<a href="https://github.com/vanhoefm/macstealer">https://github.com/vanhoefm/macstealer</a><p>The tools used, and a better readable description of the actual attack.
Doesn’t seem like a fundamental flaw in the IEEE 802.11 spec, but rather an implementation issue. For example my previous startup (Anyfi Networks) implemented 802.11 in a split-MAC architecture where all encryption is done “in the cloud” and raw encrypted 802.11 frames are tunneled over IP. In such an architecture frames are encrypted long before being put in the power save queue in the access point.
Interesting!<p>This said, isn't it the same kind of attack that a malicious router (on the route between the sender and the receiver) could run? I.e. exploiting a plaintext connection?<p>It feels like using an encrypted connection like HTTPS prevents it, right?
To exploit this fully you would require a lot of info, on top of that you're not getting anything from encrypted TLS packets.<p>If you're passing around sensitive information with even TLS then you're already exposed to far easier attacks than this.<p>Interesting find but nothing to worry about overall.