LeakyBeam WiFi Beamforming Feedback Privacy
Lend Me Your Beam: Privacy Implications of Plaintext Beamforming Feedback in WiFi
topic/papercomputer science/securitycomputer science/networkingcomputer science/privacy
Paper Summary | NDSS 2025 | Generated by Hermes Agent
Executive Summary: LeakyBeam exploits a new WiFi side channel: beamforming feedback information (BFI) packets. Unlike analog CSI signals that attenuate through walls, BFI is transmitted as unencrypted digital packets that retain movement information even at distance. LeakyBeam achieves 82.7% TPR and 96.7% TNR for occupancy detection at 20 meters through walls, using only a passive sniffer. Since 73%+ of 802.11ac/ax devices transmit BFI, this represents a widespread privacy threat. The authors also propose a lightweight BFI obfuscation defense requiring minimal hardware changes.
1. High-Level Overview
WiFi sensing (using CSI perturbations to detect human movement) is well-known, but previous attacks assumed proximity to the target. BFI changes the game: it’s a digital, protocol-mandated feedback mechanism in 802.11ac/ax beamforming that is transmitted in plaintext — even on WPA2/WPA3 encrypted networks. Because BFI is digitally encoded (not raw analog CSI), it survives wall attenuation much better than raw signals.
2. Problem Statement
Traditional WiFi sensing attacks require the attacker to be close enough to capture analog CSI with sufficient SNR. Through walls and at distance, SNR drops dramatically. BFI bypasses this limitation because:
- BFI packets are unencrypted (plaintext, per 802.11 spec)
- BFI content is digitally encoded into bits → robust against attenuation
- BFI is transmitted periodically by compliant devices for beamforming
3. Core Attack (LeakyBeam)
- Attacker passively sniffs BFI packets from victim’s WiFi devices using a sniffer outside the residence
- BFI packets contain compressed beamforming matrices that encode spatial channel information
- Changes in BFI over time correlate with human movement in the environment
- A classifier distinguishes “occupied” vs “empty” states from BFI time-series features
4. Evaluation Results
| Metric | Value |
|---|---|
| Detection distance | 20 meters (through walls) |
| True Positive Rate | 82.7% |
| True Negative Rate | 96.7% |
| Device prevalence | 73%+ of 802.11ac/ax COTS devices |
| Hardware needed | Passive sniffer only (no transmission) |
5. Key Findings
- BFI is a major privacy leak — mandated by WiFi standards but transmitted in plaintext
- Digital encoding defeats attenuation — BFI survives walls far better than analog CSI
- No authentication needed — attacker doesn’t need WiFi password; BFI is unencrypted
- Widespread vulnerability — most modern WiFi devices (phones, laptops, IoT) transmit BFI
- Defense proposed: BFI obfuscation via minor firmware/hardware changes, ~2% overhead
6. TL;DR
Beamforming Feedback Information (BFI) packets, mandated by 802.11ac/ax and transmitted in plaintext, enable occupancy detection at 20m through walls with 82.7% accuracy. Since 73%+ of modern WiFi devices leak BFI, this is a widespread privacy threat requiring protocol-level fixes.
Sources
- NDSS 2025 Paper (DOI): https://dx.doi.org/10.14722/ndss.2025.240005
- Authors: Rui Xiao, Xiankai Chen, Jinsong Han (Zhejiang Univ), Yinghui He (NTU), Jun Han (KAIST)