Security Analysis of Immersive Virtual Reality and Its Implications

Immersive virtual reality is currently used not only for entertainment but also for work and social interaction where user's privacy and confidentiality of the information has a high priority. Unfortunately, security measures applied by software vendors are often not sufficient. This thesis delivers an extensive security analysis of a popular VR application Bigscreen which has more than 500,000 users. Techniques of network traffic analysis, penetration testing, reverse engineering, and even application crippling were utilised. Research led to a discovery of critical vulnerabilities directly exposing the privacy of the users and allowing the attacker to take full control of a victim's computer. Found security flaws allowed distribution of malware and creation of a botnet using a computer worm spreading in virtual environments. A novel VR cyber attack Man-in-the-Room was implemented. Furthermore, a security vulnerability in the Unity engine was discovered. Carried out responsible disclosure has helped to mitigate the risks for more than half a million Bigscreen users and all affected Unity applications worldwide.

Immersive Virtual Reality, Man-in-the-Room Attack, Responsible Disclosure, Bigscreen, Unity, Forensic Analysis, Security Analysis, Network Traffic Analysis, Penetration Testing, Reverse Engineering, Application Patching, Application Crippling, Augmented Reality, Mixed Reality, HTC Vive, Oculus Rift, Altspace VR, Rec Room, Facebook Spaces