GAZEploit (Exploit Kit) – Malware

Overview

In recent years, virtual reality (VR) and mixed reality (MR) technologies have become increasingly pervasive, offering new opportunities for immersive digital experiences. These innovations have revolutionized fields such as gaming, education, and remote work, allowing users to interact with virtual environments and avatars in ways that were previously unimaginable. However, as these technologies evolve, they also introduce significant privacy risks that remain largely underexplored. One such risk is the potential for attackers to exploit gaze-controlled typing systems, which are becoming more prevalent as users interact with virtual avatars. In response to this emerging threat, researchers have introduced GAZEploit, a novel exploit that can infer keystrokes typed by users through their gaze movements, reconstructed remotely from their avatar images. GAZEploit takes advantage of the eye-related biometrics inherent in gaze-controlled typing systems. In environments where users control avatars via eye movements, the gaze direction and eye aspect ratio (EAR) can be captured and analyzed to deduce the text being typed. This vulnerability is particularly concerning in scenarios where users share avatars on platforms such as video calls, online meetings, or live streaming services. Even seemingly innocuous interactions in these digital spaces can expose sensitive information, such as login credentials, to malicious actors. By remotely analyzing the avatar’s visual representation, attackers can accurately reconstruct the user’s keystrokes, thus compromising user privacy and security.

Targets

Individuals

How they operate

The GAZEploit attack introduces a sophisticated method of inferring keystrokes by remotely analyzing gaze movements from avatars in virtual reality (VR) and mixed reality (MR) environments. This technical article delves into the underlying mechanisms of GAZEploit, exploring how it exploits gaze-controlled typing systems to reconstruct text entered by users without their knowledge. The attack leverages key biometrics—eye aspect ratio (EAR) and gaze estimation—to distinguish typing sessions from other VR activities and map gaze movements to individual keystrokes on a virtual keyboard. Gaze Estimation and Feature Extraction: GAZEploit begins by capturing the gaze information embedded in the video stream of a virtual avatar. The system extracts two primary biometrics: the eye aspect ratio (EAR) and the gaze direction. EAR is a measure of the eye’s openness, which varies with blinking and gaze shifts. Meanwhile, gaze direction refers to the trajectory of the user’s eye movement. Both features are highly indicative of typing behavior. During typing sessions, the user’s gaze tends to be more focused and consistent, creating a discernible pattern in comparison to other activities, such as watching videos or gaming. By collecting gaze data from these sessions, the attack is able to isolate typing behavior from other VR-related activities with a high level of accuracy. Pattern Recognition Using Recurrent Neural Networks (RNNs): Once gaze data is captured, GAZEploit employs machine learning to analyze the sequential nature of the user’s eye movements. Specifically, the attack utilizes a Recurrent Neural Network (RNN) to process the time-series data generated by the user’s gaze. RNNs are well-suited for this task due to their ability to recognize patterns in sequential data. The model is trained to identify the distinctive patterns of eye movements that occur during typing sessions, such as a decrease in blinking frequency and a more concentrated gaze. A dataset collected from 30 participants was used to train the RNN, achieving impressive results with an accuracy rate of 98.1% in classifying typing sessions and a precision of 90.5%. The network’s ability to identify typing behavior with high precision lays the foundation for the subsequent stages of the attack. Keystroke Identification through Gaze Stability: Once a typing session is detected, GAZEploit proceeds to identify individual keystrokes. During gaze typing, users fixate on specific keys on a virtual keyboard, creating periods of stability in their gaze, known as fixations. Between fixations, rapid eye movements, or saccades, occur as users shift their gaze from one key to another. The system detects these fixations by analyzing the stability of the gaze trace and differentiates them from saccades using an algorithm that sets a threshold for gaze stability. By focusing on stable fixation points, the attack can accurately identify the keys that the user is targeting. This stage of the attack achieves a precision of 85.9% and a recall rate of 96.8% for detecting individual keystrokes during typing sessions. Adaptive Virtual Keyboard Mapping: A key challenge in GAZEploit is accurately mapping gaze data to specific keys on a virtual keyboard. This is particularly challenging in dynamic virtual environments where the location and orientation of the keyboard may vary. To address this, GAZEploit uses eye-movement statistics to estimate the keyboard’s location in virtual space. The average gaze direction provides clues about the plane on which the virtual keyboard is located. Furthermore, the positioning of edge keys, such as ‘Q’, ‘P’, and the ‘SPACE’ key, helps establish the boundaries of the keyboard. This adaptive mapping system ensures that gaze points are consistently and accurately mapped to specific keys. As a result, GAZEploit can achieve a top-5 character prediction accuracy of 100%, ensuring that even edge-case keys are correctly identified. Conclusion: The GAZEploit attack represents a significant advancement in the realm of remote keystroke inference. By utilizing gaze-controlled typing systems and extracting critical biometric features, GAZEploit can reconstruct typed text with remarkable accuracy. The attack highlights vulnerabilities in VR and MR environments, where seemingly benign avatar interactions can expose sensitive information such as login credentials. GAZEploit’s use of machine learning, gaze stability algorithms, and adaptive mapping demonstrates the increasing sophistication of privacy risks in virtual spaces. As virtual environments continue to grow, addressing these vulnerabilities will be essential to safeguarding user privacy and security.  

References

• GAZEploit
• GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices