Some cheap smart glasses are a security disaster
NSB Cyber and Abstract Shield found a dozen flaws in cheap smart glasses, including unauthenticated Bluetooth pairing letting attackers hijack cameras and intercept data.
Researchers tested two low-cost smart glasses models (A$60 and A$110) and found over a dozen flaws across the devices, companion apps, and associated websites. Insecure Bluetooth pairing allows an attacker to connect to unattended glasses without a password, then capture photos and recordings, copy media, and intercept data. A device identifier plus a website weakness could expose users' email addresses and dates of birth, and AI inputs were routed through a Shenzhen server, likely breaching Australian Privacy Principles and Cyber Security Act rules.
- Unauthenticated Bluetooth pairing allows full attacker takeover of unattended glasses
- Attacker can capture recordings, copy media, and impersonate glasses to the mobile app
- Website weakness plus Bluetooth identifier can leak user email and date of birth
- Voice, text, and images sent to the built-in AI were transmitted to a Shenzhen server
- Devices appear to violate Australian privacy law and 2026 smart-device security standards
Full article583 words · extracted from malwarebytes.com · click to collapse
Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all.
ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 (around US$42 and US$78), and found more than a dozen flaws across the smart glasses themselves, their app, and an associated website.
The main problem they uncovered was insecure Bluetooth pairing: If the glasses were powered on and not connected to their owner’s phone, an attacker could connect first, with no password or meaningful pairing confirmation.
After connecting, an attacker could reportedly control the glasses to capture photos or recordings, copy existing media, and intercept data moving between the glasses and the phone. An attacker could also make another device appear to be the victim’s glasses, allowing it to connect to the owner’s mobile app.
The testing also found that a Bluetooth-visible device identifier could allegedly be used with a weakness in the app’s website to retrieve a user’s email address and date of birth.
The research uncovered another privacy issue. ABC reports that voice or text submitted to the built-in AI, along with images sent to it, was first transmitted to a server in Shenzhen and could be forwarded elsewhere, depending on the function. The tests did not establish how the data was subsequently used.
The server locations, combined with some of the AI’s answers to specific questions, led researchers to conclude that the chatbot companion relied at least in part on Chinese sovereign AI models. Professor Kimberlee Weatherall, a technology regulation expert involved in the testing, said the failure to identify China in the privacy policy appeared to violate the Australian Privacy Principles,
The timing of the testing is also relevant because Australia’s smart-device security standards apply to most consumer smart devices manufactured on or after March 4, 2026. They require, among other measures, no universal default passwords, a way to report vulnerabilities, and information about the minimum security-update period. Devices made before that date are outside the requirements.
Experts quoted by ABC said the devices violated Australia’s privacy laws and were also likely to breach several sections of the Cyber Security Act. However, whether the new smart-device standards apply would depend partly on when the glasses were manufactured, and the rules have not yet been tested in a known enforcement action.
Professor Weatherall said:
“The rules say that the password must be unique. It doesn’t even seem like they were applying a password, which might mean that their standards are so low they don’t even technically breach that rule, which I find amazing.”
What to do
We’re not fans of smart glasses, expensive or cheap. But if you own a pair:
- Avoid pairing or using inexpensive camera glasses that lack a clear physical pairing step, account authentication, a published security-contact process, and a stated update-support period.
- Stop using their AI or cloud features for sensitive material, remove unnecessary permissions from the companion app, check for firmware and app updates, and consider returning the product if the vendor cannot document a fix.
- Ask permission before recording people, and check your local laws to understand what is and isn’t allowed.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
About the author
Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.