Schneier on Security

Clive Robinson • March 9, 2026 9:57 AM

@ AlexT,

Like you, I’ve only had a brief look through the paper.

That said, the conclusion is quite short and the latter part of,

“We
believe that a root cause of these vulnerabilities is the missing
standardization of client isolation: this defense was added
by vendors without proper public review. However, we have
shown that client isolation is surprisingly tedious to get right
in modern Wi-Fi networks due to their complexity. Moreover,
we have shown that client isolation in home networks, which
is often a configuration option in routers, is fundamentally
flawed. We hope our work motivates standardization groups
to more rigorously specify the requirements of client isolation
and that Wi-Fi vendors will implement the same more securely.“

Is quite revealing in what it says, in that it basically portraits all parts of the design process as not what they could or should have been for a robust and secure system…

Clive Robinson • March 9, 2026 4:20 PM

@ ALL,

For those trying to read either the ARS article or the paper you first need to understand the notion of

1, A class of attacks.
2, Instances of attacks in a class.

The paper is about both… And thus so is the article. That is it’s about several different instances of attacks in a general class, all interoperating.

Thus the key bit in the ARS article is,

“The isolation can effectively be nullified through AirSnitch, the name the researchers gave to a series of attacks that capitalize on the newly discovered weaknesses.“

Note the plurals “attacks” and “weaknesses”

You also need to understand what happens with network,

1, Bridges
2, Switches
3, Routers

And what layers they do or do not operate at.

Worse that networks can be layered on top of each other. That is in normal use people get taught about a physical layer and assume it is the “base layer” often not realising or considering that it could be another high level network like X25 or another routed IP network. Or it could be another “implicit network” like having three different frequency 2.5GHz / 5.0GHz / 6.0GHz interfaces in the same “Access Point”(AP) that get the equivalent of “bridged or switched” into a single equivalent wired interface inside the lowest layers of the AP.

Hence the preceding paragraph,

“New research shows that behaviors that occur at the very lowest levels of the network stack make encryption—in any form, not just those that have been broken in the past—incapable of providing client isolation, an encryption-enabled protection promised by all router makers, that is intended to block direct communication between two or more connected clients.”

That is at the lowest physical layer you can have a legitimate user and an attacker. The first on say the 2.5GHz OTA interface with the second being on the 5GHz OTA interface.

If the attacker makes their MAC address the same as the legitimate user, then the AP will send traffic from higher layers in the stack to both the 2.5 and 5.0 interfaces, as well as also combining what is sent from both to higher layers in the network stack to appear as a single instance. Thus the higher layers see a single “device” not two… And Silo / isolation is broken in effect “covertly” to the higher layers in the ISO OSI seven layer stack.

Now consider the same going on at each of the three lower layers of the OSI network stack, as well as the extra hidden layers covered by layer 1 (Physical)…

Once you get that idea into your thinking process you need to understand why things have been done this way…

Put simply “lack of resources” there are only so many valid frequency channels and they each only have a limited bandwidth… Thus “channel bonding” or “interface bonding” are very real things to get increased bandwidth or reduced latency.

Oh and don’t forget users want or need to be in effect “mobile” and skip from channel to channel and AP to AP even though they may not be physically moving about, others around them are. So channels may become unusable due to multipath, jamming, or countless other reasons. The user need to be “frequency agile” or they get very upset…

To effectively “silo / isolate users” it needs to be done at the lowest layer and for basic technical reasons it’s not done that way because of “abstraction” due to issues of “resources” and “ambiguity”… Because you will in ordinary operation have a single user appearing on multiple interfaces simultaneously as they move, it can not be avoided…

This brings up the issue of where “crypto keys” or “KeyMat” used for the silo / issolation process actually are, and how they get used simultaneously and moved from interface to interface and remain working in what is an asynchronous model by necessity.

So don’t expect these issues to be solved any time soon.

Which means you have to “mitigate” either partially or fully at the higher layers of the ISO OSI model. By adopting a “no plaintext on the wire” model of operation (which is verboten in many organisations due to regulatory compliance for the likes of “insider trading” etc).

However other “Man in the Middle” attacks work even at these layers at the “key negotiation” time…

Which brings us back to,

1, Security
2, Efficiency
3, Workability / Interoperability

“Pick any two of three”, but remember

“Security -v- Efficiency”

Is always a trade off as I’ve been saying here and other places for many many years now. I’ve also been pointing out that network security in a “broadcast model” is hard, and both ends being mobile makes it not just very very hard but under some security models “impossible”.

If you want to dance to the tune of “user convenience” then you “have to pay the piper” his very very costly due.