Wavefront Manipulation Attack via Programmable mmWave Metasurfaces: from Theory to Experiments

The use of reconfigurable intelligent surfaces is an emerging paradigm in wireless networks as it offers on-demand control over the wireless medium. Such a customized channel control can particularly benefit mmWave networks in which transmissions suffer from inherent propagation losses (e.g., high path loss and penetration loss). Indeed, recent literature studied surface-enhanced mmWave WLANs to improve signal-to-noise-ratio (SNR), expand coverage, increase spatial diversity, and enable blockage recovery via creating non-specular non-line-of-sight (NLOS) paths. Despite their exciting prospects, mmWave WLANs face new physical layer vulnerabilities with the advent of such surfaces, as the wireless medium can now be maliciously controlled by an adversary ? an issue that has not been thoroughly investigated in the literature. In this work, we investigate Metasurface-enabled Sideband Steering (MeSS), a new metasurface-in-the-middle attack in which an adversary manipulates the spectral-spatial properties of the reflected wavefront to create and steer a concealed sideband for eavesdropping. To avoid detection, the adversary keeps a directional link toward Bob at the same time. Although a small power reduction at Bob is inevitable, it can be masked under typical mmWave channel fluctuations caused by environment mobility. We have fabricated a custom reconfigurable surface prototype and evaluated MeSS through theoretical analysis as well as over-the-air experiments at the 60 GHz band. Our results indicate that MeSS significantly reduces empirical secrecy capacity (up to 81.7%).