Link: https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

New research shows that behaviors that occur at the very lowest levels of the network stack make encryption—in any form, not just those that have been broken in the past—incapable of providing client isolation, an encryption-enabled protection promised by all router makers, that is intended to block direct communication between two or more connected clients.

The isolation can effectively be nullified through AirSnitch, the name the researchers gave to a series of attacks that capitalize on the newly discovered weaknesses. Various forms of AirSnitch work across a broad range of routers, including those from Netgear, D-Link, Ubiquiti, Cisco, and those running DD-WRT and OpenWrt.

AirSnitch “breaks worldwide Wi-Fi encryption, and it might have the potential to enable advanced cyberattacks,” Xin’an Zhou, the lead author of the research paper, said in an interview. “Advanced attacks can build on our primitives to [perform] cookie stealing, DNS and cache poisoning. Our research physically wiretaps the wire altogether so these sophisticated attacks will work. It’s really a threat to worldwide network security.” Zhou presented his research on Wednesday at the 2026 Network and Distributed System Security Symposium.

Unlike previous Wi-Fi attacks, AirSnitch exploits core features in Layers 1 and 2 and the failure to bind and synchronize a client across these and higher layers, other nodes, and other network names such as SSIDs (Service Set Identifiers). This cross-layer identity desynchronization is the key driver of AirSnitch attacks.

The most powerful such attack is a full, bidirectional machine-in-the-middle (MitM) attack, meaning the attacker can view and modify data before it makes its way to the intended recipient. The attacker can be on the same SSID, a separate one, or even a separate network segment tied to the same AP. It works against small Wi-Fi networks in both homes and offices and large networks in enterprises.

With the ability to intercept all link-layer traffic (that is, the traffic as it passes between Layers 1 and 2), an attacker can perform other attacks on higher layers. The most dire consequence occurs when an Internet connection isn’t encrypted—something that Google recently estimated occurred when as much as 6 percent and 20 percent of pages loaded on Windows and Linux, respectively. In these cases, the attacker can view and modify all traffic in the clear and steal authentication cookies, passwords, payment card details, and any other sensitive data. Since many company intranets are sent in plaintext, traffic from them can also be intercepted.

Even when HTTPS is in place, an attacker can still intercept domain look-up traffic and use DNS cache poisoning to corrupt tables stored by the target’s operating system. The AirSnitch MitM also puts the attacker in the position to wage attacks against vulnerabilities that may not be patched. Attackers can also see the external IP addresses hosting webpages being visited and often correlate them with the precise URL.

Wi-Fi has always been a risky proposition, and AirSnitch only expands the potential for malice. Then again, the new capabilities may mean little in the real world, where evil twin attacks accomplish many of the same objectives with much less hassle.

Even when HTTPS is in place, an attacker can still intercept domain look-up traffic and use DNS cache poisoning to ...

Aren't all modern browsers already doing DoT or DoH ?

I think DNS-over-TLS & DNS-over-HTTPS would be no less vulnerable than web-over-TLS & web-over-HTTPS.

AirSnitch doesn't break TLS/HTTPS at all. Only unencrypted plain DNS traffic is exposed. DoT and DoH are encrypted, so they're fine.

Even when HTTPS is in place, an attacker can still intercept domain look-up traffic and use DNS cache poisoning to corrupt tables stored by the target’s operating system. The AirSnitch MitM also puts the attacker in the position to wage attacks against vulnerabilities that may not be patched. Attackers can also see the external IP addresses hosting webpages being visited and often correlate them with the precise URL.

Even when HTTPS is in place, an attacker can still intercept domain look-up traffic (DNS)

this part has nothing to do with the attack.

It was always true.

Your ISP or anybody sitting on a network node could do that. Because DNS is not encrypted. It doesn't matter that the rest of the traffic, after the name resolution is HTTPS/TLS.

Thats why DoT/DoH was invented. To make DNS queries fully encrypted AND to make them look indistinguishable from normal traffic.

So if your system implements it properly, it can not be meaningfully intercepted and used in a poisoning attack.

The attack doesn't break HTTPS/TLS cryptography.

In my opinion, the whole article is (AI) slop. It says "AirSnitch" but is actually describing "ARP spoofing".

Encryption (especially TLS) assumes the underlying transport is insecure. It's called Transport Layer Security, a secure transport made possible by utilising encryption. It already had considered MitM by design.

I'm not disagreeing with anything you're saying and I think the articles about this are sensationalized in the impact in some ways, but I think you're focusing too much on the type of traffic that is typically encrypted with HTTPS/TLS.

I think the bigger issue is internal networks where it is still common to run non encrypted and/or unauthenticated services. This is particularly an issue when SSID segreagation (lile guest networks) was used to mitigate this kind of issue. The AirSniff paper shows that SSID isolation in many APs can be bypassed.