A survey and risk assessment on virtual, augmented and mixed reality cyberattacks

• Main Author: Silva, Tânia Cristina Ferreira da
• Publication Date: 2024
• Format: Master thesis
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: http://hdl.handle.net/20.500.11960/3946
• topic: Virtual reality; Augmented reality; Mixed reality; Cyberattacks; Vulnerabilities; Risk assessment; Realidade aumentada; Realidade virtual; Realidade mista; Ciberataques; Vulnerabilidades; Classificação de risco

Nowadays, Virtual Reality (VR), Augmented Reality (AR) and Mixed Reality (MR.) systems are not exclusively associated with the gaming industry. Their potential is also useful for other business areas such as healthcare, automotive, and educational domains, based on gathered statistics. Companies need to accompany technological advances and enhance their business processes and thus, the adoption of VR, AR, or MR technologies could be advantageous in reducing resource usage or improving the overall efficiency of operations. However, before implementing these technologies, companies must be aware of potential cyberattacks and security risks to which these systems are subject. This study presents a survey of attacks related to VR, AR. and MR. scenarios and a risk assessment based on the ISO 27005 methodology when considering healthcare, automotive, educa- tion, and gaming industries. The main goal is to make companies aware of the possible. cyberattacks that can affect the devices and their impact on their business processes. This classification intends to guide the companies that want to implement VR, AR, and MR. systems in their operations. They will be aware of the possible cyberattacks that can affect the devices and their risk level in their business domain. Proofs of concept for De nial of Service and Jamming attacks targeting HoloLens and other VR and AR, devices, along with a vulnerability found in the authorization method used in the HoloLens' Device Portal tool, are presented in this study. The motivation behind this project is to raise awareness among companies about potential vulnerabilities in these devices and how they can impact their business processes enabling them to apply effective mitigation methods.