Why does changing physical router not warn of possible man in the middle attack?

Question

Situation

I swapped out a dead router at home today. I setup the new router with the same SSID and encryption settings. The devices on my network acted like nothing had happened and are happily connected to the new router.

Question

If I swap out a physical host or VM using the same IP and using SSH for example, connect to that host, the thumbprints are different and problems ensue. Why does this not happen when switching out a router? I could think of a few cases where this could be done maliciously, so I'm surprised it works like this.

Answer 1

WiFi access points have no secret. They use a SSID, but they otherwise offer or know nothing that the client can validate. Every time a device (say, a laptop) connects to a WiFi router, it uses it as if it was a new router and expects nothing in particular from that router. Secrets are more on the client side: the router will require the device to demonstrate knowledge of the WiFi password.

With a SSH server, the server has a private/public key pair, and shows the public key, and the client records that public key. If the client reconnects, then it will require that the server uses the same public key as previously; otherwise, it will complain loudly (as you observe).

There is no such public key in a WiFi router. Clients are not actually interesting in knowing whether the router has changed or not, because the router is only meant to route data to the Internet, not to provide access to some sensitive data or receive sensitive data.

---

When you talk to your banker, you want to be sure that you have a genuine banker with you, because you will give him your money. When you talk to the cashier at a supermarket you don't care whether he is a real cashier or not, as long as you get to exit the supermarket with the food and security guards don't begin to shout at you.

Answer 2

Essentially the security on a wireless network is provided in the encryption key (for WPA2-PSK and WEP protected networks) or the authentication process for WPA2 enterprise networks).

An attacker who can get physical access to the access point and then replace it with their own hardware can compromise the security of the network (assuming they can extract the key from the device), so that's what needs to be protected to protect the system.

In the example you give about SSH it's that key exchange which provides the security so changing it causes alerts. The analagous situation in a wireless network would be an attacker setting up an Access Point with the same SSID but a different key.

Answer 3

As @Stefan Lasiewski, mentioned in a comment in a typical network there is little to no security down at the layer data link layer of the network (see OSI model).

But there are features present in some switches, and wifi devices to implement 802.1x which is a technology that provides for authentication and encryption at the link layer. These features are not present on low-end wifi equipment like you might find in your home since administering is very complex and the effort required to configure it properly is far beyond the risk most people face.