With the rapid evolution of wireless technologies, Wi-Fi has expanded beyond its original role in data transmission to support various emerging applications, particularly in physical-layer security, including device authentication, user authentication, and secret key generation. Despite extensive research on Wi-Fi Channel State Information (CSI)-based physical-layer security, its vulnerabilities remain largely unexplored. In this work, we propose BFIAttack, a novel attack that exploits Beamforming Feedback Information (BFI) to reconstruct the CSI of a legitimate user or device, thereby compromising Wi-Fi-based physical-layer security. We realize the attack by leveraging a closed-form CSI reconstruction method for the single-antenna station scenario and a maximum likelihood estimation-based CSI reconstruction for the multi-antenna station scenario. Moreover, we exploit spatial similarities among antenna pairs to refine the reconstructed CSI and enhance attack effectiveness. Experimental results show that BFIAttack achieves an average attack success rate of $73\%$ in multi-antenna station scenarios with no more than five attack attempts, and over $93\%$ in single-antenna station scenarios with only a single attempt. BFIAttack reveals critical vulnerabilities in existing Wi-Fi-based physical-layer security.

翻译：随着无线技术的快速发展，Wi-Fi已超越其最初的数据传输角色，扩展到支持多种新兴应用，特别是在物理层安全领域，包括设备认证、用户认证和密钥生成。尽管基于Wi-Fi信道状态信息（CSI）的物理层安全研究已十分广泛，但其脆弱性仍未得到充分探索。本文提出BFIAttack这一新型攻击方法，通过利用波束赋形反馈信息（BFI）重构合法用户或设备的CSI，从而破坏基于Wi-Fi的物理层安全。我们通过针对单天线站点场景采用闭式CSI重构方法，以及针对多天线站点场景采用基于最大似然估计的CSI重构技术来实现攻击。此外，我们利用天线对之间的空间相似性优化重构的CSI，以增强攻击效果。实验结果表明，在多天线站点场景中，BFIAttack在不超过五次攻击尝试下平均攻击成功率达73%；而在单天线站点场景中，仅需一次尝试即可超过93%。BFIAttack揭示了现有基于Wi-Fi的物理层安全中的关键脆弱性。