RIStealth: Practical and Covert Physical-Layer Attack against WiFi-based Intrusion Detection via Reconfigurable Intelligent Surface

The emerging reconfigurable intelligent surface (RIS) technique introduces novel threats to wireless sensing owing to its channel customization ability. Unlike active radios, the RIS's interference behaves akin to natural reflections, exhibiting a higher level of stealthiness and difficulty in detection. However, the majority of current RIS-based attacks lack generalizability to real-world scenarios, as they assume complete coverage of the RIS over objects and develop their techniques within electromagnetic-controlled environments such as an anechoic chamber. To bridge this gap, we present RIStealth, a practical and covert attack that leverages RIS technology to render a moving individual undetectable by WiFi-based intrusion detection systems in real-life scenarios. RIStealth integrates the strengths of both motion reduction and threshold lifting strategies to address challenges of limited RIS affordability, constrained cooperation in adversary settings, and complex and unpredictable environments. Through real-world evaluations conducted with our RIS prototype, we demonstrate that RIStealth effectively reduces the victim's intrusion detection rate from 95.1% to 16.4%. Our findings shed light on the practical threats posed by RIS, thereby encouraging further countermeasure development.