XR Devices Send WiFi Packets When They Should Not: Cross-Building Keylogging Attacks via Non-Cooperative Wireless Sensing

XR Devices Send WiFi Packets When They Should Not: Cross-Building Keylogging Attacks via Non-Cooperative Wireless Sensing

Speakers: Christopher Vattheuer

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=Q1sExyB9c70

Overview

Presented by Justin from UCLA, this research introduces TWIST (Transition Web and Spring Tension Network), a novel keylogging attack against extended reality (XR) headsets that operates at distances of tens of meters -- even through walls and across buildings. Unlike prior VR keylogging attacks that require malware installation on the victim headset, close-range cameras, or nearby RF equipment, TWIST exploits a fundamental WiFi protocol behavior called Polite WiFi to turn the victim's headset into an involuntary transmitter. The attack requires no machine learning, no pre-training, and no fine-tuning -- only approximately 90 seconds of passive measurement to build a mapping between WiFi channel state information (CSI) and keyboard positions. The researchers demonstrated a cross-building attack at UCLA, successfully inferring keystrokes from one building to another across a courtyard.

Background

▶ Watch: Introduction: XR keylogging at distance without machine learning (0:30)

Extended reality devices are increasingly ubiquitous in personal use, corporate environments, and medical training. With this growth in adoption comes growing privacy concerns, particularly around keylogging attacks. Prior keylogging approaches against VR headsets have relied on three modalities: malware (requiring access to or installation on the victim headset), camera-based tracking (requiring close range and direct line-of-sight to the user's hands), and RF-based attacks (suffering from significant range limitations and environment sensitivity). All three approaches face a fundamental challenge in adapting to different environments and require complex, close-proximity setups.

The Polite WiFi vulnerability, documented in prior work, describes a behavior in the WiFi protocol where any WiFi device that receives a packet passing the Frame Check Sequence (FCS) validation will automatically respond with an acknowledgement (ACK) packet -- regardless of whether the device is on the same network as the sender or whether the packet was intended for it. This behavior is baked into the WiFi standard and affects virtually all WiFi-enabled devices.

Key Findings

▶ Watch: Polite WiFi explained: headsets as involuntary transmitters (4:00)

No machine learning required: TWIST operates entirely without neural networks or training data. The system uses a clustering and graph-based approach to map CSI measurements to keyboard positions, making it immediately deployable in new environments.

Near-field domination effect: Because the victim's headset serves as an involuntary transmitter, hand motions near the headset antenna consistently produce strong signal changes regardless of the attacker's distance. The signal-to-noise ratio (SNR) remains stable as the attacker moves further away, unlike prior work where the user's position between transmitter and receiver caused SNR degradation.

90-second setup: The entire graph construction needed to map CSI to keyboard positions requires only 90 seconds of measurement, making the attack highly practical for real-world deployment.

Cross-building operation: The researchers demonstrated the attack from one UCLA building across a courtyard to another building, proving the attack works at significant distances without line-of-sight.

Device identification at scale: The researchers successfully identified a MetaQuest 3 among approximately 1,000 other devices using Information Element (IE) probes that WiFi devices broadcast automatically, enabling targeted attacks even when MAC address randomization is employed.

Robust across conditions: The attack maintained consistent top-K accuracy across different distances (1-30 meters), through walls, with different users (varying heights and typing speeds), and at different angles (including -90 and +90 degrees relative to the victim).

Technical Deep Dive

▶ Watch: Force-directed graph projection maps CSI to keyboard layout (8:00)

TWIST operates in four stages. First, device identification: the attacker identifies the target XR headset's MAC address either directly (for devices with stable MAC addresses) or through WiFi fingerprinting using IE probes (for devices with MAC randomization). Second, involuntary transmission: the attacker sends WiFi packets to the headset's MAC address; thanks to Polite WiFi, the headset automatically responds with ACK packets regardless of network membership.

The core innovation lies in the CSI-to-position mapping. The collected ACK packets carry CSI data reflecting the wireless channel response. Hand movements near the headset antenna impart measurable changes in CSI across different WiFi subcarriers -- left-side keyboard presses produce distinctly different CSI patterns from right-side presses. TWIST represents keyboard positions as nodes in a graph with weighted transitions, then uses a force-directed graph projection to map clusters onto a 2D plane representing the keyboard layout. Nodes near the center of the keyboard naturally have higher weights and more transitions, causing them to gravitate toward the center during projection. The enter key serves as a strong positional anchor due to its frequent use.

For press timing estimation, TWIST handles two cases. On sites like Google Drive and Gmail, each keypress generates a burst of network packets, providing clear timing signals. On sites without per-keypress packet bursts (like Bank of America login pages), TWIST profiles the user's typing cadence between the session start and the final enter key press, then interpolates individual press timings.

Keystroke inference uses uniform key estimation (selecting the most likely key based on position with decreasing probability for surrounding keys) enhanced by dictionary-aided word ranking that composites individual letter probabilities to rank candidate words.

Demo / Proof of Concept

▶ Watch: Press timing estimation via packet bursts and cadence interpolation (10:00)

The researchers tested TWIST using a MetaQuest 2 as the primary victim device, with additional validation on MetaQuest 3 and Apple Vision Pro. The adversary setup used an ESP32 -- a commercially available microcontroller costing only a few dollars -- with collocated transmitter and receiver. Testing covered line-of-sight distances from 1 to 30 meters, through-wall scenarios, multiple users with different physical characteristics and typing speeds, and various angular orientations. The cross-building demonstration at UCLA showed the attack operating from one building, across a courtyard, to another building where the VR user was typing.

Defensive Implications

▶ Watch: Results: robust accuracy across distances, users, and angles (14:00)

Mitigating this attack is challenging because it exploits fundamental WiFi protocol behavior. Two categories of defense exist: preventing the vulnerability (which requires changing the WiFi protocol or headset firmware to stop automatic ACK responses to unsolicited packets) and detecting the attack (monitoring for anomalous patterns of incoming WiFi packets targeting the headset). The researchers noted that their attack caused less than a 20% degradation in normal network performance, making detection through network quality monitoring difficult. Protocol-level fixes would require changes to IEEE 802.11 standards or manufacturer-specific firmware patches, neither of which is trivial to deploy across the installed base.

Key Takeaways

• The Polite WiFi vulnerability turns any WiFi-enabled XR headset into an involuntary transmitter, enabling keylogging at distances of tens of meters and through walls
• TWIST requires no machine learning, no training data, and only 90 seconds of passive measurement to become operational in a new environment
• The attack hardware costs only a few dollars (ESP32), making it accessible to any motivated attacker
• Tested successfully against MetaQuest 2, MetaQuest 3, and Apple Vision Pro -- the three dominant XR platforms
• Defenses are difficult because the vulnerability exists at the WiFi protocol level, requiring standards-level or firmware-level changes

About the Speaker(s)

Justin (presenting on behalf of first author Christopher Vattheuer) is a researcher at UCLA working on wireless security and privacy in extended reality systems. The research represents a collaboration focused on the intersection of WiFi protocol vulnerabilities and emerging XR device privacy threats.