Uncovering Practical Security and Privacy Threats for Connected Glasses with Embedded Video Cameras

Abstract

We address in this work security and privacy threats for connected camera glasses, for which very few investigations have been conducted so far, despite the considerable attention to understanding security concerns for other wearables, such as smartwatches and fitness trackers. To raise awareness about such threats, we present the results of a case study involving a low-cost spy camera glasses device, readily available on the market, that can be used to record and stream live video, for which we demonstrate infringement of several privacy requirements (regarding the camera glasses device itself, the data collected by the embedded video camera, the wearer of the device, and for bystanders as well) that lead to corresponding security threats (e.g., data confidentiality, integrity, availability, and access control). To foster replicability and reproducibility of our empirical results, investigation method, and implementation of attacks, we describe our case study in the form of a detailed activity log and release full C++ code implementing our approach. Furthermore, we present our findings to three IT security experts and summarize their recommendations for designing more secure connected camera glasses.