Wireless Side-Lobe Eavesdropping Attacks

Home , Main lobe, Side lobe

arXiv:1810.10157v1 [cs.CR] 24 Oct 2018 a iely rvn aedopn tak sn narrow, using attacks beams. eavesdropping directional prevent (ideally) can a throughput high offer networks wireless Millimeter-wave ABSTRACT ascudfi nsaldvcslk mrpoe,adcan and smartphones, like ( beams devices focused small highly generate on fit ar- could phased rays 60GHz example, For [1]. transmitters (mmWave) n a nyb oae ehncly hyaentsial f suitable not are They scenarios. mechanically. application rotated be only can and eeaigsga aclain mn utpeatna i array antennas phased multiple a among by cancellations built is signal beam leveraging narrow The endpoint transmission. two the the s capture between cannot (RX), directly receiver not attackers target nearby a that fo- towards highly layer. signal a physical send directional to the cused, (TX) at transmitter a eavesdroppers allows against Beamforming defend to ing qal rmsn direction promising equally data in counts and sizes packet 28]. [17, just sourc transmissions observing specific the by [2]. infer traffic tools still of can simple one via encryptions, 30] existing [11, pro- attacks security snooping recent by compromised successfully more been Even have wire- WPA2-PSK like many 36]. tocols in 34, exploited [33, been networks has less eaves- weakness easily more This are they wir dropped. that means fact broadcast The are counterparts. signals wired less its than attacks to ble INTRODUCTION 1. im- by defenses. eliminated proposed currently be or cannot hardware they proved and indoor settings, both in outdoor effective and highly are links mmWave thes on that transmissions attacks show mmWave We attacks. of eavesdropping properties side-lobe against security the of study oe,sgasta ar h aesniiedt stemain the as data side sensitive exhibit same lobe. the all carry arrays that antenna signals today’s lobes, mean hardware cal applications, throughput. Gbps achieving while nas) ihdrcinlt n hogptfrln-ag communi long-range for its throughput leverage mmWave and directionality of high applications new [10], headsets ity 1 ed o osdrhr nensa hyaebly expensive bulky, are they as antennas horn consider not do We hl ecniu oipoeecyto loihs an algorithms, encryption improve to continue we While vulnera- more been always has communication Wireless hl ale plctosfcsdo hr-ag indoor short-range on focused applications earlier While u okpeet eut ftefis experimental first the of results presents work Our az h,Yn Ju Ying Zhu, Yanzi e.g., 1 n sms aiybiton built easily most is and , ieesSd-oeEvsrpigAttacks Eavesdropping Side-Lobe Wireless oerues[]adwrls ita real- virtual wireless and [8] routers home notntl,ipretosi physi- in imperfections Unfortunately, nvriyo aiona at Barbara Santa California, of University st s ieesbeamform- wireless use to is e.g., † { tt ai oioigCenter Monitoring Radio State az,bolunwang yanzi, { encyn aebn htzheng ravenben, jennacryan, §† 3 ◦ ou ag en Cryan Jenna Wang, Bolun , sn 32 using millimeter-wave × 2anten- 32 Despite } rour or c.cbeu [email protected], @cs.ucsb.edu, nd es e- n o e s - , 1 in steatfc farray transmi of directional artifact of the is aspect sions under-studied One i mmWave critical. of properties physical understanding plications, 42]. 32, [29, network 5G next [5]. towards mmWave cost signals using reduce networks to picocell mmWave proposed have with Academics consider- fiber is wired Google replacing [7]. ing com- Jose 60GHz San downtown using in network munications mesh a deployed. deployed been has already Facebook have applications such Many cation. oeevsrpigattacks. side- eavesdropping against lobe communications mmWave of properties curity eliminate. physical to As difficult very are transmission. they exploited the imperfections, be recover can to and eavesdroppers information, by same lobe, the main carry the lobes than side weaker cancellat While signal imperfect elements. direc of antenna different results among in are pointing lobes lobes Side side tions. of series the of ample cnro.Seicly ease he e questions: key outdoor three and answer indoor we Specifically, both scenarios. in eavesdropping effectiv side-lobe the of evaluate ness to [4] project Terragraph Facebook’s communications. long-ran vali for never especially is measurements, network it using [25], dated leakage side-lobe of problem the shown • • • rpatcs ( eaves- attacks? side-lobe drop against effective defenses existing Are deploying and elements. antennas antenna more re from after artifacts even possible hardware still moving is lobes side again Eavesdropping defend im- fully it. the not but reduce attack, eavesdropping only the can of pact hardware improved that find We eoe rnmsini ag rawt ihscesrate success high below). with (details area large a can in Attacker transmission scenarios. recover outdoor and indoor ef- both incredibly in is fective eavesdropping side-lobe that observe We ihagoignme fdpoe ewrsadap- and networks deployed of number growing a With a etrmWv adaeipoescrt?( security? improve hardware mmWave better Can nti ae,w odc h rteprclsuyo h se- the of study empirical first the conduct we paper, this In o eeei maesd-oeevsrpig ( eavesdropping? side-lobe mmWave is severe How aedopn ra r once,adteatce can attacks. stealthy attacker launch the and freely and move connected, are areas eavesdropping Peer-to-Peer Picocell Mesh ( Area Eavesdropping ‡ } nvriyo Chicago of University § @cs.uchicago.edu ia ioogUniversity Jiaotong Xi’an ‡ e .Zhao Y. Ben , eueacmeca 0H ete from testbed 60GHz commercial a use We atclryfrotorseais most scenarios, outdoor for Particularly § 5) m 2 ) lhuheitn eessshow defenses existing Although ‡ ielobes side atoZheng Haitao , > hl hoeia tde have studies theoretical While 16.6 109 takrsPce ucs Rate Success Packet Attacker’s 10% 79 i.1sosa ex- an shows 1 Fig. . > 15.7 88.6 64.6 50% ‡ > 13.1 54 55 95% § § ion 4) 3) ge e- s- s - - - st TX RX Examined promising results against single-device eavesdroppers, they Scenario Distance Max Area EIRP Height Height either impose impractical hardware requirements, or re- to TX Throughput (m2) (dBm) (m) (m) main vulnerable against more advanced attackers, e.g., those (m) (Gbps) Mesh 32 6 200 6 1.0 10×20 with multiple devices. Picocell 32 6 50 1 1.5 10×20 Peer-to-Peer 23 1 10 1 1.5 4×5 2. BACKGROUND Table 1: Detailed experiment setup and configurations. To provide context for later study, we first describe the adversarial model and then our measurement methodology. Isotropically Radiated Power (EIRP) of 32dBm, supporting Adversarial Model. We consider passive eavesdropping, 1Gbps (QPSK) transmissions at 200m range (line-of-sight). where an attacker listens to side-lobe signals and recovers But we could re-purpose these radios for picocell and peer- packet header or payload. The attacker stays hidden from to-peer scenarios as well, by lowering the EIRP. Each receiv- its victim TX and RX, but is unable to manipulate the com- ing radio can report received signal-to-noise-ratio (SNR) of munication between the victims. Without knowing the at- each packet in real time. tacker’s physical location, victims cannot apply conventional Measurement Setup. We place our testbed radios at dif- defenses like null-forming2. ferent heights and distances apart to emulate the three ap- We do not consider eavesdropping attacks on the main plication scenarios. In all scenarios, TX sends 32KB TCP lobe of the transmission. Such an attack would affect the packets to RX at 1Gbps by default. Equipment placement communication between TX and RX, as the attacker has to details and specifications are listed in Table 1. In particular stay inside the main lobe or use a reflector, and thus can be for (c) peer-to-peer, we choose 23dBm EIRP the same as the detected [35]. Finally, we assume the attacker has one or commodity 60GHz chipset from Wilocity [9]. Given TX’s more synchronized devices as powerful as the victim’s hard- EIRP and the distance from victim RX to TX, RX can at ware. The attacker knows the victim’s location and hard- best communicate with TX at 1Gbps, 1.5Gbps, and 1.5Gbps ware configuration3. The attacker and his device(s) are free with less than 5% packet loss in mesh, picocell, and peer-to- to move around the victims. peer networks, respectively. Further reducing TX power will Application Scenarios. We consider three practical sce- affect RX’s performance. narios where mmWave signals are commonly used: mesh During transmission, we move the attacker radio around networks [7], picocell networks [42], and indoor peer-to- TX to eavesdrop side lobes at different locations. We grid the area around TX (200m2 for two outdoor scenarios and peer transmissions [8, 10]. Fig. 2 shows an illustration of 2 the three. 20m for the indoor scenario) into 816 (34×24) rectangles. mmWave signals are commonly considered for indoor peer- In each grid, we face the attacker radio at TX and eaves- to-peer scenarios (Fig. 2(c)), e.g., virtual reality [10, 12] and drop the transmission for 30s. Our testbed could record 100k wireless display [3]. Here TX and RX are within very short packet samples and 30 SNR values in each grid. In each ap- range (≤10m)and oftenat thesame height(∼1m). As mmWave plication scenario, we collected a total of 80 million packets signals degrade much faster than lower frequency signals in and 24k SNR measurements. the air, it is less known that they can also be used outdoor 3. EFFECTIVENESS OF EAVESDROPPING for long-range communications (20–200m). For example, Facebook has deployed a mesh network in downtown San From our collected measurements, we now present the Jose [7], supporting up to 200m link using 60GHz phased severity of side-lobe eavesdropping under three mmWave array radios4. Researchers [29, 42] also propose picocell network scenarios. We use the following two metrics to networks using 60GHz signals. In both scenarios, TX is quantify the effectiveness of side-lobe eavesdropping. mounted higher than human height, e.g., 6m. Depending on • Packet success rate (PSR) measures the percentage of pack- the scenario, RX is either mounted at a similar height or on ets the attacker could successfully retrieve from eaves- the ground, shown in Fig. 2(a) and (b), respectively. dropping through side lobes, calculated from 100k packets Measurement Hardware. Our testbed consists of three per location. When the attacker’s PSR is no less than that identical 60GHz radios. We use them as TX, RX, and the of the victim RX (>95% in our experiments), we consider attacker. Each radio has a 16×8 rectangular phased array ittobea full attack. (Fig. 3) and follows the 802.11ad single-carrier standard for • Eavesdropping area measures the area where the attacker 60GHz communication [6]. Our radios are designed for out- can achieve PSR higher than a given threshold by eaves- door mesh network scenario with a maximum Equivalent dropping on side lobe signals.

2If TX knows the attacker’s location, it can change its radiation 3.1 Mesh Network pattern to nullify signals towards that location to avoid attacks [15]. We begin by showing the effectiveness of eavesdropping 3This information is often publicly available, or could be derived from simple techniques, e.g., device localization. in an outdoor mesh network. During transmission, the main 4Compared to horn antennas, phased arrays offer robust real-time lobe points towards RX and side lobes point towards the link adaptation by eliminating mechanical steering. ground. The eavesdropper moves freely on the ground and

2 30 TX RX TX Aacker Main Lobe Side Lobes Main y 20 Lobe Aacker RX RX 10 TX Side y y Aacker 0 Lobes x x x -10 Antenna Gain (dB) -90 -60 -30 0 30 60 90 (a) Mesh Network (b) Picocell Network (c) Peer-to-Peer Network Angle (deg) Figure 2: Illustration of three application scenarios we test the eavesdropping at- Figure 1: Example of side lobes of tack. Attacker could eavesdrop through side lobes (blue) to decode information a 16×8 array (horizontal plane). transmitted in the main lobe (red).

in a large area. Within 109m2, the attacker could decode 60GHz Phased at least one packet, which is 54.5% of the entire examined 2 2 Array Antennas area. An area of 54m within this 109m allows the attacker to eavesdrop with >95% PSR, thus fully recovering Development the victim’s transmission. The ratio of eavesdropping area to Board the entire examined area is comparable to the mesh network scenario, which indicates similar levels of effectiveness of Figure 3: Our 60GHz testbed with 16×8 antenna array. the eavesdropping attack. Interestingly, in both the mesh and picocell networks, the searches for locations where he could hear side-lobe signals. area of connected eavesdropping locations grows larger as Fig. 4(a) shows the attacker’s PSR at different locations, and the attacker moves away from TX. This seems counter-intuitive, how the eavesdropping area changes. since signals become weaker at farther distances due to prop- From the heatmap in the figure, we observe that the at- agation loss. However, in outdoor scenarios, the projection tack is proved very effective. In 79m2 out of the 200m2 ex- of side lobes on the ground grows larger at farther distances. amined area, the attacker could successfully decode at least Despite the propagation loss, the side lobes remain strong one packet. Aggregated, the eavesdropping area accounts enough for the attacker to successfully decode the transmis- for 39.5% of the entire area. Large connected portions allow sion, given the sufficiently high TX power for transmissions an attacker to act more stealthily by moving freely through at distances over 100m. This finding appears more obvi- areas as large as 23m2 rather than staying in one location. ous in the picocell network because TX’s beams point down- Note that all eavesdropping areas center along TX’s trans- wards, causing less propagation loss through side lobes. mission direction (along the x-axis). This allows the attacker Increasing link rate reduces eavesdropping area. Dif- to easily predict vulnerable areas to launch attacks, because ferent from the mesh network, where RX remains stationary side lobes along the x-axis are strong enough for eavesdrop- and achieves at most 1Gbps throughput, the victim RX in ping, while other side lobes pointing away from the x-axis picocell is mobile. As RX moves closer to TX, RX could suffer higher signal loss (>13dB) and become too weak. achieve higher SNR and increase data rate up to 1.5Gbps, We further investigated how the eavesdroppingarea changes while maintaining >95% PSR. We re-configured the testbed given different PSR thresholds. As shown in the lower figure to transmit at 1.5Gbps, and measured the correspondingPSR in Fig. 4(a), the eavesdropping area reduces very slowly as at different locations. The lower figure in Fig. 4(b) shows we increase the PSR threshold. When requiring the attacker a smaller eavesdropping area when TX increases data rate to achieve >50% PSR, the eavesdropping area reduces only from 1Gbps to 1.5Gbps. On average, this reduces the eaves- 2 by 19%, down to 64m2. Moreover, in a 55m2 area (69.6% dropping area by 24m . In particular, when requiring the of the total eavesdropping area), the attacker could achieve attacker to have >95%, increasing throughput reduces the 2 2 >95% PSR, the same performanceachievedby RX. This fur- eavesdropping area from 54m to 31m . The area reduces ther shows the incredible effectiveness of an eavesdropping because increasing the legit transmission rate also raises the attack in a mesh network scenario. channel quality requirement at the eavesdropper, thus miti- Our measurements for the mesh network cover 200m2 gating the attack to some extent. Yet it does not fully solve area and already show the severity of side-lobe eavesdrop- the problem, as the attacker could still successfully decode ping. Although not shown in figure, we found that more packets in a large area. eavesdropping locations also exist outside the examined area, e.g., >20m away from TX. We leave further investigation of 3.3 Peer-to-Peer Network these areas to future work. Fig. 4(c) shows the eavesdropping performance in a peer- to-peer scenario. In a connected area of 16.6m2 the attacker 3.2 Picocell Network could decode at least one packet. The area is significantly Fig. 4(b) shows the eavesdropping results in a picocell large (83%), compared to the 20m2 total examined area. network scenario. Similar to the mesh network scenario, When requiring >95% PSR, the attacker could still decode the attacker could successfully eavesdrop the transmission the transmission in 65% (13.1m2) of the total area.

3 Eavesdropper PSR Eavesdropper PSR Eavesdropper PSR 5 1 5 1 2 1 2.5 0.8 2.5 0.8 1 0.8 0.6 0.6 0.6 0 0 0 0.4 0.4 0.4 -2.5 0.2 -2.5 0.2 -1 0.2

Location y (m) -5 0 Location y (m) -5 0 Location y (m) -2 0 0 5 10 15 20 0 5 10 15 20 0 1 2 3 4 5 Location x (m) Location x (m) Location x (m)

100 120 20

) 80 ) ) 2 2 90 2 15 60 60 10 40 1Gbps 1Gbps Area (m 20 Area (m 30 Area (m 5 1Gbps 1.5Gbps 1.5Gbps Eavesdropping 0 Eavesdropping 0 Eavesdropping 0 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 Eavesdropper PSR Eavesdropper PSR Eavesdropper PSR (a) Mesh Network (b) Picocell Network (c) Peer-to-Peer Network

Figure 4: Effectiveness of side-lobe eavesdropping under three mmWave scenarios. For each scenario, the top plot shows attacker’s packet success rate (PSR) at 1Gbps at different side-lobe locations. TX is at (0, 0) and beams towards RX along x-axis. The bottom one shows how the eavesdropping area changes with PSR thresholds at different link rates.

Similar to the picocellscenario, bothRX and TX can move 30 Our Testbed Perfect freely, causing different distances between RX and TX. This 20 allows higher SNR and higher link rate without degrading 10 RX’s PSR, but again, it cannot remove the eavesdropping area completely. Still, in an area of 7m2, the attacker could 0 > Antenna Gain (dB) -10 decode transmissions with 95% PSR. -90 -60 -30 0 30 60 90 Note that the shape of eavesdropping area in the peer-to- Angle from TX (deg) peer scenario differs from those in the other two scenarios. Figure 5: Antenna artifacts cause side lobe distortions. This is mainly because TX sits at a much lower height than the other two scenarios. The attacker resides on the same 4. IMPACT OF RADIO HARDWARE plane of TX and RX, and captures the side-lobe signals on the horizontal plane. As such, the eavesdropping area fol- So far we have empirically measured the eavesdropping lows a similar shape of the side-lobe beam pattern (Fig. 1), area using off-the-shelf 60GHz devices (16×8 phased ar- rather than the circular ones observed in mesh and picocell rays). In this section, we further explore whether upgrading networks. This observation of different shapes within eaves- array hardware can help reduce the impact of eavesdropping dropping areas could better guide the attacker’s predictions attacks. Specifically, there are two immediate ways to im- for where to launch attacks based on a targeted scenario. prove mmWave array hardware and reduce side-lobe emis- Although the eavesdropping area in an indoor scenario ac- sions: (1) removing implementation artifacts from the an- counts for a larger portion of the examined area than the tenna radiation pattern, (2) increasing the number of antenna outdoor scenarios, its absolute size is significantly smaller, elements. Fig. 5 compares the ideal antenna radiation pattern thus with less potential threat. Moreover, 60GHz signals can and that of our current hardware. While the current hard- hardly penetrate walls, so the eavesdropping area for the in- ware faces distortions on side-lobe emissions, the ideal array door scenario remains bounded by its room size, further re- implementation would produce weaker, less detectable side stricting the attacker’s mobility and effectiveness of eaves- lobes. Similarly, increasing the number of antennas can also dropping. Therefore, side-lobe eavesdropping proves much reduce the emission power of side lobes [16], thereby reduc- more severe in the prior two outdoor scenarios. ing the performance of an eavesdropping attack. In the following, we study how upgrading radio hardware would reduce the eavesdropping effectiveness. To emulate 3.4 Summary hardware configurations different from our testbed, we used In all scenarios, we find that a passive attacker could ef- trace-driven simulations. Specifically, we apply the Friis fectively eavesdrop transmissions with very high PSR in a free-space propagation model [22] to compute an attacker’s large area. This shows that despite the directional nature of SNR at different locations. All of our testbed measurements, mmWave beamforming transmission, side lobes still expose along with prior works [42, 40], show that this model can a significant amount of information. Increasing transmission accurately estimate the SNR in line-of-sight with very small rate slightly mitigates the threat, but cannot effectively de- errors (±1dB). At each location, we map simulated SNR fend against the eavesdropping attack. to PSR using the empirical correlation derived from previ-

4 ) ) ) 2 200 2 120 2 35 Testbed (PSR>0) Picocell Perfect (PSR>0) 100 Mesh 30 150 Perfect (PSR>0.95) 80 Peer-to-Peer 25 20 100 60 15 40 50 10 20 5 0 0 0

Eavesdropping Area (m Mesh Picocell Indoor Eavesdropping Area (m 0 8 16 24 32 40 48 56 64 Eavesdropping Area (m 1m 2m 3m Network Network Peer-to-Peer Number of Antennas (One-Dimension) Eavesdropper Device Height Figure 6: Perfect antennas help miti- Figure 7: Increasing number of anten- Figure 8: Attacker can raise device gate eavesdropping but not avoid it. nas helps reduce eavesdropping area. high to enlarge eavesdropping area. ous testbed experiments. We verified that this correlation ceive the side-lobe signals. remains stable and accurate across different application sce- As well as incurring larger hardware implementation cost narios and link rates. Our simulations follow the same con- and size, increasing the number of antennas does not fully figuration in §2, with altered hardware aspects. We also ex- prevent an eavesdropping attack. For instance, in both mesh panded the experiments by varying the height of the eaves- and picocell scenarios, a simple yet effective method for at- dropping device and RX’s locations. tacker is to raise the eavesdropping device to get closer to TX 4.1 Perfect Antennas without Artifacts and receive stronger signals. This results in higher SNR than eavesdropping on the ground, and the attacker could achieve First we simulated eavesdropping attacks on three applica- better eavesdropping results. Fig. 8 shows its effect in the tion scenarios, using perfect antennas without artifacts. Fig. 6 picocell scenario. Even though TX uses 64 perfect anten- shows the eavesdropping areas for different scenarios, com- nas (in the horizontal plane), an attacker could increase the pared with our testbed measurements. We only present re- eavesdropping area from 3.91m2 to 15.2m2 by moving the sults with 1Gbps, and omit those from other data rates as device from in-hand position (1m) to above-head (2m). If they show similar findings. attacker uses drones to further raise the device height, the Comparing eavesdroppingareas using perfect antennas and eavesdropping area increases to 30.8m2. We observed sim- our testbed, we found eliminating hardware artifacts reduces ilar improvement in mesh networks. As such, even after re- the eavesdropping area. In the mesh and picocell network configuring hardware with significant cost, an attacker could scenarios, the eavesdropping area reduced by 43% and 52% still successfully eavesdrop in large area. This poses a seri- respectively. However, the area for the indoor peer-to-peer ous security threat as simple methods, like holding the de- scenario reduced by only 4%, as for short-range indoor com- vice higher, allow attackers to advance beyond hardware up- munications, TX’s power (with 23dBm EIRP) at side lobes grades. So we need new defense mechanisms. is high enough to allow eavesdropping. Despite the reduced eavesdropping area, we find the re- 5. ANALYSIS OF EXISTING DEFENSES maining area is still large enoughfor attackers to movearound while achieving high PSR. In mesh, picocell, and peer-to- Existing defenses focus on adding artificial noises to side- peer scenarios, an attacker could achieve full recovery of the lobe signals to prevent attackers from decoding useful infor- transmission (>95% PSR) in 45m2, 52m2, and 15m2 re- mation [13, 21, 24, 31, 37, 39, 41]. They fall under two spectively. Thus, removing hardware artifacts cannot fully categories, depending on how the noise is generated: (1) 5 defend against eavesdropping. antenna-based defenses and (2) RF-chain-based defenses . In this section, we analyze these defenses to study whether 4.2 Increasing Number of Antenna Elements they are practical and effective defending against side-lobe In addition to removing artifacts from hardware, we in- eavesdropping. We summarize them in Table 2. creased the number of antennas, and tested if the combina- Antenna-Based Defenses. This defense creates noisy side tion of these two techniques could defend against the eaves- lobes by changing the radiated signals from a subset of an- dropping attacks. Fig. 7 shows how the eavesdropping area tenna elements. During transmission, TX either disables [13, (with PSR >0) changes as we increase the number of an- 37] or flips the phase [21] of a random subset of antennas. tennas in the horizontal plane (our testbed uses 16 antennas This produces randomized radiation patterns on side lobes, in this plane). We find that in all our application scenarios, with minimal impact on normal transmissions6. eavesdropping area decreases monotonically as we add more Antenna-based defenses require TX to change the selected antennas. For example, in the picocell network scenario, antenna subset very frequently, often on a per-symbol ba- using 64 antennas (compared to 16 in our testbed) effec- 5 tively reduces the eavesdropping area from 52.39m2 down An RF (radio-frequency) chain refers to a set of physical hardware m2 components for wireless signal processing, bridging between the to 3.91 . This confirms the theory that more antenna el- antenna array and radio baseband. ements reduce side lobes’ beam width and emission power, 6 Due to space limit, we omit details about this defense. We refer resulting in shrinking the area where an attacker could re- interested readers to related work for more information.

5 sis, i.e. at the time scale of sub-nanoseconds. Less frequent Security Analysis in mmWave Eavesdropping. Existing switching keeps signals within a packet highly correlated works to study mmWave eavesdropping either perform sim- with each other. This could allow the attacker to simply ulations[13, 18, 19, 21, 24, 25, 37, 38, 41] or use horn anten- estimate the wireless channel, or guess the correlation con- nas [35], which have no side lobes. Differing from these, we stant to recover the transmission. Despite the effectiveness, are the first to study mmWave side-lobe eavesdropping from switching at a per-symbol frequency incurs extremely high actual measurements, using commercial 60GHz phased ar- cost in hardware and power. Today’s hardware can only rays in real-world application scenarios. support packet-level switching (10s of nanoseconds) for the Many of these proposed defenses against mmWave eaves- same reason, making antenna-based defenses impractical. dropping, i.e. using antenna-based [13, 21, 37] or RF-chain- Despite the impracticality, we implemented the defenses based designs [21, 24, 38, 41] assume a naive single-device in simulation. We found it effectively defends against single- attacker. Our work analyzes these proposals and finds these device side-lobe eavesdroppers, regardless of where the at- methods either as vulnerable to advanced attackers with mul- tack is launched. However, it remainsvulnerable to advanced tiple synchronizeddevices, or they introduce significant hard- attacks. For instance, attack can use multiple synchronized ware overhead and cost. Thus, these defenses are not appli- devices to measure side-lobe signals at different angles, undo cable to mmWave transmissions. the effects of antenna randomization on a per-symbol basis, Eavesdropping in Low-Frequency RF Bands. Eaves- and recover the packets. The key is to decode the antenna dropping is more prevalent and easier in lower frequency selections for transmission from measurements, as there is a bands, e.g., Wi-Fi and cellular, due to its omni-directional limited number of antenna subset selections. signals. Many previous works propose defense mechanisms RF-Chain-Based Defenses. Unlike antenna-based de- using jamming, which injects artificial noise towards the at- fenses, these defenses add additional RF chains to generate tackers [20, 27, 39]. Although different techniques are used, noise and do not need randomizations in TX’s radiation pat- e.g., a separated jammer synchronizedwith the transmitter [23], tern. They “jam” the eavesdropper at TX’s side lobes, so cooperative devices or relays [20, 27], these defensive mech- the attacker can only receive a mixture of transmitted signals anisms all require a high number of RF chains. Despite the and noise signals. For mmWave hardware, this adds signif- acceptably minimized hardware cost in commodity Wi-Fi icant complexity and cost in RF signal processing compo- and cellular devices, the cost of these defenses remains ex- nents, increasing the hardware cost and power requirements. tremely high in the context of mmWave. Despite that previous work [14, 21] reduces the hardware requirement, these defenses [21, 24, 39, 41] remain costly and 7. CONCLUSION AND FUTURE WORK power-demanding. Despite an initial step to investigate mmWave side-lobe We found in simulations that RF-chain-based defenses ef- eavesdropping with real measurements, we already find it fectively defend against single-device eavesdroppers. Al- proves to be a much greater threat than we expected. We though, TX’s side lobes have gaps in between, which nulls hope our results draw the attention of the community and the transmitted signals. An advanced attacker can exploit shed light on the future development of mmWave communi- this and search for only noise signals. He could then perform cations. Moving forward, many open challenges remain. noise cancellation with only two synchronizedreceivers: one Potential Defenses. Despite existing proposals, we lack listening to only noise and the other eavesdropping the mixed a practical and secure solution against side-lobe eavesdrop- noise and legit signals. The attack becomes more difficult ping. Other than reducing the RF chain cost in mmWave when TX uses over two RF chains to generate noise. Noise communications, a possible alternative could leverage the from different RF chains would mix together and becomes antenna artifacts. Designing specific artifacts in hardware difficult to isolate. Still, this countermeasure comes at an could resist the attack since we saw earlier that artifacts may even higher cost in mmWave hardware and device power. alter the shape of side lobes. The artifacts should be carefully designed so the normal transmission remains unaffected. Defense Requirement Vulnerability Category Antenna # of Sync. Empirical Validation of Advanced Attacks. We briefly # of RF Info. Required Switching Devices Chains for Attack described and simulated two types of advanced attacks, i.e. Frequency to Attack No Defense 1 - 1 side-lobe signals antenna randomization attack and noise cancellation attack. signals at While other advanced attacks remain possible, current mmWave Antenna-Based 1 per-symbol N N locations hardware is not flexible enough to implement these attacks. noise signals RF-Chain-Based >2 - 2 at N locations Also, our device does not report bit error rate (BER) which may shed light on more fine-grained insights as [26] did. We Table 2: Summary and vulnerabilities of different de- hope more flexible hardware becomes available soon, so we N fense mechanisms. is the number of TX antennas. can empirically validate the attacks with consideration of antenna artifacts, which may affect the attacks’ performance.

6. RELATED WORK 8. REFERENCES

6 R. W. Enhancing secrecy with multi-antenna transmission in [1] 60ghz wireless technology overview. http://www.mmwaves. millimeter wave vehicular communication systems. IEEE com/products.cfm/product/20-194-0.htm. Transactions on Vehicular Technology PP, 99 (2017). [2] Aircrack. https://www.aircrack-ng.org/. [22] FRIIS, H. T. A note on a simple transmission formula. In Proc. of [3] Dell wireless dock wigig. http://i.dell.com/sites/ IRE 34, 5 (1946), 254–256. doccontent/consumer/merchandizing/en/ [23] GOLLAKOTA,S., AND KATABI, D. ijam: Jamming oneself for Documents/Dell-Wireless-Dock-WiGig-spec- secure wireless communication. Tech. rep., Computer Science and sheet.pdf. Artificial Intelligence Laboratory Technical Report, 2010. [4] Facebook’s terragraph. https://techcrunch.com/2016/ [24] JU, Y., WANG,H.M.,ZHENG, T. X., AND YIN, Q. Secure 04/13/terragraph/. transmissions in millimeter wave systems. IEEE Transactions on [5] Google fiber considers gigabit wifi to cheaply cover last mile. Communications 65, 5 (2017). https://www.engadget.com/2016/06/09/google- [25] KIM,M.,HWANG,E., AND KIM, J.-N. Analysis of eavesdropping attack in mmwave-based wpans with directional antennas. Wireless fiber-considers-gigabit-wifi-to-cheaply- Networks 23, 2 (2017). cover-last-mile/. [26] LACURTS,K., AND BALAKRISHNAN, H. Measurement and analysis [6] IEEE 802.11 Task Group AD. http://www.ieee802.org/11/ of real-world 802.11 mesh networks. In Proc. of IMC (2010). Reports/tgad_update.htm. [27] LAI,L., AND EL GAMAL, H. The relay-eavesdropper channel: [7] San jos partners with facebook for high-speed outdoor wi-fi. Cooperation for secrecy. IEEE Trans. Inf. Theor. 54, 9 (2008). https://gcn.com/articles/2016/04/18/san-jose- [28] LIBERATORE,M., AND LEVINE, B. N. Inferring the source of facebook.aspx. encrypted http connections. In Proc. of CCS (2006). [8] Talon ad7200 multi-band wi-fi router. http://www.tp-link. [29] MARZI,Z.,MADHOW,U., AND ZHENG, H. Interference analysis com/us/products/details/cat-5506_AD7200.html. for mm-wave picocells. In Proc. of GLOBECOM (2015). [9] Wilocity: 60ghz wireless revolution begins at ces. http://news. [30] NAKHILA,O.,ATTIAH,A.,JINZ, Y., AND ZOUX, C. Parallel active cnet.com/8301-30685_3-57326718-264/wilocity- dictionary attack on wpa2-psk wi-fi networks. In Proc. of MILCOM 60ghz-wireless-revolution-begins-at-ces/. (2015). [10] Wireless htc vive tested: One of vr’s problems solved, but two [31] RAMADAN,Y. R., IBRAHIM,A.S., AND KHAIRY,M. M.Rf remain. https://arstechnica.com/gadgets/2017/02/ beamforming for secrecy millimeter wave miso-ofdm systems. In htc-vive-wireless-tested-review/. Proc. of ICC (2016). [11] Your wi-fi’s wpa2 encryption can be cracked offline: Here’s how. [32] RASEKH,M.E.,MARZI,Z.,ZHU, Y., MADHOW,U., AND https://www.howtogeek.com/202441/your-wi-fi%E2 ZHENG, H. Noncoherent mmwave path tracking. In Proc. of %80%99s-wpa2-encryption-can-be-cracked- HotMobile (2017). offline-here%E2%80%99s-how/. [33] SHAKED, Y., AND WOOL, A. Cracking the bluetooth pin. In Proc. of [12] ABARI,O.,BHARADIA,D.,DUFFIELD,A., AND KATABI,D. MobiSys (2005). Enabling high-quality untethered virtual reality. In Proc. of NSDI [34] SHELDON,F. T.,WEBER,J.M.,YOO,S.-M., AND PAN,W. D. (2017). The insecurity of wireless networks. IEEE Security & Privacy 10, 4 [13] ALOTAIBI,N.N., AND HAMDI, K. A. Switched phased-array (2012). transmission architecture for secure millimeter-wave wireless [35] STEINMETZER,D.,CHEN, J.,CLASSEN,J.,KNIGHTLY,E., AND communication. IEEE Transactions on Communications 64, 3 (2016). HOLLICK, M. Eavesdropping with periscopes: experimental security [14] AYACH,O.E.,RAJAGOPAL,S.,ABU-SURRA,S.,PI,Z., AND analysis of highly directional millimeter waves. In Proc. of CNS HEATH, R. W. Spatially sparse precoding in millimeter wave mimo (2015). systems. IEEE Transactions on Wireless Communications 13, 3 [36] TEWS,E., AND BECK, M. Practical attacks against wep and wpa. In (2014). Proc. of WiSec (2009). [15] BAIRD,C., AND RASSWEILER, G. Adaptive sidelobe nulling using [37] VALLIAPPAN,N.,LOZANO,A., AND HEATH, R. W. Antenna digitally controlled phase-shifters. IEEE Transactions on Antennas subset modulation for secure millimeter-wave wireless and Propagation 24, 5 (1976). communication. IEEE Transactions on Communications 61, 8 (2013). [16] BALANIS,C.A. Antenna theory: analysis and design. John Wiley & [38] WANG,C., AND WANG, H. M. Physical layer security in millimeter Sons, 2016. wave cellular networks. IEEE Transactions on Wireless [17] BISSIAS,G.,LIBERATORE,M., JENSEN,D., AND LEVINE,B.N. Communications 15, 8 (2016). Privacy vulnerabilities in encrypted http streams. In Proc. of PET [39] ZHANG,X.,ZHOU,X., AND MCKAY, M. R. Enhancing secrecy (2005). with multi-antenna transmission in wireless ad hoc networks. IEEE [18] DAI,H.-N.,LI,D., AND WONG, R. C.-W. Exploring security Transactions on Information Forensics and Security 8, 11 (2013). improvement of wireless networks with directional antennas. In Proc. [40] ZHOU,X.,ZHANG,Z.,ZHU, Y., LI, Y., KUMAR,S.,VAHDAT,A., of LCN (2011). ZHAO, B. Y., AND ZHENG, H. Mirror mirror on the ceiling: Flexible [19] DAI, H.-N.,WANG,Q.,LI,D., AND WONG, R. C.-W.On wireless links for data centers. In Proc. of SIGCOMM (2012). eavesdropping attacks in wireless sensor networks with directional [41] ZHU, Y., WANG,L.,WONG,K., AND HEATH, R. W. Secure antennas. International Journal of Distributed Sensor Networks 9, 8 communications in millimeter wave ad hoc networks. IEEE (2013). Transactions on Wireless Communications 16, 5 (2017). [20] DONG,L.,HAN,Z.,PETROPULU,A. P., AND POOR, H. V. [42] ZHU, Y., ZHANG,Z.,MARZI,Z.,NELSON,C.,MADHOW,U., Cooperative jamming for wireless physical layer security. In Proc. of ZHAO, B. Y., AND ZHENG, H. Demystifying 60GHz outdoor SSP (2009). picocells. In Proc. of MobiCom (2014). [21] ELTAYEB,M.E.,CHOI,J.,AL-NAFFOURI, T. Y., AND HEATH,