GAZEploit: Remote keystroke inference attack by gaze estimation in VR/MR devices
wired.com
wired.com
For example, you could then use the AVP to stare at people and then claim afterwards you were doing no such thing.
I'd suggest blurring the face in a "password input context" (like password fields on the web with their redacted display text), but I suspect that that'd go against what Apple wants the Vision Pro experience to look like.
Oh man, this is my favorite part of the Apple Design Cycle!
1. Apple announces a new feature that is suspiciously invasive and only marginally useful (eg. iCloud Screening, Find My, OCSP, etc.)
2. Self-conscious, Apple releases a security whitepaper that explains how things should work but doesn't let anyone audit their system
3. Users assume that things are okay because the marketing tells them it is okay, and do not ever consider the potential for an exploit
4. The data leaks, either to advertisers, Apple employees, warrantless government allies, government adversaries or OEM contractors
5. Apple customers attempt to absolve themselves of responsibility ("How was I supposed to know?")
I've seen this process so many times at this point that I'm just apathetic to it all. Maybe one day people will learn to stop assuming the best when there is literally no evidence corroborating it.
https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...
https://apple.stackexchange.com/questions/445122/is-icloud-p...
Various oversight issues of that nature. Note: we could know about all of these exploits before-hand if Apple's supposedly-private infrastructure was meaningfully accountable.
> The researchers alerted Apple to the vulnerability in April, and the company issued a patch to stop the potential for data to leak at the end of July
Here is the keynote: https://www.youtube.com/live/JdBYVNuky1M?si=46vw7FG3SjWWBezn
9.25 is when they talk about unwanted tracking.
They thought a bit about stalking, but not enough to alter the experience, or release tools for non-apple owners to avoid being tracked.
Sure, there are some "industry leading features" but no-one else in industry decided to co-opt a network of ~1 billion devices to provide location updates.
Sure Apple made it very difficult to track an airtag on a person, for the owner's privacy. But that also means that the non-owner is less able to find it.
It takes about 3-5 days (although its been up to two weeks in some cases) before my various iphones twig that an errant airtag is with me.
Now you might see me as someone who is anti apple, or has an agenda against apple. Thats not the case.
The issue is, when you create a device like this, and marry it to such a capable platform, you have to own the side effects. It took something like _6 months_ to release an android airtag detector. Which means it was very much an after thought. Had they talked to any Domestic Violence support groups, they would have told them very clearly how these devices would be used. (I suspect they did, but that would destroy the product vision too much, so it was downgraded. )
Tile also has the advantage of not being able to provide any useful location data less than a few hundred meters (unless you use the beeper)
The spatial resolution that airtags are capable of, because of the network of iOS devices that were auto enrolled is far far greater than the shit that tile could hope to dream of.
just because tile is a fly by night type organisation, doesn't mean apple can get away with being so lacklustre about safety.
They _knew_ that this was a risk, but didn't choose to mitigate it until much later on. Had they bothered to listen to the nagging voices, they wouldn't have been surprised.
I wonder what the accuracy is if you drop the eye tracking and only do head tracking on that demo.
I don’t think eye tracking alone would give you the necessary bounds for inferring the keyboard size. For one, eyes flit around more and also are harder to see.
I also wonder how easily this attack is foiled by different key clusters. E.g it looks like they’re relying on large head movements at opposite ends of the keyboard to infer the bounds.
But keyboard use can be very clustered which would foil the ability to know how wide the user has the keyboard.
I imagine it also breaks when the user moves the keyboard
https://security.stackexchange.com/questions/41247/changing-...
That is so bad it almost has to be a deliberate method to extract passwords.
HN tends to dislike Microsoft, but they went to great lengths to build a HoloLens system where eye tracking was both useful and safe.
The eye tracking data never left the device, and was never directly available to the application. As a developer, you registered targets or gestures you were interested in, and the platform told you when the user for example looked to activate your target.
Lots of subtlety and care went into the design, so yes, the first six things you think of as concerns or exploits or problems were addressed, and a bunch more you haven't thought of yet.
If this is a space you care about, read up on HoloLens eye tracking.
It's pretty inexcusable if Apple is providing raw eye tracking streams to app developers. The exploits are too easy any too prevalent. [EDIT ADDED: the article is behind a paywall but it sounds from comments here like Apple is not providing raw eye tracking streams, this is about 3rd parties watching your eyes to extract your virtual typing while you are on a conference call]
Apple is not doing that. As the article describes, the issue is that your avatar (during a FaceTime call, for example) accurately reproduces your eye movements.
The exploit requires analysing the avatar's eyes, but as they're not the natural movements but replicated ones, there should be a lot less noise. And of course as you need to intentionally focus on specific UI targets, these movements are even less natural and fuzzy than if you were looking at your keyboard while typing.
I don't think that's an accurate description, either. The SharePlay "Persona" avatar is a system service just like the front-facing camera stream. Any app can opt into using either of them.
Apple should have been more careful about allowing any eye motion information (including simple video) to flow out of a system where eye movements themselves are used for data input.
Sure, but like everything. It is when it is widespread that the impact changes. The technology was around, but now it could be on everyone's face, tracking everything you look at.
If this was added to TV's so every TV was tracking your eye-movements, and reporting that back to advertisers. There would be an outcry.
So this is just the slow nudging us in that direction.
I agree that we should be vigilant when big corps are adding more and more sensors into our lives, but Apple is absolutely not reporting tracked eye-movement data to advertisers, nor do they allow third-party apps to do that.
The problem is the edge case where it's used for two different things with different demands at the same time, and the fix is to...not do that.
> Apple fixed the flaw in a Vision Pro software update at the end of July, which stops the sharing of a Persona if someone is using the virtual keyboard.
Or
"Ooopps, so sorry you caught us. Guess we'll have better luck keeping this hidden next time."
" lot about someone from their eyes. They can indicate how tired you are, the type of mood you’re in, and potentially provide clues about health problems. But your eyes could also leak more secretive information: your passwords, PINs, and messages you type."
Do you want that shared with advertisers? With your health care provider?
The article isn't about the technology, it is about sharing the data.
This exploit is not some kind of unprecedented new thing only possible with super-sensitive eye tracking data. It is completely analogous to watching/hearing someone type their password on their keyboard, either in person when standing next to them or remotely via their webcam/mic. It is also trivial to fix. Simply obfuscate the gaze data when interacting with sensitive inputs. This is actually much better than you can do when meeting in person. You can't automatically obfuscate your finger movements when someone is standing next to you while you enter your password.
The vast majority of people are not expert users, so for them having safe defaults is critical to their safety online.
> It is completely analogous to watching/hearing someone type their password on their keyboard,
Except the eye gaze vector is being delivered in high fidelity to your client so it can render the eyes.
Extracting eye gaze from normal video is exceptionally hard. Even with dedicated gaze cameras, its pretty difficult to get <5 degrees of certainty (without training or optimal lighting.)
Video passthrough also isn’t available except to “enterprise” developers, so all you can get back is the position of images or objects that you’re interested in when they come into view.
Even the Apple employee who helped me with setup advised me not to turn my head, but to keep my head static and use the glance-and-tap paradigm for interacting with the virtual keyboard. I don’t think this was directly for security purposes, just for keeping fatigue to a minimum when using the device for a prolonged period of time. But it does still have the effect of making it harder to determine your keystrokes than, say, if you were to pull the virtual keyboard towards you and type on it directly.
EDIT: The edit is correct. The virtual avatar is part of visionOS (it appears as a front camera in legacy VoIP apps) and as such it has privileged access to data collected by the device. Apparently until 1.3 the eye tracking data was used directly for the gaze on the avatar, and I assume Apple has now either obfuscated it or blocks its use during password entry. Presumably this also affects the spatial avatars during shared experiences as well.
Interestingly, I think the front display blanks out your gaze when you’re entering a password (I noticed it when I was in front of a mirror) to prevent this attack from being possible by using the front display’s eye passthrough.
Like checking out how you are zeroing in on the boobs. What would sponsored adds look like, once they also know what you are looking at every second. Even some medical add, and the eyes checkout the actresses body.
"Honey, why am I suddenly getting adds for Granny Porn?".
I think the headsets are pretty much in alignment that it's a feature that needs permissions but they'll provide it to the app with focus.
Apple is a lot more protective.
This article snippet is behind a paywall but it seems like it’s talking about the eyes that are projected on the outside of the device.
So basically it’s no more of an exploit than just tracking someone’s actual eyes.
Enabling "reader mode" bypasses the paywall in this instance
Now I want to make a keyboard where you shine a laser pointer at the key you want to press, and your cat jumping up is what actually triggers the button press.
fwiw while you can do that, it's much easier to just poke the keys or use Siri
a folding bluetooth keyboard with built in trackpad has become a must have travel accessory for me :)
The article title :
> Gaze estimation
It doesn't seem like it
Typing with your eyes is much faster and more subtle than what they show here.
Brilliant though, just brilliant.
Buying lunch - 1 Selling your home - 10
Even with optimal conditions (ie dedicated cameras, no eye make up and correct positioning) uncalibrated gaze has at least a 5 degree uncertainty.
That’s a pretty big assumption. Also, I guess the user has to be stationary - stay in the camera’s field of view and not move their head in a way that would obstruct the image.
Unless this is about intercepting in-device data; but in this case it seems easier to address.
The user is always stationary in relation to the headset and the cameras in it.
If you move around, your head moves too. If you stand up, you momentarily go out of frame before it applies a delayed sync. The idea being that it matches what a regular webcam would do.