Physical-Layer Spoofing in WiFi 6 to Steer the Beam Toward the Attacker

Security threats of an IEEE 802.11ax (WiFi 6) system can occur throughout the layers of the protocol stack. Looking at the security aspect of the physical layer and from an attacker's perspective, we present how a spoofing attack can cause an access point to steer the beam dedicated to a legitimate user toward the attacker. More particularly, we propose the BeamSteal attack that takes advantage of the vulnerability of the beamforming feedback (BFF) mechanism. The purpose of the BeamSteal attack is to cause the access point to receive the wrong BFF -information-bearing bits and end up steering the beam toward the attacker instead of the legitimate user. To contrast the harmful effect of the proposed attack, we compare it with two benchmarks, namely the no attack case and the jamming attack case. Our numerical results show that the BeamSteal attack not only degrades the performance of the legitimate user, but also helps the attacker improve its performance significantly.