Lend Me Your Beam: Privacy Implications of Plaintext Beamforming Feedback in WiFi

In recent years, the proliferation of WiFi-connected devices and related research has led to novel techniques of utilizing WiFi as sensors, i.e., capturing human movements through channel state information (CSI) perturbations.While this enables passive occupant sensing, it also introduces privacy risks from leaked WiFi signals that attackers can intercept, leading to threats like occupancy detection, critical in scenarios such as burglaries or stalking.We propose LeakyBeam, a novel and improved occupancy detection attack that leverages a new side channel from WiFi CSI, namely beamforming feedback information (BFI).BFI retains victim's movement information, even when transmitted through walls, and is easily captured since BFI packets are unencrypted, making them a rich source of privacy-sensitive information.Furthermore, we also introduce a defense mechanism that obfuscates BFI packets, requiring minimal hardware changes.We demonstrate LeakyBeam's effectiveness through a comprehensive real-world evaluation at a distance of 20 meters, achieving true positive and negative rates of 82.7% and 96.7%, respectively.