We’ve written before about what Meta’s Ray-Ban smart glasses can see and hear, and who might get to use that information. Those worries focus on how the glasses handle information during normal use. A security researcher has now shown how to bypass a safeguard meant to stop unauthorized software running on them.
Vulnerability researcher Paula, known online as pamoutaf, found a way to run her own software on a pair of Ray-Ban Meta glasses. For the technical details I’ll gladly refer you to her own post about it.
The glasses are controlled by the Meta AI app on the owner’s phone. Developers can add their own apps to the glasses through a developer tool, and the phone sends that software to the glasses to install.
The glasses were supposed to check that the software really came from Meta. In older firmware (up to and including version 126), they didn’t check, so the researcher could swap in an app of her own.
Meta introduced a check in firmware version 127 to verify the app’s digital signature to prove that it came from Meta . The researcher found the on/off switch for that signature check came from a settings file passed along by the phone. The glasses only checked the file was correctly formed, not whether it had been tampered with. Changing a single byte in the file turned the signature check off.
Once her app was running, she could send commands to the glasses from the paired phone over a wireless connection.
The glasses have a camera, microphones and a wireless connection, and they sit on your face all day. A wearable that can be made to run unapproved code goes beyond a privacy-policy question. It becomes a security question about who controls the device. As we’ve seen, some cheaper smart glasses already are a security disaster.
In this case the person running the code would be the person that controls the phone. If malicious software running on the glasses could access the camera or stored recordings, it could potentially send footage to an attacker’s server. Pamoutaf’s research doesn’t demonstrate that scenario, but it raises questions about what that software might be able to access.
In her post she promised a follow-up exploring other potential ways to attack the glasses.
How to stay safe
Keep the glasses’ firmware and the Meta AI app updated, and avoid unofficial apps or modifications.
If smart glasses are just another gadget to you, I’d leave them on the shelf. If you rely on them as an accessibility aid, you deserve technology that helps you without putting your privacy or other people’s at risk.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.