That should be an easy fix in a future software update by simply not replicating eye movement as soon as the user is looking at the keyboard.
this post was submitted on 12 Sep 2024
85 points (96.7% liked)
Cybersecurity
5686 readers
48 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 1 year ago
MODERATORS
The solution is constant googly eyes.
Sounds like what they already did: as soon as the virtual keyboard pops up the eye movement isn't transmitted as part of the avatar.
Oh I see. According to the article:
The GAZEpolit researchers reported their findings to Apple in April and subsequently sent the company their proof-of-concept code so the attack could be replicated. Apple fixed the flaw in a Vision Pro software update at the end of July, which stops the sharing of a Persona if someone is using the virtual keyboard.
An Apple spokesperson confirmed the company fixed the vulnerability, saying it was addressed in VisionOS 1.3.
Seems like we're going to be stuck in the uncanny valley of telepresence. The more fidelity we add, the more we're able to pick up on microexpressions, subtle eye movements, and breathing, which helps trigger oxytocin and promote trust. But also, the more fidelity we add, the more attack surface we open up for malicious actors to exploit.
Easy fix.
bet same for video calls.
Sounds like you could do this to a person in a normal zoom call with no headset.
Most people don't look while typing, especially things with muscle memory like passwords, when using a physical keyboard. And a zoom call doesn't convey facial data in three dimensions. The unique nature of the virtual keyboard, plus the three dimensional avatar, makes this new attack more feasible.