.
WiFi provides half-way measures with client isolation features that break down when the packets hit L3, or in some cases the broadcast key implementations are deficient allowing L2 attacks. The paper is about all of the fun ways they could pivot across networks, and they figured out how to enable full bidirectional MITM in a wider class of attacks than commonly known or previously published.
However client isolation should be a tool people have at their disposal. Consider the need for people to buy cloud IOT devices and throw them on a guest network (https://arstechnica.com/security/2024/09/massive-china-state...). It's also about keeping web-browsers away from these devices during regular use, because there are paths for malicious web pages to break into IOT devices.
I work on https://supernetworks.org/. We propose a solution to these flaws with per-device VLANs and encourage per-device passwords as well.
More practically the risk for these attacks is as follows. A simple password makes sense for easy setup on a guest network, that's treated as untrusted. These passwords can probably be cracked from sniffing a WPA2 key exchange -- who cares says the threat model, the network is untrusted. But this attack lets the insecure network pivot out into the secure one.
"Notably, while probabilistic computers can emulate quantum interference with polynomial resources, their convergence is in general believed to require exponential time [10]. This challenge is known as the signproblem in Monte Carlo algorithms [11]."
i am still in the process of reading this article (https://arxiv.org/pdf/2408.06418) however entanglement witnesses can be realized in several ways and are one of the underlying aspects of how quantum networking can be made reliable.
under the category of heralded entanglement, one realization uses photons striking photo detectors after they meet in a beamsplitter under the hong-ou-mandel effect scenario. for type 1 entanglement with HOM: if the photons at the two input modes are identical, they always bunch due to quantum interference, and if the photons resulted from emissions in the respective quantum nodes those nodes are now entangled, and the detection is the classical signal that the entangled link was created. the nodes can now transmit information unidirectionally into the entangled qubits. for type 2 entanglement with HOM it's a little bit more complicated although the underlying concept of indistinguishability is what results in the entanglement just the same.
heres one experiment from oxford, https://www.nature.com/articles/s41586-024-08404-x, where they achieved this with high fidelity although the particular details of the beam splitter experiment are not as well detailed.
"The requeue-once rule is enforced by only allowing requeueing to the futex previously passed to futex_wait_requeue_pi as uaddr2, so it's not possible to requeue from A to B, then from B to C - but it is possible to requeue from B to B.
When this happens, if (!q.rt_waiter) passes, so rt_mutex_finish_proxy_lock is never called. (Also, AFAIK, free_pi_state is never called, which is true even without this weird requeue; in the case where futex_requeue calls requeue_pi_wake_futex directly, pi_state will sit around until it gets cleaned up in exit_pi_state_list when the thread exits. This is not a vulnerability.) futex_wait_requeue_pi exits, and various pointers to rt_waiter become dangling. "
"Riffling through other files, Mendax found mail confirming that the attack had indeed come from inside MILNET. His eyes grew wide as he read on. US military hackers had broken into MILNET systems, using them for target practice, and no-one had bothered to tell the system admin at the target site.
Mendax couldn't believe it. The US military was hacking its own computers. This discovery led to another, more disturbing, thought. If the US military was hacking its own computers for practice, what was it doing to other countries' computers? "
[1] https://github.com/spr-networks/super/blob/main/multicast_ud...
While we were not aware of these protocol flaws specifically, the project was inspired by fundamental weaknesses in secure wifi isolation. One of the attacks that's demonstrated in the scripts but not in the academic paper -- is that most routers will route UDP/IP packets between devices even when they are "isolated", so there are problems with most guest wifi networks even before mac stealer type attacks come into play.