Non-intrusive and Unconstrained Keystroke Inference in VR Platforms via Infrared Side Channel

TL;DR

This paper reveals a novel infrared side-channel attack on VR platforms that can non-intrusively infer user keystrokes with high accuracy, highlighting security vulnerabilities in VR controller interactions.

Contribution

The paper introduces VRecKey, a new keystroke inference attack exploiting IR signals from VR controllers, demonstrating its effectiveness on commercial VR devices.

Findings

Achieves over 94.2% top-3 accuracy in character inference

Effective in various real-world scenarios

Resilient to practical impact factors

Abstract

Virtual Reality (VR) technologies are increasingly employed in numerous applications across various areas. Therefore, it is essential to ensure the security of interactions between users and VR devices. In this paper, we disclose a new side-channel leakage in the constellation tracking system of mainstream VR platforms, where the infrared (IR) signals emitted from the VR controllers for controller-headset interactions can be maliciously exploited to reconstruct unconstrained input keystrokes on the virtual keyboard non-intrusively. We propose a novel keystroke inference attack named VRecKey to demonstrate the feasibility and practicality of this novel infrared side channel. Specifically, VRecKey leverages a customized 2D IR sensor array to intercept ambient IR signals emitted from VR controllers and subsequently infers (i) character-level key presses on the virtual keyboard and (ii) word-level keystrokes along with their typing trajectories. We extensively evaluate the effectiveness of VRecKey with two commercial VR devices, and the results indicate that it can achieve over 94.2% and 90.5% top-3 accuracy in inferring character-level and word-level keystrokes with varying lengths, respectively. In addition, empirical results show that VRecKey is resilient to several practical impact factors and presents effectiveness in various real-world scenarios, which provides a complementary and orthogonal attack surface for the exploration of keystroke inference attacks in VR platforms.