Reusing Wi-Fi communication packets for sensing purpose has been regarded as one of the most cost-effective ways to realize integrated sensing and communication (ISAC) on commodity Wi-Fi. However, the channel state information (CSI) measured from these packets can be heavily compromised by modern Wi-Fi beamforming protocols tailored primarily to maximize communication throughput, hence inadvertently affecting Wi-Fi sensing performance. Existing approach attempts to mitigate this negative impact through passive signal processing in single-user sensing scenarios, but it fails to fundamentally resolve the problem. In contrast, we actively leverage beamforming, transforming its adverse effects into positive gains, and propose VersaBeam, a practical Wi-Fi ISAC system that simultaneously supports multiple sensing and communication users. Specifically, for multi-user scenarios, we design a correlation-based user pairing algorithm to ensure that the reused communication packets of each sensing receiver are transmitted with sufficiently high power along the sensing direction. Building on this, a novel ISAC-oriented beamforming strategy is proposed to balance the requirements of both sensing and communication. To further provide consistent inputs for sensing tasks, a CSI unification method is developed to remove inconsistencies resulting from diverse beamforming matrices when reusing packets from different communication users. Finally, a prototype of VersaBeam is implemented on commodity Wi-Fi devices, and its effective ness is validated through micro-benchmarking and real-world experiments across three representative sensing applications.

New Wi-Fi systems have leveraged beamforming to manage a significant portion of traffic for achieving high throughput and reliability. Unfortunately, this has amplified certain security risks since beamforming critically relies on theclear-textbeamforming feedback information (BFI): though similar risks have been exposed using emulation platforms (e.g., USRP), they have never proven realistic till this day. In this paper, we propose BeamCraft, thefirstattack to manipulate traffic incommodityWi-Fi systems; it differs significantly from existing attacks either staying only on emulation platforms with limited real-world applicability or jamming communications by brute force. The core idea of BeamCraft involves corrupting beamforming decisions by injecting crafted BFIs that feed an access point (AP) with erroneous information on channel states. To mount a covert yet purposeful attack, we develop i) a joint location and transmit power selection strategy to evade detection by victims and ii) a novel BFI forgery method to effectively manipulate AP's beamforming decisions. We implement BeamCraft using commodity Wi-Fi devices and perform extensive evaluations with it; the results reveal that BeamCraft effectively manipulates Wi- Fi traffic while maintaining a low exposure rate. Furthermore, we also introduce a defense strategy, namely BeamCrypt, that jointly leverages reciprocity and similarity of the channel within the coherence time to authenticate the legitimate user with low overhead. We implement it using WARP and evaluation results verify the effectiveness.

New Wi-Fi systems have leveraged beamforming to manage a significant portion of traffic for achieving high throughput and reliability. Unfortunately, this has amplified certain security risks since beamforming critically relies on the clear-text beamforming feedback information (BFI): though similar risks have been exposed using emulation platforms (e.g., USRP), they have never proven realistic till this day. In this paper, we propose BeamCraft, the first attack to manipulate traffic in commodity Wi-Fi systems; it differs significantly from existing attacks either staying only on emulation platforms with limited real-world applicability or jamming communications by brute force. The core idea of BeamCraft involves corrupting beamforming decisions by injecting crafted BFIs that feed an access point (AP) with erroneous information on channel states. To mount a covert yet purposeful attack, we develop i) a joint location and transmit power selection strategy to evade detection by victims and ii) a novel BFI forgery method to effectively manipulate AP's beamforming decisions. We implement BeamCraft using commodity Wi-Fi devices and perform extensive evaluations with it; the results reveal that BeamCraft effectively manipulates Wi-Fi traffic while maintaining a low exposure rate.