Researcher bypassed Ray-Ban Meta glasses checks to run her code
Original title: Researcher bypassed Meta smart glasses’ safeguards to run her own code
Firmware through version 126 skipped signature checks; version 127’s check can be disabled by editing a phone settings file.
Researcher Paula, known as pamoutaf, showed she could install her own software on Ray-Ban Meta glasses. Firmware up to and including version 126 did not verify that apps came from Meta. Version 127 added a signature check, but a settings file supplied by the paired phone could turn that check off if one byte was changed. Once running, her app could receive commands from the phone over a wireless link.
Unconfirmed: The write-up does not show that malicious glasses software can reach the camera, stored recordings, or an attacker server.
- The Meta AI app on the owner’s phone installs developer apps on the glasses.
- Version 127 checks that the settings file is well formed, not that it is untampered.
- The demonstrated control requires the person who controls the paired phone.
- Her research does not show camera or recording access or footage exfiltration.
- She said a follow-up would explore other ways to attack the glasses.
Impact: Run unapproved code on the glasses from the paired phone
| Product | Affected |
|---|---|
| Meta Ray-Ban Meta glasses | firmware up to and including version 126; version 127 |
- 1.Keep the glasses firmware and the Meta AI app updated.
- 2.Avoid unofficial apps or modifications.
From the original article
2 min read at malwarebytes.com
She was able to bypass a safeguard meant to stop unauthorized software running on Meta glasses. It wasn't easy, but showed it is possible.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.