Google Glass security flaw flagged by researcher

However, research team praise search giant for fast fix of vulnerability.

Project Glass

Security researchers have uncovered a Google Glass vulnerability that could allow hackers to remotely control the device.

Hackers could gain access to a user's data simply by taking advantage of a feature in Google Glass that scans pictures the devices takes for QR codes.

Researchers from security firm Lookout created a QR code to demonstrate the flaw.

Advertisement - Article continues below

"We analysed how to make QR codes based on configuration instructions and produced our own 'malicious' QR codes," said Lookout Mobile Security principal security researcher Marc Rogers in a blog post.

"When photographed by an unsuspecting Glass user, the code forced Glass to connect silently to a 'hostile' WiFi access point that we controlled. That access point in turn allowed us to spy on the connections Glass made, from web requests to images uploaded to the cloud."

He said the flaw could also make Google Glass divert to a webpage on the Wi-Fi hotspot that contained a known Android 4.0.4 web vulnerability that hacked the device as it browsed the page.

Rogers said his firm disclosed the vulnerability to Google in May and the search giant fixed the vulnerability in version XE6 of the device's firmware in June. Glass will now only scan QR codes when a user asks it to.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The responsive turnaround by Google "indicates the depth of Google's commitment to privacy and security for this device and set a benchmark for how connected things should be secured going forward," he added.

In a statement by Google, the firm said that it wanted to put "Glass into the hands of all sorts of people, listen to their feedback, see the inspirational ways they use the technology, and discover vulnerabilities that we can research and work to address before we launch Glass more broadly."

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
CSA and ISSA form cyber security partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
Labour Party donors caught up in Blackbaud data breach
data breaches

Labour Party donors caught up in Blackbaud data breach

31 Jul 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020