With ICMP magic, you can snoop on vulnerable HiSilicon, Qualcomm-powered Wi-Fi A vulnerability identified in at least 55 Wi-Fi router models can be exploited by miscreants to spy on victims' data as it's sent over a wireless network. Eggheads in China and the US have published details of a security shortcoming in the network processing units (NPUs) in Qualcomm and HiSilicon chips found at the heart of …
"Also, the attacker needs to: be able to directly communicate with the victim's device via the Wi-Fi network"
So...
Scenario 1 - An SSID protected by WPA2/3 - They either need to crack the WPA-PSK before getting onto the network in the first place to execute the attack or
Scenario 2 - 'Guest/Public' WiFi - No WPA2/3 - I can't remember the last time I observed a public/open WiFi network that didn't isolate each wireless client from each other, either via on-AP subnetting or client isolation so would be much trickier in practice.
Sounds like it's not an easy fix though.. and once fixed it could have a fairly significant performance impact/overhead.
It's ultimately low-level chips that are forwarding spoofed traffic without thought. The crux is that the attacker and victim are connected to the same network. The attacker crafts an ICMP redirect packet with source of the router itself and destination of the victim and sends it. The router should immediately know that it can't *receive* a packet that it seemingly crafted and should drop the packet, but the low-level chips running it are simply forwarding the packet to the victim without questioning it. The argument seems to be that "it would take a lot of processing power to check every message so we don't" but in reality, no chip should forward this message as it didn't come from the device itself. Tighter controls around ensuring the sender *is* the sender is probably the fix, although equally controls that define the router has sent packets that it's purported to have sent would also fix this.
My interest is that it seems to have been proven on "all in one" router/wifi/?modem? networks (where there's no excuse as it operates all sides of the discussion and should know whether it originated these packets), but I wonder what would happen where the router, switch and multiple APs are distinct devices: would for instance a UniFi AP allow such an attack as at a chip-level it can't distinguish this packet came from another user and not from the router it expects to communicate with via a wired interface? What about in a mesh environment?
Well…
Egghead is also slang for a bald man…
It would seem boffin originated from military research.
Given the earliest reference to boffin seems to have been in the air force, I suspect it is a word play on Backroom boys that resulted in a word that sounded like a bird, which given the air force flies birds… lending the word some parallels with “a patchy server” which became “apache server”.
[https://wikidiff.com/egghead/boffin?utm_content=cmp-true , https://www.worldwidewords.org/topicalwords/tw-bof1.htm ]
Boffin, nearly bald - Professor Heinz Wolff, ticks all the boxes
https://www.theregister.com/2017/12/18/heinz_wolff_obituary/
Network folks may be tempted to solve problems like this by turning ICMP off completely. I mean who cares all that much about whether ping works? Unfortunately, there's a drawback. Something called Path MTU Discovery (PMTUD) depends on ICMP in both IPv4 and IPv6. Break PMTUD, and you may end up with something called Blackhole Routing. That sounds bad. And it is. What happens is that small message packets fly through to their destination. Large packets simply disappear. But the symptom people see is that some programs work fine. Others don't. Or maybe some options of some program work fine but others don't. This is not easy to diagnose and is harder to fix since the problem may be on someone else's computer. It's not even all that easy to figure out whose.
And yes, it really does happen. Back in my working days, I encountered it several times.
So, if you are tempted to improve your security profile by turning ICMP off, it might be a good idea to read and understand the Wikipedia article https://en.wikipedia.org/wiki/Path_MTU_Discovery Maybe it's OK to live without ICMP ... and maybe it isn't
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
