Anonymity Nearest Neighbor Attack.

[Fixxx]

Nearest Neighbor Attack Method that Allows Attackers to Hack Wi-Fi Networks from the Other Side of the World.​

From an information security perspective, wireless networks are generally considered to be very localized. After all, to connect to them, one must be physically close to the access point. This characteristic significantly limits their use for attacks on organizations and thus reduces their perception as a likely attack vector. Simply because a person gets the impression that an abstract hacker from the Internet cannot just connect to corporate Wi-Fi. However, the recently discovered "nearest neighbor" attack demonstrates that this is not entirely true. A wireless network in a well-protected organization can become a convenient entry point for remote attackers if they first hack another, more vulnerable company whose office is located in the same building or in one of the neighboring ones. Here’s a closer look at how this works and what can be done to protect against such attacks.

Remote Attack on an Organization's Wireless Network​

Let’s assume there are some attackers who plan to remotely hack a certain organization. They gather information about this company, investigate its external perimeter, and may even find credentials of some employees in leaked password databases. However, they do not see any exploitable vulnerabilities, and they understand that all external services of the company have two-factor authentication enabled, so just having passwords is not enough. One potential method of penetration could be the corporate Wi-Fi network, which they could attempt to access using the same credentials. This is especially true if the organization has a guest Wi-Fi network that is not sufficiently isolated from the main network - two-factor authentication is rarely enabled for it. But there’s a problem: the attackers are on the other side of the globe and cannot physically connect to the office Wi-Fi.

​

This is where the "nearest neighbor" tactic comes into play. If the attackers conduct additional reconnaissance, they will likely discover many other organizations whose offices are within the Wi-Fi signal range of the targeted company. It cannot be ruled out that some of these neighboring organizations may be significantly more vulnerable than the original target of the attackers.​

Simply because the nature of these organizations' activities does not imply a serious risk of cyberattacks, they don't pay much attention to security. For example, they may not use two-factor authentication on their external resources or fail to update their software in a timely manner, providing attackers with convenient vulnerabilities to exploit. In any case, it's easier for the attackers to gain access to the network of one of these neighboring organizations. They then need to find and compromise a device connected to the wired network and equipped with a wireless module within the "neighboring" infrastructure. By scanning the Wi-Fi spectrum through it, the attackers can discover the SSID of the network of the company they are interested in. After that, using the compromised "neighboring" device as a bridge, the attackers will be able to connect to the corporate Wi-Fi network of their actual target. This way, they gain access inside the perimeter of the attacked organization. The initial task of the hackers will be accomplished and they can proceed to their main goal - stealing information, encrypting data, monitoring employee activities and so on.

How to Protect Against the "Nearest Neighbor" Attack​

It should be noted that this tactic has been used for some time by at least one APT group, so the danger is by no means theoretical. Therefore, organizations that have a chance of becoming victims of targeted attacks should start treating the security of their corporate wireless network with as much care as they do for resources connected to the Internet. In general, to protect against the "nearest neighbor" attack, is recommended the following:

• Ensure that the guest Wi-Fi network is truly isolated from the main network.
• Strengthen the security of connections to corporate Wi-Fi, using two-factor authentication with one-time codes or certificates.
• Enable two-factor authentication not only on external resources but also on internal ones.
• Use an advanced threat detection and prevention system.