Abstract:WiFi connections are vulnerable to simulated attacks from rogue access points (AP) or devices whose SSID and/or MAC/IP address are the same as legitimate devices. This kind of attack is difficult to counter with traditional network security mechanisms. In this paper, we propose a new security mechanism that uses environment-independent features extracted from channel state information (CSI) to detect and identify rogue WiFi devices or APs, and reject their connections. We find that due to the I/Q imbalance and imperfect oscillator of each WiFi network card (NIC), the nonlinear phase error of different subcarriers will vary with the NIC. Through our experimental verification, this cross-subcarrier phase feature is invariant to the location and the environment. We deploy systems on two platforms that can extract constant phase errors from the constantly changing CSI in less than one second, which is at least 8× faster than that of the state-of-the-art solution. Extensive experiments on commercial routers and end devices in different scenarios show that based on the Industral Platform Computer (IPC) platform, where only non-encrypted rogue connections can be detected, the detection accuracy rate reaches 96%, and the false alarm rate is less than 2%. Based on the ASUS router platform (a commercial WiFi router), WiFi channels and smart device types are not restricted, which greatly improved universality, and the accuracy of device connection detection can even reach more than 99%. We improve a device-type identification method based on the communication traffic features of the device when connected to WiFi. Experiments show that even if there are multiple similar devices from the same manufacturer, the accuracy of device type detection exceeds 99%.

An Imperceptible Eavesdropping Attack on WiFi Sensing Systems

ActListener: Imperceptible Activity Surveillance by Pervasive Wireless Infrastructures

Detecting Rogue Access Points Using Client-agnostic Wireless Fingerprints.

Push the Limit of WiFi-based User Authentication Towards Undefined Gestures

Accurate and Robust Rogue Access Point Detection with Client-Agnostic Wireless Fingerprinting

Signal Tracking Using Commodity WiFi

Mmear: Push the Limit of COTS Mmwave Eavesdropping on Headphones

Adversarial WiFi Sensing Using a Single Smartphone

Real-time Identification of Rogue WiFi Connections Using Environment-Independent Physical Features

VoiceListener

Unauthorized and Privacy-Intrusive Human Activity Watching Through Wi-Fi Signals: an Emerging Cybersecurity Threat

Security Analysis of WiFi-based Sensing Systems: Threats from Perturbation Attacks

Physical-World Attack towards WiFi-based Behavior Recognition

Time to Think the Security of WiFi-Based Behavior Recognition Systems

A Framework for Behavior Privacy Preserving in Radio Frequency Signal

Active eavesdropping detection: a novel physical layer security in wireless IoT

Real-Time Identification of Rogue WiFi Connections in the Wild

No More Free Riders: Sharing WiFi Secrets with Acoustic Signals

EV-Linker: Mapping Eavesdropped Wi-Fi Packets to Individuals Via Electronic and Visual Signal Matching

We Can "See" You via Wi-Fi - WiFi Action Recognition via Vision-based Methods

RFTrack: Stealthy Location Inference and Tracking Attack on Wi-Fi Devices