Untangling the Knot: Breaking Access Control in Home Wireless Mesh Networks

Home wireless mesh networks (WMNs) are increasingly gaining popularity for their superior extensibility and signal coverage compared to traditional single-AP wireless networks. In particular, there is a single gateway node and multiple extender nodes that cooperate to provide wireless coverage. We observe that there is no comprehensive research conducted on the security aspects of the control plane of such networks. For example, this decentralized architecture enables each extender node to independently authenticate wireless clients by synchronizing access control policies from the gateway node. However, this synchronization unexpectedly opens an attack surface which has not been scrutinized. In our research, we conduct an empirical study investigating devices and protocols of six popular home wireless mesh network vendors, focusing on the attack surface introduced by the access policy synchronization. Interestingly, we find that the exact protocols used to support such functionalities vary by vendors, despite the existence of the EasyMesh standard that vendors could opt-in. Furthermore, we find a number of serious security flaws, including but not limited to malicious clients retaining their network access indefinitely and direct compromises of gateway and extender nodes in some cases. These issues arise due to the lack of coordination across different layers of protocols that work together to support the control plane. We reported all of our findings to the affected vendors and they have acknowledged the issues and are working towards fixes (most of the vendors have released patches). Finally, we discuss trade-offs in different existing designs, suggest alternative solutions, and summarize lessons learned from the research. CCS CONCEPTS • Security and privacy → Mobile and wireless security; Security protocols; Cryptanalysis and other attacks.