Apple’s Vision Pro: How GAZEploit Could Have Eyeballed Your Passwords
Apple’s Vision Pro mixed reality headset had a security flaw that allowed attackers to infer data entered via the device’s virtual keyboard, dubbed GAZEploit. The vulnerability was patched in visionOS 1.3, preventing attackers from analyzing virtual avatars’ eye movements to extract sensitive information like passwords.
Hot Take:
Just when you thought your virtual reality was secure, along comes GAZEploit to remind you that even your eye movements are fair game for hackers. Looks like we’re all going to need virtual tinfoil hats next!
Key Points:
- A vulnerability in Apple’s Vision Pro headset allowed attackers to infer data entered on a virtual keyboard.
- The attack, named GAZEploit, uses eye gaze data to reconstruct typed text.
- Apple patched this flaw in visionOS 1.3, released on July 29, 2024.
- The vulnerability, CVE-2024-40865, affected a component called Presence.
- Attackers could potentially extract sensitive information like passwords through this method.
Already a member? Log in here