Researcher Bypasses Meta Smart Glasses Security to Run Custom Code

A security researcher, known online as pamoutaf, has successfully bypassed security safeguards on Meta's Ray-Ban smart glasses, enabling the execution of custom code on the wearable devices. This discovery raises significant security and privacy concerns, as it could allow malicious applications to access sensitive data captured by the glasses' cameras and microphones.

The smart glasses, controlled via the Meta AI app on a paired smartphone, are designed to only install software verified by Meta. However, pamoutaf found that older firmware versions, up to and including version 126, lacked the necessary signature checks to prevent the installation of unauthorized applications. This allowed the researcher to replace legitimate apps with her own custom code.

While Meta introduced digital signature verification in firmware version 127 to enhance security, pamoutaf discovered that the mechanism controlling this verification could be circumvented. The signature check is toggled via a settings file transmitted from the phone. Although the glasses verify the integrity of this settings file, they do not validate its origin or content. By altering a single byte within this file, the researcher was able to disable the signature verification process entirely.

Once custom code was running on the glasses, pamoutaf could issue commands to the device remotely via a wireless connection from the paired phone. The implications of this are substantial, given that the glasses are worn throughout the day and are equipped with cameras, microphones, and wireless connectivity. The ability to run unapproved code transforms a privacy policy issue into a critical security vulnerability.

While pamoutaf's research did not demonstrate a scenario where an attacker exfiltrates data, the potential exists. If malicious software were able to access the camera feed or stored recordings, it could theoretically transmit this sensitive information to an attacker's server. This vulnerability highlights the broader risks associated with sophisticated wearable technology and the potential for unauthorized access to personal data.

Pamoutaf has indicated plans for follow-up research to explore additional potential attack vectors on the smart glasses. To mitigate these risks, users are advised to keep their glasses' firmware and the Meta AI app updated, and to avoid installing unofficial applications or attempting unauthorized modifications.

The findings underscore the ongoing challenges in securing consumer electronics, particularly those equipped with advanced sensing capabilities. As smart glasses become more integrated into daily life, ensuring robust security measures against unauthorized code execution and data compromise will be paramount for user trust and safety.