Wi-Fi MU-MIMO Has Fundamental Security Flaws

This work reveals a critical vulnerability of the IEEE 802.11 standard that, if unaddressed, might lead to serious security issues and compromise the performance of several billion Wi-Fi devices. We introduce BREAK, a new attack to Wi-Fi networks operating in multi-user multi-input multi-output (MU-MIMO), which leverages the channel estimation procedure used by Wi-Fi to decrease the throughput of the entire network without being detected by devices implementing the current standard amendments. Through rigorous mathematical optimization, we compute the poisoned feedback that a BREAK adversary needs to send to the access point to reduce the throughput of legit-imate users. Next, we propose unBREAK, an attack detection algorithm that, if integrated in the IEEE 802.11 standard, allows access points to detect BREAK and restore normal MU-MIMO operation. We extensively and experimentally evaluated BREAK effects with commercial off-the-shelf Wi-Fi routers and smartphones in multiple network configurations, showing that an adversary may decrease throughput at legitimate stations by 65% by modifying only about 17% of its feedback. We show that unBREAK effectively detects the attack and identifies the adversary station to be excluded from the communication. For replicability, we shared the code implementing the attack together with the modified firmware to be used at the adversary node. A video demonstration of the BREAK attack is also available.