Meta Quest VR Hack: “Inception Attack” Exposed

A new study by the University of Chicago has uncovered a vulnerability within the Meta Quest VR system that allows malefactors to hijack user devices, pilfer confidential information, and manipulate social interactions using generative AI.

The attack, dubbed “Inception Attack,” requires access to the user’s VR headset Wi-Fi network. Once infiltrated, victims are susceptible to phishing, fraud, and other threats.

Cybercriminals must craft an application that injects malicious code into the Meta Quest system, then replicate the main screen and applications to monitor, record, and alter all user activities in VR, including voice commands, gestures, browser activity, and social interactions.

The research illustrated how attackers could modify information displayed to the user, such as showing incorrect bank account balances and even altering transaction amounts without the user’s knowledge.

The employment of generative AI exacerbates the situation by enabling the instantaneous cloning of voices and the creation of visual deepfakes for manipulation within the VR space.

An experiment involving 27 VR expert volunteers revealed that the majority were unaware of the attack’s presence, with only one participant noticing suspicious activity. A Meta representative has expressed the company’s intent to examine the study’s findings and emphasized collaboration with academic circles through its vulnerability research program.