In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. Despite the various security mechanisms (e.g., WEP and WPA2/WPA3) implemented to safeguard Wi-Fi networks, our study reveals that an off path attacker can still extract sufficient information from the frame size side channel to hijack the victim's TCP connection. Our side channel attack is based on two significant findings: (i) response packets (e.g., ACK and RST) generated by TCP receivers vary in size, and (ii) the encrypted frames containing these response packets have consistent and distinguishable sizes. By observing the size of the victim's encrypted frames, the attacker can detect and hijack the victim's TCP connections. We validate the effectiveness of this side channel attack through two case studies, i.e., SSH DoS and web traffic manipulation. Furthermore, we conduct extensive measurements to evaluate the impact of our attack on real-world Wi-Fi networks. We test 30 popular wireless routers from 9 well-known vendors, and none of these routers can protect victims from our attack. Also, we implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 69 (86%) evaluated Wi-Fi networks. We have responsibly disclosed the vulnerability to the Wi-Fi Alliance and proposed several mitigation strategies to address this issue.

翻译：本文揭示了Wi-Fi网络中的一个基本侧信道，即可观察到的帧大小，攻击者可利用该侧信道发起TCP劫持攻击。尽管Wi-Fi网络实施了多种安全机制（如WEP和WPA2/WPA3），我们的研究表明，路径外攻击者仍能从帧大小侧信道中提取足够信息，从而劫持受害者的TCP连接。我们的侧信道攻击基于两个重要发现：（i）TCP接收器生成的响应数据包（如ACK和RST）大小不同；（ii）包含这些响应数据包的加密帧具有一致且可区分的大小。通过观察受害者加密帧的大小，攻击者可以检测并劫持受害者的TCP连接。我们通过两个案例研究（SSH拒绝服务攻击和Web流量操纵）验证了该侧信道攻击的有效性。此外，我们进行了大量测量以评估攻击对真实世界Wi-Fi网络的影响。我们测试了来自9家知名厂商的30款流行无线路由器，结果表明，这些路由器均无法保护受害者免受攻击。我们还在80个真实Wi-Fi网络中实施了攻击，并在69个（86%）评估网络中成功劫持了受害者的TCP连接。我们已向Wi-Fi联盟负责任地披露了这一漏洞，并提出了若干缓解策略以解决该问题。