Collaborative Research: SaTC 2.0: RES: Modeling and Mitigating Reflective Backscatter Side-Channel Attacks (ReBac) in Everyday Devices

Everyday electronics, including keyboards, computer mice, game controllers, and smart home devices, are designed under the assumption that their physical enclosure protects the information transferred inside. This project investigates a newly identified class of vulnerabilities that challenges this assumption. By illuminating a device with a low-power radio signal from several meters away, an attacker can measure reflected signals that scatter from internal cables and Printed Circuit Board (PCB) traces. The amplitude of these reflections subtly changes in response to user activities, letting a remote eavesdropper recover what a person is typing or doing, even through walls and without a direct line of sight. Because billions of consumer and industrial products share this vulnerability, the work transforms how such devices are designed and developed, protecting personal privacy, economic security, and the integrity of information systems on which the public depends. The project also helps train the next generation of cybersecurity professionals through curriculum activities, strengthening cybersecurity workforce development. The project establishes a scientific foundation for understanding and defending against reflective backscatter (ReBac) side-channel attacks, in which a compact transmitter illuminates a target device while a receiver decodes data-dependent reflections from internal interconnects such as flex cables and PCB traces. ReBac enables two attack capabilities: digital data exfiltration on serial buses and analog inference of usage patterns such as keyboard matrix scanning. Spanning both digital and analog variants, the team pursues three integrated objectives. First, the project develops a predictive theoretical framework that links victim-device parameters such as cable length, geometry, and communication protocol, environmental conditions including distance and physical obstacles, and attacker configuration such as transmit power, frequency, and receiver design, to overall attack feasibility. Second, the project conducts end-to-end demonstrations on commodity keyboards, mice, controllers, and Internet-of-Things (IoT) gadgets to quantify both digital and analog attacks under realistic operating conditions. Third, the project designs and evaluates low-cost defenses, including safe-length and layout guidelines for internal interconnects, lightweight shielding strategies, and data-randomization techniques suitable for industry adoption. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.