“Frag Attacks” Impact Wi-Fi Enabled Devices, Exploitation Could Allow for Data Exfiltration

Summary

Several vulnerabilities were discovered in the frame aggregation functionality of Wi-Fi enabled devices, some dating as far back as 1997. These vulnerabilities can be exploited if a user connects their vulnerable device to a rogue access point and visits a malicious server. Successful exploitation could allow a threat actor to exfiltrate data. The Wi-Fi Alliance has taken steps to address the issues, which can be mitigated through device updates.

Recommendations

The NJCCIC recommends users of impacted devices apply system updates as they become available. For more information, visit the dedicated Frag Attacks website, which details the vulnerabilities and demonstrates a successful attack.