Inception Attacks: Immersive Hijacking in Virtual Reality Systems

TL;DR

This work reveals a new class of security threats in virtual reality by introducing immersive hijacking via inception attacks, where an attacker traps a user inside a malicious app that imitates the VR interface. The authors implement and evaluate the attack on Meta Quest devices, demonstrating feasible eavesdropping and real-time manipulation of both 2D and 3D apps, including browser content and VRChat conversations, through IRB-approved user studies. They analyze threat models, present a three-step attack process, and propose a multifaceted defense pipeline encompassing prevention, detection, and hardware-based mitigations. The findings highlight the unique challenges of securing immersive VR environments and underscore the urgency for robust defenses as VR platforms mature and enable more powerful attacks with advances in AI-generated content. Overall, the paper provides both a practical demonstration of a high-risk VR vulnerability and a strategic framework for strengthening VR security and user awareness.

Abstract

Today's virtual reality (VR) systems provide immersive interactions that seamlessly connect users with online services and one another. However, these immersive interfaces also introduce new vulnerabilities, making it easier for users to fall prey to new attacks. In this work, we introduce the immersive hijacking attack, where a remote attacker takes control of a user's interaction with their VR system, by trapping them inside a malicious app that masquerades as the full VR interface. Once trapped, all of the user's interactions with apps, services and other users can be recorded and modified without their knowledge. This not only allows traditional privacy attacks but also introduces new interaction attacks, where two VR users encounter vastly different immersive experiences during their interaction. We present our implementation of the immersive hijacking attack on Meta Quest headsets and conduct IRB-approved user studies that validate its efficacy and stealthiness. Finally, we examine effectiveness and tradeoffs of various potential defenses, and propose a multifaceted defense pipeline.

Figures (11)

• Figure 1: Inception Attacks: A user thinks they are interacting directly with a VR app launched from the VR home environment, when they are in fact interacting with a simulated environment inside the attacker's inception layer.
• Figure 2: Screenshot of an example 3D home environment with a menu panel for apps, captured on a Meta Quest Pro headset.
• Figure 3: The app library window in the Meta Quest Pro VR home. The user is selecting an app called wolvic.
• Figure 4: A side-by-side comparison of Meta Quest Browser and our replica. Full size images at Appendix, Figure \ref{['fig:browser_fullsize']}.
• Figure 5: In a banking scenario, the Bank of America server sends the correct account balance to the headset. Our attack modifies this balance to display $10 on the headset screen.