An Empirical Study on Oculus Virtual Reality Applications: Security and Privacy Perspectives

TL;DR

This paper introduces the VR-SP detector, a static-analysis–based tool that combines code analysis and privacy-policy NLP to evaluate security and privacy in Oculus VR apps. By applying VR-SP to 500 apps from Oculus and SideQuest, it uncovers pervasive manifest risks, OS- and VR-platform vulnerabilities, PII and biometric data leaks, and substantial privacy-policy inconsistencies, including GDPR non-compliance. The work provides concrete findings (e.g., widespread dangerous manifest flags, lack of root-detection, biometric data usage without permissions, and policy contradictions) and concrete developer guidance to improve VR app security and user privacy. Overall, the study highlights the need for integrated security/privacy tooling in metaverse app development and establishes a benchmark for future VR privacy research and tooling iterations.

Abstract

Although Virtual Reality (VR) has accelerated its prevalent adoption in emerging metaverse applications, it is not a fundamentally new technology. On one hand, most VR operating systems (OS) are based on off-the-shelf mobile OS. As a result, VR apps also inherit privacy and security deficiencies from conventional mobile apps. On the other hand, in contrast to conventional mobile apps, VR apps can achieve immersive experience via diverse VR devices, such as head-mounted displays, body sensors, and controllers though achieving this requires the extensive collection of privacy-sensitive human biometrics. Moreover, VR apps have been typically implemented by 3D gaming engines (e.g., Unity), which also contain intrinsic security vulnerabilities. Inappropriate use of these technologies may incur privacy leaks and security vulnerabilities although these issues have not received significant attention compared to the proliferation of diverse VR apps. In this paper, we develop a security and privacy assessment tool, namely the VR-SP detector for VR apps. The VR-SP detector has integrated program static analysis tools and privacy-policy analysis methods. Using the VR-SP detector, we conduct a comprehensive empirical study on 500 popular VR apps. We obtain the original apps from the popular Oculus and SideQuest app stores and extract APK files via the Meta Oculus Quest 2 device. We evaluate security vulnerabilities and privacy data leaks of these VR apps by VR app analysis, taint analysis, and privacy-policy analysis. We find that a number of security vulnerabilities and privacy leaks widely exist in VR apps. Moreover, our results also reveal conflicting representations in the privacy policies of these apps and inconsistencies of the actual data collection with the privacy-policy statements of the apps. Based on these findings, we make suggestions for the future development of VR apps.

Figures (9)

• Figure 1: The Overview of VR-SP Detector
• Figure 2: APK Structure of VR App
• Figure 3: App size & Downloads Distribution
• Figure 4: Manifest Analysis Result
• Figure 5: Dangerous Permission