Researcher Bypasses Meta Smart Glasses’ Code-Signing Safeguard

Summary

Researcher Paula (pamoutaf) found that tampering with a settings file could disable app-signature verification on Ray-Ban Meta glasses, allowing her code to run. Her research did not demonstrate access to camera footage or recordings.

Key points

Firmware versions up to and including 126 did not verify that installed apps came from Meta.
Firmware 127 added app-signature verification, but the glasses trusted a phone-provided settings file that was checked for format, not tampering.
Changing one byte in the settings file disabled the signature check, allowing the researcher to run her own app.
The app could receive commands from the paired phone over a wireless connection.
The research did not demonstrate that the app could access camera footage or stored recordings.
The article recommends updating the glasses’ firmware and the Meta AI app, and avoiding unofficial apps or modifications.

Article Details

Vulnerability Types: App signature verification bypass by tampering with a settings file
Affected Versions: Ray-Ban Meta glasses firmware versions up to and including 126
Ray-Ban Meta glasses firmware version 127
Exploitation Status: reported
Exploit Availability: unknown
Patch Status: partial
Workarounds: Keep the glasses' firmware and the Meta AI app updated.
Avoid unofficial apps or modifications.

People

PaulaVulnerability researcher who demonstrated running her own software on Ray-Ban Meta glasses; she is known online as pamoutaf.

Vendors

MetaWe’ve written before about what Meta’s Ray-Ban smart glasses can see and hear, and who might get to use that information. Those worries focus on how the glasses handle information during normal use. A security

Products

Meta AI appThe glasses are controlled by the Meta AI app on the owner’s phone. Developers can add their own apps to the glasses through a developer tool, and the phone sends that software to the glasses to install.Ray-Ban Meta glassesVulnerability researcher Paula, known online as pamoutaf, found a way to run her own software on a pair of Ray-Ban Meta glasses. For the technical details I’ll gladly refer you to her own post about it.