Feeds

Ultra-hackable Google Glass could be a security nightmare

Easy root access opens spyware floodgates

Gartner critical capabilities for enterprise endpoint backup

Google's high-tech Glass headsets might be a gadget enthusiast's dream, but in their current form they're far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle "Saurik" – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

"Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices," Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 "Ice Cream Sandwich," including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can't be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don't use any kind of PIN – just turn them on and they're ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else's Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

"If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then ... launch into a security exploit to get root," Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

"Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head," Freeman writes. "A bugged Glass doesn't just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do."

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

"Nothing is safe once your Glass has been hacked," Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user's eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it's not operating. That could not only help reassure people that they're not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray's "duh!" outburst on Friday.

"As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system," Freeman writes. "The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion." ®

Boost IT visibility and business value

More from The Register

next story
Kate Bush: Don't make me HAVE CONTACT with your iPHONE
Can't face sea of wobbling fondle implements. What happened to lighters, eh?
Apple takes blade to 13-inch MacBook Pro with Retina display
Shaves price, not screen on mid-2014 model
iPhone 6 flip tip slips in Aussie's clip: Apple's 'reversible USB' leaks
New plug not compatible with official Type-C, according to fresh rumors
The agony and ecstasy of SteamOS: WHERE ARE MY GAMES?
And yes it does need a fat HDD (or SSD, it's cool with either)
Steve Jobs had BETTER BALLS than Atari, says Apple mouse designer
Xerox? Pff, not even in the same league as His Jobsiness
TV transport tech, part 1: From server to sofa at the touch of a button
You won't believe how much goes into today's telly tech
Apple analyst: fruity firm set to shift 75 million iPhones
We'll have some of whatever he's having please
Apple to build WORLD'S BIGGEST iStore in Dubai
It's not the size of your shiny-shiny...
NVIDIA claims first 64-bit ARMv8 SoC for Androids
Mile-High 'Denver' Tegra K1 successor said to rival PC performance
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.