Abstract:Although Virtual Reality (VR) has accelerated its prevalent adoption in emerging metaverse applications, it is not a fundamentally new technology. On one hand, most VR operating systems (OS) are based on off-the-shelf mobile OS. As a result, VR apps also inherit privacy and security deficiencies from conventional mobile apps. On the other hand, in contrast to conventional mobile apps, VR apps can achieve immersive experience via diverse VR devices, such as head-mounted displays, body sensors, and controllers though achieving this requires the extensive collection of privacy-sensitive human biometrics. Moreover, VR apps have been typically implemented by 3D gaming engines (e.g., Unity), which also contain intrinsic security vulnerabilities. Inappropriate use of these technologies may incur privacy leaks and security vulnerabilities although these issues have not received significant attention compared to the proliferation of diverse VR apps. In this paper, we develop a security and privacy assessment tool, namely the VR-SP detector for VR apps. The VR-SP detector has integrated program static analysis tools and privacy-policy analysis methods. Using the VR-SP detector, we conduct a comprehensive empirical study on 500 popular VR apps. We obtain the original apps from the popular Oculus and SideQuest app stores and extract APK files via the Meta Oculus Quest 2 device. We evaluate security vulnerabilities and privacy data leaks of these VR apps by VR app analysis, taint analysis, and privacy-policy analysis. We find that a number of security vulnerabilities and privacy leaks widely exist in VR apps. Moreover, our results also reveal conflicting representations in the privacy policies of these apps and inconsistencies of the actual data collection with the privacy-policy statements of the apps. Based on these findings, we make suggestions for the future development of VR apps.

I Know What You Enter on Gear VR

Remote Keylogging Attacks in Multi-user VR Applications

Penetration Vision through Virtual Reality Headsets: Identifying 360-degree Videos from Head Movements

GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices

Analysis and Design of Efficient Authentication Techniques for Password Entry with the Qwerty Keyboard for VR Environments

Inception Attacks: Immersive Hijacking in Virtual Reality Systems

Key Listener: Inferring Keystrokes on QWERTY Keyboard of Touch Screen Through Acoustic Signals

Blind Recognition of Touched Keys: Attack and Countermeasures

Exploiting Out-of-band Motion Sensor Data to De-anonymize Virtual Reality Users

mmSpyVR: Exploiting mmWave Radar for Penetrating Obstacles to Uncover Privacy Vulnerability of Virtual Reality

Exploiting the Uncoordinated Privacy Protections of Eye Tracking and VR Motion Data for Unauthorized User Identification

Blind Recognition Of Touched Keys On Mobile Devices

Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience

How Interactions Influence Users' Security Perception of Virtual Reality Authentication?

Immersed in Reality Secured by Design -- A Comprehensive Analysis of Security Measures in AR/VR Environments

Virtual Reality and Augmented Reality Security: A Reconnaissance and Vulnerability Assessment Approach

BehaVR: User Identification Based on VR Sensor Data

Exploring the Vulnerabilities and Advantages of SWIPE or Pattern authentication in Virtual Reality (VR)

An Empirical Study on Oculus Virtual Reality Applications: Security and Privacy Perspectives

Designing Leakage-Resilient Password Entry on Head-Mounted Smart Wearable Glass Devices

Security Considerations for Virtual Reality Systems