Google Glass could leave users vulnerable to being profiled by hackers through network vendors attacks, according to Kaspersky Lab.
Kaspersky researchers, Roberto Martinez, and Juan Andres Guerrero, looked into Google Glass and Samsung Galaxy Gear 2, to explore how they could affect people’s privacy and security.
There are two ways to surf the Web from Google Glass; through Bluetooth pairing with a mobile device that shares its data network connection, or directly through Wi-Fi.
The latter gives the user more freedom since it doesn’t require a separate mobile device in order to access the Internet.
However, according to Kaspersky security researcher, Roberto Martinez, this functionality also means that the Glass is exposed to network vector attacks, particularly MiTM, where a communication between two systems can be intercepted.
This was discovered in an experiment conducted by Kaspersky Lab researchers after attaching the device to a monitored network and checking the data it transmitted.
The results of the captured data analysis showed that not all the traffic exchanged between the device and the hot spot was encrypted.
In particular, it was possible to find out that the targeted user was looking for airlines, hotels and tourist destinations.
In other words, it was possible to perform a profiling task through a simple form of surveillance.
Martinez said that it was not a very damaging vulnerability.
"But even so, profiling via meta data from Web traffic exchange could become the first step of a more complex attack against the device’s owner,” he said.
Galaxy Gear 2 apps fell under the eye of researchers.
Dedicated apps for Galaxy Gear 2 are loaded onto the device with help of Gear Manager, a special app by Samsung designed to transmit an app from the smartphone to the smartwatch.
Read more: Telstra and b2cloud reveal Google Glass projects for vision and hearing impaired
Research found, when an app is installed on the smartwatch’s operating system, there was no notification shown on the watch display.
This makes targeted attacks involving silent app installation possible.
Guerrero said there was no evidence to suggest that wearables were currently being targeted by professional APT actors.
“However there is a two-fold appeal presented by wearables that make them a likely future target if they are widely adopted by consumers," he said.
"In future, the data collected by wearable devices is going to attract new players to the cyber-espionage scene.”
When Guerrero examined his Samsung Galaxy Gear 2, the device is deliberately designed to make a loud noise and warn people nearby if it is being used to take a photo.
However, a deeper look into the software of Galaxy Gear 2 revealed that after rooting the device and using Samsung’s publicly available proprietary software tool ODIN, it was possible to enable Galaxy Gear 2 to silently take pictures using its embedded camera.
"This obviously opens the door to possible scenarios in which Galaxy Gear 2 could violate other people’s privacy," he said.
