Inexpensive Smart Glasses Pose Significant Security and Privacy Risks
Researchers have uncovered over a dozen critical vulnerabilities in affordable smart glasses, enabling attackers to steal data, capture media, and hijack device control.
Security researchers have identified a concerning landscape of vulnerabilities within inexpensive smart glasses, raising significant privacy and security alarms. A joint investigation by NSB Cyber and Abstract Shield, detailed by ABC Australia, scrutinized two budget-friendly smart glass models priced at approximately A$60 and A$110. The findings revealed more than a dozen flaws affecting the glasses themselves, their companion mobile applications, and associated online platforms.
The most critical vulnerability discovered is an insecure Bluetooth pairing mechanism. When the smart glasses are powered on but not actively connected to a user's phone, an attacker can intercept and establish a connection without any form of password protection or robust pairing confirmation. This allows unauthorized access, enabling attackers to remotely control the glasses to capture photos and audio recordings, exfiltrate existing media files stored on the device, and intercept data transmitted between the glasses and the user's smartphone.
Further exploitation of this Bluetooth vulnerability allows attackers to impersonate the victim's smart glasses. By making a malicious device appear as the legitimate smart glasses, an attacker can trick the user's mobile app into connecting to the imposter device. This could lead to the theft of sensitive information or the execution of unauthorized commands through the compromised app connection.
Beyond Bluetooth, the research also highlighted weaknesses in how user data is handled. A combination of a Bluetooth-visible device identifier and a flaw on the app's website could allegedly be used to retrieve a user's email address and date of birth. This exposes personal information that could be used for identity theft or targeted phishing attacks.
A significant privacy concern arises from the glasses' built-in AI features. Voice commands, text inputs, and images sent to the AI were found to be transmitted to a server located in Shenzhen, China. While the exact subsequent use of this data remains unclear, the server's location and the AI's responses to specific queries suggest a reliance on Chinese sovereign AI models. This raises questions about data sovereignty and potential government access to user data.
Experts noted that the failure to disclose the use of Chinese servers in the privacy policy likely violates Australian Privacy Principles. The timing of these findings is also pertinent, as Australia's new smart-device security standards, which mandate measures like unique default passwords and vulnerability reporting mechanisms, apply to devices manufactured after March 4, 2026. While these specific glasses may fall outside the scope of these new regulations depending on their manufacturing date, they are still believed to contravene existing Australian privacy and cyber security laws.
Consumers owning such devices are advised to exercise extreme caution. It is recommended to avoid pairing or using inexpensive camera glasses that lack clear security features like physical pairing steps, account authentication, a published vulnerability contact, and a stated update support period. Users should refrain from using AI or cloud features for sensitive information, revoke unnecessary app permissions, check for updates, and consider returning the product if vendors cannot provide evidence of security fixes.
This research underscores a broader trend of inadequate security in low-cost consumer electronics. As smart devices become more integrated into daily life, the potential for privacy breaches and security compromises grows, especially when cost-cutting measures lead to the neglect of fundamental security principles. The findings serve as a stark reminder for consumers to scrutinize the security practices of device manufacturers, particularly for products that handle personal data and media.