Eavesdropping with periscopes: Experimental security analysis of highly directional millimeter waves

Next generation wireless networks utilizing millimeter waves (mm-waves) achieve extremely high data rates using narrow signal beams. Featuring a high directivity and being susceptible to blockage by objects, mm-waves are often assumed to be hard to intercept. However, small-scale objects within the beam cause reflections, thus enabling eavesdroppers to receive the signal from the outside. In this paper, we practically demonstrate the vast impact that inconspicuous objects might have on mm-wave security. Experiments on our novel mm-wave software defined radio (SDR) testbed highlight that even centimeter-scale reflectors make eavesdropping from outside the signal beam possible. More sophisticated objects increase the signal strength of the reflected signal or allow the attacker to choose its location with more latitude. Modern communication devices with metal surfaces like mobile phones or laptops cause sufficient reflections for eavesdropping as well; signals will bounce off the intended receiver. With our experiments, we demonstrate empirically that reflections enable potential attackers to achieve a received signal strength as high as that of the intended receiver with only a minimal impact on the receiver´s performance. For blockages that do not impact the quality of the reception, reflections decrease the secrecy capacity by 32%. When tolerating small signal blockage towards the intended receiver, the attacker overcomes any inherent security of narrow beams and reduces the secrecy capacity to zero.