一句话：构建 VR-SP 检测器并对 500 个 Oculus VR 应用开展安全与隐私实证研究，揭示普遍漏洞与隐私政策不一致
VR 应用多基于现成移动操作系统，会继承传统移动应用的隐私与安全缺陷；同时它们借助头显、体感设备与手柄采集手部追踪、面部追踪等敏感生物特征，并普遍使用 Unity 等 3D 游戏引擎，从而引入新的风险，但这些问题尚未得到充分关注。本文开发了安全与隐私评估工具 VR-SP detector，将程序静态分析工具与隐私政策分析方法相结合；作者从 Oculus 与 SideQuest 应用商店获取 500 个热门 VR 应用，通过 Meta Oculus Quest 2 设备提取 APK，并利用 VR 应用分析、污点分析与隐私政策分析进行评估。结果表明安全漏洞与隐私泄露在 VR 应用中普遍存在，隐私政策内部存在相互矛盾的表述，其声明的数据收集与实际行为不一致，论文据此提出开发建议。
Although Virtual Reality (VR) has accelerated its prevalent adoption in emerging metaverse applications, it is not a fundamentally new technology. On one hand, most VR operating systems (OS) are based on off-the-shelf mobile OS (e.g., Android). As a result, VR apps also inherit privacy and security deficiencies from conventional mobile apps. On the other hand, in contrast to conventional mobile apps, VR apps can achieve immersive experience via diverse VR devices, such as head-mounted displays, body sensors, and controllers though achieving this requires the extensive collection of privacy-sensitive human biometrics (e.g., hand-tracking and face-tracking data). Moreover, VR apps have been typically implemented by 3D gaming engines (e.g., Unity), which also contain intrinsic security vulnerabilities. Inappropriate use of these technologies may incur privacy leaks and security vulnerabilities although these issues have not received significant attention compared to the proliferation of diverse VR apps. In this paper, we develop a security and privacy assessment tool, namely the VR-SP detector for VR apps. The VR-SP detector has integrated program static analysis tools and privacy-policy analysis methods. Using the VR-SP detector, we conduct a comprehensive empirical study on 500 popular VR apps. We obtain the original apps from the popular Oculus and SideQuest app stores and extract APK files via the Meta Oculus Quest 2 device. We evaluate security vulnerabilities and privacy data leaks of these VR apps by VR app analysis, taint analysis, and privacy-policy analysis. We find that a number of security vulnerabilities and privacy leaks widely exist in VR apps. Moreover, our results also reveal conflicting representations in the privacy policies of these apps and inconsistencies of the actual data collection with the privacy-policy statements of the apps. Based on these findings, we make suggestions for the future development of VR apps.
@inproceedings{paperbot11438,
title = {An Empirical Study on Oculus Virtual Reality Applications: Security and Privacy Perspectives},
author = {Hanyang Guo and Hong-Ning Dai and Xiapu Luo and Zibin Zheng and Gengyang Xu and Fengliang He},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639082}
}