Abstract:Virtual Reality (VR) is an exciting new consumer technology which offers an immersive audio-visual experience to users through which they can navigate and interact with a digitally represented 3D space (i.e., a virtual world) using a headset device. By (visually) transporting users from the real or physical world to exciting and realistic virtual spaces, VR systems can enable true-to-life and more interactive versions of traditional applications such as gaming, remote conferencing, social networking and virtual tourism. However, as with any new consumer technology, VR applications also present significant user-privacy challenges. This paper studies a new type of privacy attack targeting VR users by connecting their activities visible in the virtual world (enabled by some VR application/service) to their physical state sensed in the real world. Specifically, this paper analyzes the feasibility of carrying out a de-anonymization or identification attack on VR users by correlating visually observed movements of users' avatars in the virtual world with some auxiliary data (e.g., motion sensor data from mobile/wearable devices held by users) representing their context/state in the physical world. To enable this attack, this paper proposes a novel framework which first employs a learning-based activity classification approach to translate the disparate visual movement data and motion sensor data into an activity-vector to ease comparison, followed by a filtering and identity ranking phase outputting an ordered list of potential identities corresponding to the target visual movement data. Extensive empirical evaluation of the proposed framework, under a comprehensive set of experimental settings, demonstrates the feasibility of such a de-anonymization attack.

Truth in Motion: The Unprecedented Risks and Opportunities of Extended Reality Motion Data

Berkeley Open Extended Reality Recordings 2023 (BOXRR-23): 4.7 Million Motion Capture Recordings from 105,852 Extended Reality Device Users

Inferring Private Personal Attributes of Virtual Reality Users from Head and Hand Motion Data

Exploring the Privacy Risks of Adversarial VR Game Design

Exploiting Out-of-band Motion Sensor Data to De-anonymize Virtual Reality Users

Exploiting the Uncoordinated Privacy Protections of Eye Tracking and VR Motion Data for Unauthorized User Identification

Immersed in Reality Secured by Design -- A Comprehensive Analysis of Security Measures in AR/VR Environments

Effect of Data Degradation on Motion Re-Identification

A Large-Scale Study of Personal Identifiability of Virtual Reality Motion Over Time

From Virtual Gains to Real Pains: Potential Harms of Immersive Exergames

A Comprehensive Review of Multimodal XR Applications, Risks, and Ethical Challenges in the Metaverse

mmWave for Extended Reality: Open User Mobility Dataset, Characterization, and Impact on Link Quality

MmWave for Extended Reality: Open User Mobility Dataset, Characterisation, and Impact on Link Quality

Privacy-preserving datasets of eye-tracking samples with applications in XR

Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience

POSTER - ReAvatar - Virtual Reality De-anonymization Attack Through Correlating Movement Signatures.

Challenges and New Directions in Augmented Reality, Computer Security, and Neuroscience -- Part 1: Risks to Sensation and Perception

Augmenting Security and Privacy in the Virtual Realm: An Analysis of Extended Reality Devices

Towards Security and Privacy for Multi-user Augmented Reality: Foundations with End Users

The Metaverse: Surveillant Physics, Virtual Realist Governance, and the Missing Commons

Thing2Reality: Transforming 2D Content into Conditioned Multiviews and 3D Gaussian Objects for XR Communication