Wireless eavesdroppers can hack 6G signal with DIY metasurface
Using just some office paper, an inkjet printer, a metallic foil transfer, and a laminator, say the researchers, crafty hackers can make a tool to eavesdrop on some 6G wireless signals in as little as five minutes. The researchers showed that an attacker could easily make a sheet of office paper covered with 2D foil symbols — a metasurface — and use it to redirect part of a 150 gigahertz “pencil beam” transmission between two users.
They dubbed the attack “Metasurface-in-the-Middle” as a nod to both the hacker’s tool and the way it is wielded. Metasurfaces are thin sheets of material with patterned designs that manipulate light or electromagnetic waves, while the phrase “man-in-the-middle” is a computer security industry classification for attacks in which an adversary secretly inserts themself between two parties.
While the 150 gigahertz frequency used in the demonstration is higher than is used in today’s 5G cellular or Wi-Fi networks, wireless carriers are looking to roll out 150 gigahertz and similar frequencies known as terahertz waves or millimeter waves over the next decade.
“Next-generation wireless will use high frequencies and pencil beams to support wide-band applications like virtual reality and autonomous vehicles,” says Edward Knightly, Rice’s Sheafor-Lindsay Professor of Electrical and Computer Engineering.
In the study, the researchers use the names Alice and Bob to refer to the two people whose communications are hacked. The eavesdropper is called Eve. To mount the attack, Eve first designs a metasurface that will diffract a portion of the tight-beam signal to her location. For the demonstration, the researchers designed a pattern with hundreds of rows of split rings. Each looks like the letter C, but they are not identical. The open part of each ring varies in size and orientation.
“Those openings and orientations are very specifically done to get the signal to diffract in the exact direction Eve wants,” says Zhambyl Shaikhanov, a graduate student in Knightly’s lab and co-author of a paper on the research. “After she designs the metasurface, she prints it on a regular laser printer, and then she uses a hot stamping technique that’s used in crafting. She places a metal foil on the printed paper, feeds it through a laminator and the heat and pressure create a bond between the metal and the toner.”
Brown University engineering Professor Daniel Mittleman and study co-author Hichem Guerboukha, a postdoctoral research fellow at Brown, showed in a 2021 study that the hot-stamping method could be used to make split-ring metasurfaces with resonances up to 550 GHz.
“We developed this approach in order to lower the barrier for fabrication of metasurfaces, so that researchers could test many different designs quickly and inexpensively,” says Mittleman. “Of course, this lowers the barrier for eavesdroppers too.”
The researchers say they hope the study will dispel a common misperception in the wireless industry that higher frequencies are inherently secure.
“People have been quoted saying millimeter-wave frequencies are ‘covert’ and ‘highly confidential’ and that they ‘provide security,’” says Shaikhanov. “The thinking is, ‘If you have a super narrow beam, nobody can eavesdrop on the signal because they would have to physically get between the transmitter and the receiver.’ What we’ve shown is that Eve doesn’t have to be obtrusive to mount this attack.”
The research showed the attack would be difficult for Alice or Bob to detect today. And while the metasurface must be placed between Alice and Bob, “it could be hidden in the environment,” says Knightly. “You could conceal it with other sheets of paper, for instance.”
Now that wireless researchers and equipment manufacturers know about the attack, say the researchers, they can further study it, develop detection systems and build those into terahertz networks up front.
“If we had known from day one, when the internet first came out, that there would be denial-of-service attacks and attempts to take down web servers, we would have designed it differently,” says Knightly. “If you build first, wait for attacks and then try to repair, that is a much more costly and expensive path than designing securely up front.”
“Millimeter-wave frequencies and metasurfaces are new technologies that can each be used to advance communication, but any time we get a new capability for communication we have to ask the question, ‘What if the adversary has this technology? What new capabilities will it give them that they didn’t have in the past? And how can we realize a secure network against a strong adversary?”
For more, see “Metasurface-in-the-Middle Attack: From Theory to Experiment.”