In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. Despite the various security mechanisms (e.g., WEP and WPA2/WPA3) implemented to safeguard Wi-Fi networks, our study reveals that an off path attacker can still extract sufficient information from the frame size side channel to hijack the victim's TCP connection. Our side channel attack is based on two significant findings: (i) response packets (e.g., ACK and RST) generated by TCP receivers vary in size, and (ii) the encrypted frames containing these response packets have consistent and distinguishable sizes. By observing the size of the victim's encrypted frames, the attacker can detect and hijack the victim's TCP connections. We validate the effectiveness of this side channel attack through two case studies, i.e., SSH DoS and web traffic manipulation. Furthermore, we conduct extensive measurements to evaluate the impact of our attack on real-world Wi-Fi networks. We test 30 popular wireless routers from 9 well-known vendors, and none of these routers can protect victims from our attack. Also, we implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 69 (86%) evaluated Wi-Fi networks. We have responsibly disclosed the vulnerability to the Wi-Fi Alliance and proposed several mitigation strategies to address this issue.

翻译：本文揭示了Wi-Fi网络中一个基础的侧信道——可观测的帧大小，攻击者可利用该侧信道实施TCP劫持攻击。尽管Wi-Fi网络部署了多种安全机制（如WEP和WPA2/WPA3），我们的研究表明，路径外攻击者仍能从帧大小侧信道中提取足够信息，劫持受害者的TCP连接。该侧信道攻击基于两项重要发现：（i）TCP接收端生成的响应数据包（如ACK和RST）大小存在差异；（ii）包含这些响应数据包的加密帧具有一致且可区分的大小。通过观测受害者加密帧的大小，攻击者能够检测并劫持受害者的TCP连接。我们通过两个案例研究（即SSH拒绝服务攻击和Web流量操纵）验证了该侧信道攻击的有效性。此外，我们开展了大量测量实验以评估该攻击在真实Wi-Fi网络中的影响。我们对来自9家知名厂商的30款主流无线路由器进行了测试，发现所有路由器均无法保护受害者免受攻击。同时，我们在80个真实Wi-Fi网络中实施了攻击，并在69个（86%）评估网络中成功劫持了受害者的TCP连接。我们已负责任地向Wi-Fi联盟披露该漏洞，并提出了多项缓解策略以解决该问题。