University of St. Gallen

← Theses

Beamforming Feedback as an Attack Surface for Wi-Fi Privacy

Open topic · MA · Advisors: Bruno Rodrigues, Karim Khamaisi

Motivation

A modern Wi-Fi router does not broadcast in every direction at once. To reach your laptop efficiently it aims its signal, and to aim it, the router first has to know what the radio channel to that laptop looks like. So it asks, and the laptop answers with a compact summary of angles describing how the signal arrives. That answer is called Beamforming Feedback Information (BFI), and every Wi-Fi 5 and Wi-Fi 6 client that beamforms sends it many times per second as ordinary housekeeping.

Problem statement

Two properties turn this housekeeping into a privacy problem. The channel that BFI describes includes the room it crosses, so a person walking between the laptop and the router changes what the laptop reports, which makes BFI a sensor nobody installed. And since 802.11ac in 2013 the report has been transmitted in plaintext, so any device within radio range can read it by switching its Wi-Fi card to monitor mode, with no patched firmware and without joining the network. This is what separates BFI from Channel State Information (CSI), the conventional route to Wi-Fi sensing, which needs specialised hardware and has therefore kept the threat mostly inside the laboratory. The attacks are documented and effective: WiKI-Eve recovers smartphone keystrokes at 88.9% accuracy and application passwords at 65.8% top-10 accuracy from BFI alone (Hu et al., 2023), LeakyBeam detects occupancy through walls (Xiao et al., 2025), and BFId identifies individuals across 197 participants at 99.5% accuracy (Todt et al., 2025). IEEE 802.11bf, published in September 2025, standardises Wi-Fi sensing but leaves BFI unencrypted, and its security model covers only the parties that negotiate a sensing session rather than a passive listener. These accuracies come from controlled setups, and it remains unclear how far they survive distance, wall materials, competing traffic, and clients that beamform only occasionally.

The project

We will build a BFI capture pipeline, reproduce a BFI-based inference attack, and measure where it holds and where it fails. The testbed already runs on Raspberry Pi 5 nodes with Intel AX210 Wi-Fi 6 radios, which is the full hardware requirement for the attack, so the work starts at the attack rather than at the instrumentation. Defences remain limited, since obfuscation schemes cost throughput and published attacks already reconstruct the obfuscated channel, so evaluating one and pricing it is part of the work. No background in wireless security or signal processing is required, and the hardware is provided. The specific goal of this project is to quantify what a passive listener learns from BFI and what stopping it costs: at what distance and through which wall materials the attack holds, how much background traffic it needs, and what a defence removes in throughput.

Objectives

  • Understand the 802.11ac/ax sounding procedure (NDPA, NDP, compressed beamforming report) and why BFI is unencrypted by design.
  • Build a BFI capture and decoding pipeline in monitor mode on our Raspberry Pi 5 testbed.
  • Reproduce a BFI-based inference attack (occupancy or identity) against it.
  • Measure the attack envelope: distance, wall materials, background traffic, and number of clients.
  • Evaluate at least one defence and quantify its cost in throughput and latency.

Previous theses in this line

References

[1] Todt, J., Morsbach, F., & Strufe, T. (2025). BFId: Identity Inference Attacks Utilizing Beamforming Feedback Information. ACM CCS 2025. https://dl.acm.org/doi/10.1145/3719027.3765062

[2] Xiao, R., Chen, X., He, Y., Han, J., & Han, J. (2025). Lend Me Your Beam: Privacy Implications of Plaintext Beamforming Feedback in WiFi. NDSS 2025. https://www.ndss-symposium.org/ndss-paper/lend-me-your-beam-privacy-implications-of-plaintext-beamforming-feedback-in-wifi/

[3] Hu, J., Wang, H., Zheng, T., Hu, J., Chen, Z., Jiang, H., & Luo, J. (2023). Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke Eavesdropping. ACM CCS 2023. arXiv:2309.03492

[4] Haque, K. F., Zhang, M., Meneghello, F., & Restuccia, F. (2025). BeamSense: Rethinking wireless sensing with MU-MIMO Wi-Fi beamforming feedback. Computer Networks, 258, 111020. arXiv:2303.09687

[5] Zhang, J., Shen, Y., Wang, N., & Ren, Y. (2026). Beamforming Feedback as a Novel Attack Surface for Wi-Fi Physical-Layer Security. arXiv:2604.04179

[6] Defeating CSI obfuscation mechanisms: A study on unauthorized Wi-Fi sensing in wireless sensor networks (2025). Computer Networks. https://www.sciencedirect.com/science/article/abs/pii/S1389128625001768

[7] Restuccia, F. (2021). IEEE 802.11bf: Toward Ubiquitous Wi-Fi Sensing. IEEE Communications Magazine. arXiv:2103.14918

[8] Sigg, S. (2025). Feeling the Room: A Practical Study on WiFi-based Occupancy Detection. Bachelor’s thesis, University of St.Gallen. https://sensing-group.com/files/theses/ba-simon-sigg.pdf

[9] IEEE Std 802.11bf-2025, Amendment 4: Enhancements for Wireless LAN Sensing. Published September 26, 2025.

Interested? Email the advisors: Bruno Rodrigues, Karim Khamaisi.