Abstract:Various industries have widely adopted Virtual Reality (VR) and Augmented Reality (AR) technologies to enhance productivity and user experiences. However, their integration introduces significant security challenges. This systematic literature review focuses on identifying devices used in AR and VR technologies and specifies the associated vulnerabilities, particularly during the reconnaissance phase and vulnerability assessment, which are critical steps in penetration testing. Following Kitchenham and Charters' guidelines, we systematically selected and analyzed primary studies. The reconnaissance phase involves gathering detailed information about AR and VR systems to identify potential attack vectors. In the vulnerability assessment phase, these vectors are analyzed to pinpoint weaknesses that malicious actors could exploit. Our findings reveal that AR and VR devices, such as headsets (e.g., HTC Vive, Oculus Quest), development platforms (e.g., Unity Framework, Google Cardboard SDK), and applications (e.g., Bigscreen VR, VRChat), are susceptible to various attacks, including remote code execution, cross-site scripting (XSS), eavesdropping, and man-in-the-room attacks. Specifically, the Bigscreen VR application exhibited severe vulnerabilities like remote code execution (RCE) via the 'Application.OpenURL' API, XSS in user inputs, and botnet propagation. Similarly, the Oculus Quest demonstrated susceptibility to side-channel attacks and ransomware. This paper provides a detailed overview of specific device vulnerabilities and emphasizes the importance of the initial steps in penetration testing to identify security weaknesses in AR and VR systems. By highlighting these vulnerabilities, we aim to assist researchers in exploring and mitigating these security challenges, ensuring the safe deployment and use of AR and VR technologies across various sectors.

Towards Secure and Usable Authentication for Augmented and Virtual Reality Head-Mounted Displays

Secure and Memorable Authentication Using Dynamic Combinations of 3D Objects in Virtual Reality

Beyond Gaze Points: Augmenting Eye Movement with Brainwave Data for Multimodal User Authentication in Extended Reality

Security Considerations for Virtual Reality Systems

Security of Virtual Reality Authentication Methods in Metaverse: An Overview

Towards Security and Privacy for Multi-user Augmented Reality: Foundations with End Users

Immersed in Reality Secured by Design -- A Comprehensive Analysis of Security Measures in AR/VR Environments

Virtual Reality and Augmented Reality Security: A Reconnaissance and Vulnerability Assessment Approach

How Interactions Influence Users' Security Perception of Virtual Reality Authentication?

Design of Secure and Efficient Authentication Protocol for Edge Computing-Based Augmented Reality Environments

Authentication Framework for Augmented Reality with Data-Hiding Technique

Augmenting Security and Privacy in the Virtual Realm: An Analysis of Extended Reality Devices

GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices

GazePair: Efficient Pairing of Augmented Reality Devices Using Gaze Tracking

Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience

Inception Attacks: Immersive Hijacking in Virtual Reality Systems

That Doesn't Go There: Attacks on Shared State in Multi-User Augmented Reality Applications

Designing Leakage-Resilient Password Entry on Head-Mounted Smart Wearable Glass Devices

A Secure Authentication Framework to Guarantee the Traceability of Avatars in Metaverse

Neuroergonomic Solutions in AR and VR Applications

Remote Keylogging Attacks in Multi-user VR Applications