GAZEploit vulnerability allows eye-tracking data to reveal Vision Pro passwords
Researchers discovered GAZEploit, a vulnerability in Apple Vision Pro's eye-tracking system that can predict and reconstruct user passwords and messages by analyzing eye movement patterns during virtual keyboard input. The attack was demonstrated to have 98% accuracy in identifying typing sessions and specific keystrokes.
What happened
Researchers from the University of Florida, CertiK Skyfall Team, and Texas Tech University identified a security vulnerability called GAZEploit in Apple Vision Pro's eye-tracking technology.
The vulnerability leverages eye-tracking data to predict what a user is typing on a virtual keyboard during FaceTime calls. The attack analyzes eye aspect ratio (how wide eyes are open) and eye gaze estimation (where the user is looking) to detect typing sessions and identify specific keys being selected.
The researchers trained a recurrent neural network machine learning model on data from 30 individuals, achieving a 98% accuracy rate in identifying typing sessions and reconstructing passwords, PINs, and messages.
Reported impact
The vulnerability puts Apple Vision Pro users at risk of having their sensitive data, including passwords and PINs, exposed during virtual or mixed reality interactions where eye-tracking is used for input.
Index analysis
The attack exploits the inherent patterns of eye movements during typing in virtual reality environments, where users' eye movements follow distinct patterns and blinking decreases while typing. The vulnerability works by analyzing saccades (rapid eye movements) followed by fixations (pauses when eyes focus on a key).
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.