Feeds

Ultra-hackable Google Glass could be a security nightmare

Easy root access opens spyware floodgates

3 Big data security analytics techniques

Google's high-tech Glass headsets might be a gadget enthusiast's dream, but in their current form they're far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle "Saurik" – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

"Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices," Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 "Ice Cream Sandwich," including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can't be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don't use any kind of PIN – just turn them on and they're ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else's Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

"If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then ... launch into a security exploit to get root," Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

"Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head," Freeman writes. "A bugged Glass doesn't just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do."

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

"Nothing is safe once your Glass has been hacked," Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user's eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it's not operating. That could not only help reassure people that they're not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray's "duh!" outburst on Friday.

"As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system," Freeman writes. "The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion." ®

SANS - Survey on application security programs

More from The Register

next story
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
US mobile firms cave on kill switch, agree to install anti-theft code
Slow and kludgy rollout will protect corporate profits
Leaked pics show EMBIGGENED iPhone 6 screen
Fat-fingered fanbois rejoice over Chinternet snaps
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Report: Apple seeking to raise iPhone 6 price by a HUNDRED BUCKS
'Well, that 5c experiment didn't go so well – let's try the other direction'
Rounded corners? Pah! Amazon's '3D phone has eye-tracking tech'
Now THAT'S what we call a proper new feature
Feast your PUNY eyes on highest resolution phone display EVER
Too much pixel dust for your strained eyeballs to handle
Hearthstone: Heroes of Warcraft – A jolly little war for lunchtime
Free-to-play WoW turn-based game when you have 20 minutes to kill
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.