Mexico. While virtual reality systems and their associated technologies bring multiple benefits, their use also raises security concerns. ESET, a proactive threat detection company, warns that the number of devices and spaces to use them has grown in recent times and cyberattackers are on the prowl.
Virtual and augmented reality is already being applied in several fields. They are used, for example, in the simulation of practices of health professionals, teaching and distance learning, in therapies and medical care, in art, virtual travel. It is even used by armies to improve soldiers' training missions and certain police forces to identify potential criminals. The expected growth in the global augmented and virtual reality chip market is estimated to be in the region of $7.76 billion by 2026 worldwide, according to Allied Market Research.
The metaverse, on the other hand, promises interaction through virtual and augmented reality with the development of open standards, and one of its goals, announced by the Metaverse Standards Forum, in 2022, is to foster collaboration in spatial computing in interactive 3D graphics, geospatial systems, physical simulation, and photorealistic content creation.
ESET mentions that virtual and augmented reality systems can collect much more personal information than traditional systems. For example, VR headsets with live microphones can record all conversations; HMD tracking systems with cameras, obtaining videos of private spaces and even recording what the user is looking at. This data, added to the biometric information collected by the devices, becomes a treasure trove for cybercriminals.
In these environments, it is almost impossible to anonymize tracking data because individuals have unique movement patterns that, together with behavioral and biological information collected in virtual reality headsets, make the user identifiable with a high degree of accuracy. A key privacy issue in these technologies is the highly personal nature of the data collected: biometric data such as iris or retina scans, fingerprints and handprints, face geometry, and vocal impressions. All this information is much more sensitive than that collected by current mass systems such as social networks, and other forms of technology, which are already used, for example, in identity theft attacks.
Some of the threats in communication networks, according to ESET, are:
Credential theft: Criminals can steal the network credentials of the portable devices being used. For example, in the case of sellers who use stores with augmented reality and virtual reality: if they do not have the necessary security layers, they expose their customers and the data recorded in their user profiles, such as credit card details and mobile payment solutions. Attackers could gain access to these profiles and silently deplete accounts.
Man-in-the-middle attacks: On the other hand, if networks are not properly managed, you would be exposed to man-in-the-middle attacks. Cybercriminals could eavesdrop on communications between the augmented reality browser and the augmented reality provider, or owners of the channel and third-party servers, resulting in attackers accessing highly sensitive information.
Denial-of-service attacks: Another potential attack on communications security is denial-of-service. It may be the case of a user who relies on augmented reality for work and suddenly loses access to the flow of information they were receiving. This could be worrisome if it's professionals using technology to perform tasks in critical situations: like a surgeon who suddenly loses access to vital real-time information in their VR goggles, or a driver who suddenly can't see the road because the VR windshield turned to a black screen.
"Today we have few resources since these technologies are still expanding and there are many things to define and work on. Current connectivity is wired or Wi-Fi, but future versions of Bluetooth are expected to have the bandwidth to support these virtual and augmented reality devices. It will then be necessary to implement high-bandwidth IPsec and TLS secure communications. To safeguard virtual reality that supports 5G, it will be important to implement end-to-end security, and to keep in mind that virtual and augmented reality systems have not yet implemented encryption for network connections, as is the case with other applications," said Mario Micucci, Information Security Researcher at ESET Latin America.
Protecting the VR network from cyberattacks and ensuring the integrity of transmitted data will be critical, according to ESET, and devices will become more vulnerable to attacks as they become more mobile. A VPN system can be used to help protect data and identity and privacy on the internet by preventing information from being compromised.
"These technologies are increasingly transversal to different areas of knowledge and make it complex to cover all the points that must be secured, such as IOT devices, virtual reality devices with their associated nature, information systems, and others. Cybercriminals will always look for their advantages and play against companies that make efforts to keep systems secure. It's important to remember that users will always be the line of defense against an attack and, at the very least, it's important to be informed and act accordingly," concludes Mario Micucci of ESET Latin America.
To be as protected as possible, ESET advises paying attention and thinking before acting, knowing that in this type of immersive universe it is more difficult to be distracted. Also, use some security solution such as antivirus software that helps keep systems protected and avoid headaches against threats related to malware, phishing and others.
