Virtual Reality (VR) techniques, serving as the bridge between the real and virtual worlds, have boomed and are widely used in manufacturing, remote healthcare, gaming, etc. Specifically, VR systems offer users immersive experiences that include both perceptions and actions. Various studies have demonstrated that attackers can manipulate VR software to influence users' interactions, including perception and actions. However, such attacks typically require strong access and specialized expertise. In this paper, we are the first to present a systematic analysis of physical attacks against VR systems and introduce False Reality, a new attack threat to VR devices without requiring access to or modification of their software. False Reality disturbs VR system services by tampering with sensor measurements, and further spoofing users' perception even inducing harmful actions, e.g., inducing dizziness or causing users to crash into obstacles, by exploiting perceptual and psychological effects. We formalize these threats through an attack pathway framework and validate three representative pathways via physical experiments and user studies on five commercial VR devices. Finally, we further propose a defense prototype to mitigate such threats. Our findings shall provide valuable insights for enhancing the security and resilience of future VR systems.
Princeton University（普林斯顿大学）；Penn State University（宾夕法尼亚州立大学）
Recently, test-time adaptation (TTA) has been proposed as a promising solution for addressing distribution shifts. It allows a base model to adapt to an unforeseen distribution during inference by leveraging the information from the batch of (unlabeled) test data. However, we uncover a novel security vulnerability of TTA based on the insight that predictions on benign samples can be impacted by malicious samples in the same batch. To exploit this vulnerability, we propose Distribution Invading Attack (DIA), which injects a small fraction of malicious data into the test batch. DIA causes models…
mmSpyVR: Exploiting mmWave Radar for Penetrating Obstacles to Uncover Privacy Vulnerability of Virtual Reality
Southeast University（东南大学）；City University of Hong Kong（香港城市大学）；Michigan State University（密歇根州立大学）；Singapore University of Technology and Design（新加坡科技设计大学）；University of Minnesota（明尼苏达大学）
When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
Beihang University（北京航空航天大学）；Zhongguancun Laboratory（中关村实验室）；The Hong Kong Polytechnic University（香港理工大学）；Beijing Institute of Technology（北京理工大学）；Amber Group（安比集团）；Huazhong University of Science and Technology（华中科技大学）
Cyber security is one of the burning issues in modern world. Increased IT infrastructure has given rise to enormous chances of security breach. Bangladesh being a relatively new member of cyber security arena has its own demand and appeal. Digitalization is happening in Bangladesh for last few years at an appreciable rate. People are being connected to the worldwide web community with their smart devices. These devices have their own vulnerability issues as well as the data shared over the internet has a very good chances of getting breached. Common vulnerability issues like infecting the devi…
Recently, various techniques (e.g., fuzzing) have been developed for vulnerability detection. To evaluate those techniques, the community has been developing benchmarks of artificial vulnerabilities because of a shortage of ground-truth. However, people have concerns that such vulnerabilities cannot represent reality and may lead to unreliable and misleading results. Unfortunately, there lacks research on handling such concerns. In this work, to understand how close these benchmarks mirror reality, we perform an empirical study on three artificial vulnerability benchmarks - LAVA-M, Rode0day an…
Social Virtual Reality based Learning Environments (VRLEs) such as vSocial render instructional content in a three-dimensional immersive computer experience for training youth with learning impediments. There are limited prior works that explored attack vulnerability in VR technology, and hence there is a need for systematic frameworks to quantify risks corresponding to security, privacy, and safety (SPS) threats. The SPS threats can adversely impact the educational user experience and hinder delivery of VRLE content. In this paper, we propose a novel risk assessment framework that utilizes at…
When Ads Become Profiles: Uncovering the Invisible Risk of Web Advertising at Scale with LLMs
The University of New South Wales（新南威尔士大学）；Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Queensland University of Technology（昆士兰理工大学）
Advanced Topic Modeling Techniques for Categorizing Software Vulnerabilities
Department of Computer Science & Engineering, Amrita School of Computing, Bengaluru, Amrita Vishwa Vidyapeetham, India（计算机科学与工程系，Amrita计算学院，班加罗尔，Amrita世界大学，印度）
More than a dozen wireless technologies are used by air traffic communication systems during different flight phases. From a conceptual perspective, all of them are insecure as security was never part of their design. Recent contributions from academic and hacking communities have exploited this inherent vulnerability to demonstrate attacks on some of these technologies. However, not all of these contributions have resonated widely within aviation circles. At the same time, the security community lacks certain aviation domain knowledge, preventing aviation authorities from giving credence to t…
The non-intrusive nature and high accuracy of face recognition algorithms have led to their successful deployment across multiple applications ranging from border access to mobile unlocking and digital payments. However, their vulnerability against sophisticated and cost-effective presentation attack mediums raises essential questions regarding its reliability. In the literature, several presentation attack detection algorithms are presented; however, they are still far behind from reality. The major problem with existing work is the generalizability against multiple attacks both in the seen a…
