PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Is Virtual Reality Ripe for Cyber Attacks?

hackerone.com | blog | #vr | #ar | #emerging-tech | #security-outlook | #qualcomm
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne CTO Alex Rice argues VR/AR platforms will see vulnerabilities nobody has thought of yet, so security must remain continuously 'on' as the tech goes mainstream; Qualcomm and others are already engaging researchers.
Published
Collected

Related coverage

blog · hackerone.com
Qualcomm Launches Bug Bounty Program
Qualcomm launches an invite-only bug bounty program on HackerOne — the first from a major silicon vendor — offering up to $15,000 per vulnerability in Snapdragon processors, LTE modems and related technologies.
blog · yeswehack.com
YesWeHackVR, an immersive hacking game
YesWeHack released a free VR game, YesWeHackVR, that walks players through the full bug bounty workflow - scope discovery, vulnerability hunting, reporting and rewards - to explain ethical hacking.
blog · projectzero.google
The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit
Research into the Qualcomm DSP driver that unexpectedly unearthed an exploitable bug, covering reverse engineering of its interface, root cause analysis, and exploit development.
blog · projectzero.google
Attacking the Qualcomm Adreno GPU
When writing an Android exploit, breaking out of the application sandbox is often a key step. There are a wide range of remote attacks that give you code execution with the privileges of an application (like the browser or a messaging application), but a sandbox escape is still required to gain full system access.
research · blog.quarkslab.com
Analysis of Qualcomm Secure Boot Chains
A six-month internship study of Qualcomm secure boot chains: dumping bootROM/SBL on Nexus 6P and Nokia 6, taking over the chain and hooking the secure monitor for EL3 read/write.
research · mccaulay.co.uk
No Tokens Required: A Movie Power Virtual Reality Breakout Exploit
During summer 2024, I went on holiday and encountered multiple virtual reality (VR) arcades containing a vulnerability which allowed me to breakout and pop a Windows command prompt on the arcade machine.
Back