A team of computer scientists has uncovered a significant security vulnerability in Apple's Vision Pro mixed reality headset, demonstrating how eye-tracking data could be exploited to decipher user inputs. This discovery highlights the potential privacy risks associated with advanced biometric technologies in wearable devices.
The GAZEploit Attack
Researchers developed an attack method dubbed GAZEploit, which analyzes the eye movements of a user's virtual avatar during video calls or streaming sessions. By observing these movements, the team was able to reconstruct passwords, PINs, and messages typed using the Vision Pro's virtual keyboard with alarming accuracy.
Key findings of the GAZEploit research include:
- 77% accuracy in guessing password characters within 5 attempts
- 92% accuracy in deciphering message content
- 73% success rate for PIN entries
- 86.1% accuracy for emails, URLs, and web pages
How GAZEploit Works
The attack relies on two main components:
- Identifying typing activity by analyzing the 3D avatar's eye movements
- Using geometric calculations to determine the virtual keyboard's position and size
By combining these elements, researchers could predict the keys a user was likely typing without direct access to the device itself.
Implications for Privacy and Security
This vulnerability raises concerns about the potential misuse of biometric data in wearable technology. As devices become more integrated into daily life, users may unknowingly expose sensitive information through seemingly innocuous features like eye tracking.
Dr. Alexandra Papoutsaki, an associate professor of computer science at Pomona College, noted the significance of the research, stating, The fact that now someone, just by streaming their Persona, could expose potentially what they're doing is where the vulnerability becomes a lot more critical.
Apple's Response
Apple was alerted to the vulnerability in April 2023 and issued a patch in July as part of the VisionOS 1.3 update. The fix prevents the sharing of a user's Persona when the virtual keyboard is in use, effectively mitigating the risk of eye-tracking data leakage.
Broader Implications
The GAZEploit research underscores the need for ongoing vigilance in protecting user privacy as wearable technologies advance. It serves as a reminder that even seemingly benign features can potentially be exploited in unexpected ways.
As the industry moves forward, balancing the benefits of innovative technologies with robust security measures will be crucial to maintaining user trust and protecting sensitive information.