Abstract:Various industries have widely adopted Virtual Reality (VR) and Augmented Reality (AR) technologies to enhance productivity and user experiences. However, their integration introduces significant security challenges. This systematic literature review focuses on identifying devices used in AR and VR technologies and specifies the associated vulnerabilities, particularly during the reconnaissance phase and vulnerability assessment, which are critical steps in penetration testing. Following Kitchenham and Charters' guidelines, we systematically selected and analyzed primary studies. The reconnaissance phase involves gathering detailed information about AR and VR systems to identify potential attack vectors. In the vulnerability assessment phase, these vectors are analyzed to pinpoint weaknesses that malicious actors could exploit. Our findings reveal that AR and VR devices, such as headsets (e.g., HTC Vive, Oculus Quest), development platforms (e.g., Unity Framework, Google Cardboard SDK), and applications (e.g., Bigscreen VR, VRChat), are susceptible to various attacks, including remote code execution, cross-site scripting (XSS), eavesdropping, and man-in-the-room attacks. Specifically, the Bigscreen VR application exhibited severe vulnerabilities like remote code execution (RCE) via the 'Application.OpenURL' API, XSS in user inputs, and botnet propagation. Similarly, the Oculus Quest demonstrated susceptibility to side-channel attacks and ransomware. This paper provides a detailed overview of specific device vulnerabilities and emphasizes the importance of the initial steps in penetration testing to identify security weaknesses in AR and VR systems. By highlighting these vulnerabilities, we aim to assist researchers in exploring and mitigating these security challenges, ensuring the safe deployment and use of AR and VR technologies across various sectors.

Inception Attacks: Immersive Hijacking in Virtual Reality Systems

Remote Keylogging Attacks in Multi-user VR Applications

I Know What You Enter on Gear VR

De-anonymizing Avatars in Virtual Reality: Attacks and Countermeasures

De-anonymization Attacks on Metaverse.

mmSpyVR: Exploiting mmWave Radar for Penetrating Obstacles to Uncover Privacy Vulnerability of Virtual Reality

Exploiting Out-of-band Motion Sensor Data to De-anonymize Virtual Reality Users

Exploring the Privacy Risks of Adversarial VR Game Design

Immersed in Reality Secured by Design -- A Comprehensive Analysis of Security Measures in AR/VR Environments

GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices

Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience

Non-intrusive and Unconstrained Keystroke Inference in VR Platforms via Infrared Side Channel

How Interactions Influence Users' Security Perception of Virtual Reality Authentication?

Penetration Vision through Virtual Reality Headsets: Identifying 360-degree Videos from Head Movements

Going Incognito in the Metaverse: Achieving Theoretically Optimal Privacy-Usability Tradeoffs in VR

Protecting Human Users Against Cognitive Attacks in Immersive Environments

Virtual Reality and Augmented Reality Security: A Reconnaissance and Vulnerability Assessment Approach

Exploiting the Uncoordinated Privacy Protections of Eye Tracking and VR Motion Data for Unauthorized User Identification

POSTER - ReAvatar - Virtual Reality De-anonymization Attack Through Correlating Movement Signatures.

The Dark Side of Perceptual Manipulations in Virtual Reality

Mitigating Privacy Threats Without Degrading Visual Quality of VR Applications: Using Re-Identification Attack As a Case Study