Malicious mm Wave Reconfigurable Surface: Eavesdropping through Harmonic Steering

The use of reconfigurable surfaces is emerging as a promising solution to tackle the blockage and coverage challenges in mmWave networks. However, if such a surface is controlled by an adversary, it could make the wireless network vulnerable to a variety of new attacks by reconfiguring the wireless channel to the adversary's advantage. This paper introduces Metasurface-enabled Sideband Steering (MeSS), a novel eavesdropping framework that takes advantage of two degrees of freedom in reconfigurable surfaces, namely, space and time, to generate and steer a concealed directional sideband toward the eavesdropper while maintaining the direction of the mainband toward the legitimate client. In particular, by applying periodic time-varying control signals, MeSS creates a multi-lobe multi-frequency reflection pattern that allows the adversary to successfully capture the reflected signal with a minimal footprint on the legitimate user. We characterize the effectiveness and stealthiness of MeSS through theoretical analysis as well as simulations. Our results demonstrate the underlying effectiveness of MeSS compared to conventional side-lobe eavesdropping attacks in mmWave networks. Finally, we provide insight on potential countermeasures against the identified physical-layer attack.