Alfred Ng* says a research team has demonstrated a proof-of-concept attack on virtual reality that could alter what a user sees and therefore lead them into danger.
Photo: Samuel Zeller
Virtual reality (VR) systems like the HTC Vive and Oculus Rift are so immersive that they require digital barriers so you don’t run into a real wall in the middle of an intense game.
But there’s nothing stopping an attacker from changing what you see in VR, according to researchers from the University of New Haven in Connecticut.
The researchers found that in a controlled attack, they were able to alter what a person could see in VR on the Oculus Rift and the Vive.
In fact, the systems include no protection to stop these kinds of attacks, Ibrahim Baggili, Director of the university’s Cyber Forensics Research and Education Group (Unhcfreg), and the paper’s co-author, Peter Gromkowski, said in an interview.
The research comes in two papers, one published this month, and another currently under peer review by academics.
The researchers are set to present their findings in May at a workshop that is part of a conference for the IEEE Symposium on Security and Privacy.
The report hints at the potential dangers of virtual reality, a once-hot tech that immerses you in a digital world through special gear like headsets and controllers.
Even without the threat of a hack, interest in VR has stalled due to expensive hardware and the dearth of meaningful experiences, despite the backing of heavy hitters like Facebook, Google and Samsung.
The University of New Haven research team infected a computer through malware attached to an email in an effort to see what protections VR had on a compromised computer.
They wanted to see how software on the Oculus Rift and the HTC Vive could stay secure if other safeguards failed.
“It was created with little security in mind, and they’re completely relying on the security of the operating system and the user,” Baggili said.
The attack tests were all done through OpenVR, a software development kit developed by Valve, and used by both Oculus and HTC when those systems are playing games on the Steam platform.
Because the research team was focused on testing the integrity of the VR system, it didn’t take into account the antivirus software and other protections already in place on a user’s computers.
Oculus, a unit of Facebook, disagreed with the research findings on gaming vulnerabilities.
Oculus said it worked with the team to address the flaws mentioned for Facebook Spaces and regularly invites researchers to participate in Facebook’s bug bounty program.
The majority of apps for Oculus run through its own store, and not on Steam, a person familiar with Oculus’s setup said.
Oculus said it has other protections for the data in place, and that adding encryption to Guardian, its program for guiding you through the virtual world, would only add unnecessary complexity and bugs.
“Guardian settings are not vulnerable unless your machine is compromised, in which case, every app and file on your computer is also susceptible,” said an Oculus spokesperson.
HTC didn’t comment on the study.
“We are evaluating the scenarios with our engineering team and do not have more to share at this time,” an HTC spokesman said.
Valve didn’t respond to a request for comment.
Gromkowski said VR systems shouldn’t just rely on their PCs for security.
Password managers on compromised computers still have encrypted data and restricted access, he noted.
“Considering the sensitivity of the information, you would expect there to be a greater level of protection, or at least the data be handled in a somewhat restricted manner,” the researcher said.
Blunderwall
Usually, there are several protections on software so that attackers don’t have a clear path to important data.
For example, the US Federal Bureau of Investigation (FBI) had the iPhone of one of the San Bernardino terrorists, but Apple’s encryption meant they couldn’t see the data stored on it.
With OpenVR, Baggili and Gromkowski found crucial elements on the software that were not encrypted.
“The door was basically wide open once we had access to the system,” Gromkoski said.
That unencrypted access included the systems’ wall boundaries, the camera and the screen’s display.
The HTC Vive uses a digital barrier setup called “Chaperone,” which the researchers successfully altered.
That meant that an attacker could move virtual boundaries on the VR display — which could cause gamers to smack right into a wall while they’re playing.
“If you do it slow enough, the person will tend to adjust, and we can almost lead them to wherever we want to go,” Gromkowski said.
Researchers weren’t able to alter Oculus’s Guardian.
Baggili also added that this kind of attack could also lead to real-world consequences, because players are so immersed within the VR gameplay.
“If [an attacker] wants to hurt someone badly, let’s say they’re on the second floor, then they can move them to that stairway and have them fall down,” the researcher said.
In a video, the research team showed how they were able to make a player unknowingly walk across the room, even though in the game, he believed he was standing still.
“I can literally make you go somewhere without you knowing,” Gromkowski said.
“That, to me, is nuts.”
* Alfred Ng is a reporter for CNET News. He tweets at @alfredwkng.
This article first appeared at www.cnet.com.
