Abstract:Although Virtual Reality (VR) has accelerated its prevalent adoption in emerging metaverse applications, it is not a fundamentally new technology. On one hand, most VR operating systems (OS) are based on off-the-shelf mobile OS. As a result, VR apps also inherit privacy and security deficiencies from conventional mobile apps. On the other hand, in contrast to conventional mobile apps, VR apps can achieve immersive experience via diverse VR devices, such as head-mounted displays, body sensors, and controllers though achieving this requires the extensive collection of privacy-sensitive human biometrics. Moreover, VR apps have been typically implemented by 3D gaming engines (e.g., Unity), which also contain intrinsic security vulnerabilities. Inappropriate use of these technologies may incur privacy leaks and security vulnerabilities although these issues have not received significant attention compared to the proliferation of diverse VR apps. In this paper, we develop a security and privacy assessment tool, namely the VR-SP detector for VR apps. The VR-SP detector has integrated program static analysis tools and privacy-policy analysis methods. Using the VR-SP detector, we conduct a comprehensive empirical study on 500 popular VR apps. We obtain the original apps from the popular Oculus and SideQuest app stores and extract APK files via the Meta Oculus Quest 2 device. We evaluate security vulnerabilities and privacy data leaks of these VR apps by VR app analysis, taint analysis, and privacy-policy analysis. We find that a number of security vulnerabilities and privacy leaks widely exist in VR apps. Moreover, our results also reveal conflicting representations in the privacy policies of these apps and inconsistencies of the actual data collection with the privacy-policy statements of the apps. Based on these findings, we make suggestions for the future development of VR apps.

VRVul-Discovery: BiLSTM-based Vulnerability Discovery for Virtual Reality Devices in Metaverse

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

mmSpyVR: Exploiting mmWave Radar for Penetrating Obstacles to Uncover Privacy Vulnerability of Virtual Reality

Automated Unearthing of Dangerous Issue Reports.

VDDL: A Deep Learning-Based Vulnerability Detection Model for Smart Contracts.

Virtual Reality and Augmented Reality Security: A Reconnaissance and Vulnerability Assessment Approach

An Empirical Study on Oculus Virtual Reality Applications: Security and Privacy Perspectives

Remote Keylogging Attacks in Multi-user VR Applications

Inception Attacks: Immersive Hijacking in Virtual Reality Systems

On Security Weaknesses and Vulnerabilities in Deep Learning Systems

Security of Virtual Reality Authentication Methods in Metaverse: An Overview

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

Exploring Vulnerabilities in Remote VR User Studies

Detecting software vulnerabilities using Language Models

Immersed in Reality Secured by Design -- A Comprehensive Analysis of Security Measures in AR/VR Environments

Research on Metaverse Security and Forensics

SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities

Exploring the Vulnerabilities and Advantages of SWIPE or Pattern authentication in Virtual Reality (VR)

How Interactions Influence Users' Security Perception of Virtual Reality Authentication?

A Survey on Metaverse: Fundamentals, Security, and Privacy

Network Intrusion Automatic Detection Based on Mobile Wireless Network Application in Clothing Design Virtual Reality System