Eyes wide open: How to mitigate the security and privacy risks of smart glasses

Smart glasses introduce significant security and privacy risks by enabling widespread, often covert, tracking and recording, endangering personal data and the privacy of individuals in their vicinity.

Technical Breakdown:

• Threat Vector: The core capability of smart glasses to passively capture audio, video, and potentially other sensor data from the user's environment. This inherent function creates a persistent data collection surface.
• Privacy Risks:
  • Unauthorized Data Collection: Recording of individuals, conversations, and sensitive information without consent or awareness.
  • Surveillance Potential: Facilitating covert surveillance in public or private spaces, bypassing traditional expectations of privacy.
  • Data Exposure: Metadata (e.g., location, time, associated accounts) collected alongside recordings can further compromise privacy.
• Security Risks:
  • Device Vulnerabilities: Insecure firmware or operating systems can expose collected data to unauthorized access.
  • Network Interception: Data transmission from glasses to paired devices or cloud services may be vulnerable to interception if not properly encrypted.
  • App Security Flaws: Companion applications handling collected data may contain vulnerabilities leading to data leakage or compromise.
• Affected Scope: Individuals (wearers and bystanders) and organizations that operate in environments where smart glasses are used.
• TTPs/IOCs: No specific TTPs (e.g., detailed attack chains) or IOCs (e.g., hashes, IPs) are detailed, as this analysis covers the general risk landscape of smart glasses as a technology category.

Defense:

• Policy & Education: Establish clear organizational policies for smart glass usage; educate users on privacy implications and responsible data handling.
• Security Controls: Implement robust security configurations for devices and associated applications, including strong authentication, encryption for data at rest and in transit, and regular vulnerability assessments.
• Transparency & Consent: Advocate for and prioritize features that provide clear recording indicators and mechanisms for informed consent to mitigate privacy concerns.

Source: https://www.welivesecurity.com/en/privacy/eyes-wide-open-mitigate-security-privacy-risks-smart-glasses/