Fewer Demands, More Chances: Active Eavesdropping in MU-MIMO Systems

As the demand for high-speed and reliable wireless networks continues to increase, multi-user multiple-input multiple-output (MU-MIMO) technology has become a popular choice for wireless communication systems. However, this technology also brings new security challenges, one of which is the vulnerability during the channel sounding process. In this paper, we propose an active eavesdropping attack targeting MU-MIMO systems. The attack consists of two phases. First, the attacker sends a forged pilot packet to the victims. After that, the access point transmits streams intended for victims to the attacker, who operates in full-duplex mode and relays the streams to the victims. Compared to existing eavesdropping attacks targeting MU-MIMO systems, our proposed attack requires less prior knowledge and coordination from attackers and maximizes eavesdropping opportunities. We evaluate the proposed attack in various settings and prove its effectiveness with multiple victims and partial channel knowledge. Additionally, we explore the use of physical-layer features to detect our proposed attack.