Hacker slips a self-signed app onto Meta's Ray-Ban glasses and gets a shell
Hacking the meta ray-ban smartglasses
A researcher pulled the full Ray-Ban firmware from Meta's OTA CDN by flipping a GraphQL flag, then swapped the Device Access Toolkit APK for a self-signed one, since firmware up to 126 never checked Meta's signature. With no screen to debug on, the implant signaled progress through beeps and opened a TCP bind shell over Wi-Fi Direct. When firmware 127 enforced signing, a one-byte edit to the phone-delivered MobileConfig turned the check off again.
There is no screen on this pair of sunglasses. No console, no logs, no "yoo your code is running". So how could I make sure my code was even executing? The answer is by listening to it.
- RobMurray
It's really sad that getting a shell on a device you own is now considered a vulnerability.
- mzajc
This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
- malicka
Maybe I’ve still got the old PS3/PSP-exploit mentality, but reporting an arbitrary code execution vuln to the OEM is kind of sad… that deliberately closes a door for people to use their devices as they see fit.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
- frenchsalmon
Nice. How robust is this with software upgrades though? Also looks like arbitrary code execution in the app sandbox, so no persistance?
- iAMkenough
Regardless of the exploit, I wonder if there's a market for similar looking smartglasses that let you do whatever you want. Some competition in the space would be good for inviting regulation.