In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. Despite the various security mechanisms (e.g., WEP and WPA2/WPA3) implemented to safeguard Wi-Fi networks, our study reveals that an off path attacker can still extract sufficient information from the frame size side channel to hijack the victim's TCP connection. Our side channel attack is based on two significant findings: (i) response packets (e.g., ACK and RST) generated by TCP receivers vary in size, and (ii) the encrypted frames containing these response packets have consistent and distinguishable sizes. By observing the size of the victim's encrypted frames, the attacker can detect and hijack the victim's TCP connections. We validate the effectiveness of this side channel attack through two case studies, i.e., SSH DoS and web traffic manipulation. Precisely, our attack can terminate the victim's SSH session in 19 seconds and inject malicious data into the victim's web traffic within 28 seconds. Furthermore, we conduct extensive measurements to evaluate the impact of our attack on real-world Wi-Fi networks. We test 30 popular wireless routers from 9 well-known vendors, and none of these routers can protect victims from our attack. Besides, we implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 75 (93.75%) evaluated Wi-Fi networks. We have responsibly disclosed the vulnerability to the Wi-Fi Alliance and proposed several mitigation strategies to address this issue.

翻译：本文揭示了Wi-Fi网络中一个基础性的侧信道——可观测的帧大小，攻击者可利用该信道实施TCP劫持攻击。尽管Wi-Fi网络已部署多种安全机制（如WEP、WPA2/WPA3），我们的研究表明，路径外攻击者仍能从帧大小侧信道中提取足够信息以劫持受害者的TCP连接。该侧信道攻击基于两项重要发现：（i）TCP接收端生成的响应数据包（如ACK和RST）大小存在差异；（ii）包含这些响应数据包的加密帧具有一致且可区分的大小。通过观测受害者加密帧的大小，攻击者能够检测并劫持其TCP连接。我们通过两个案例研究验证了该侧信道攻击的有效性，即SSH拒绝服务攻击和网络流量操纵。具体而言，我们的攻击可在19秒内终止受害者的SSH会话，并在28秒内向受害者网络流量中注入恶意数据。此外，我们进行了大量实测以评估该攻击对真实Wi-Fi网络的影响。测试了来自9家知名厂商的30款主流无线路由器，所有路由器均无法保护受害者免受攻击。我们在80个真实Wi-Fi网络中实施了攻击，成功在75个（93.75%）被评估网络中劫持了受害者的TCP连接。我们已负责任地向Wi-Fi联盟披露该漏洞，并提出若干缓解策略以解决此问题。