VR-Sniffer: WebVR Browsing History Sniffing Attack by Exploiting Controller Input Leakage

Abstract

With an increasing interest in Metaverse, virtual reality (VR) comes to the web and widely spreads to various apps. This is enabled by the WebVR framework, which allows running VR apps on top of major web browsers, providing better compatibility and accessibility. However, WebVR is exposed to privacy threats due to the open nature of the web. In particular, a malicious website can easily obtain any input from a user’s VR controller and distinguish the user’s browsing history through the controller usage patterns. This paper presents such a threat and demonstrates an effective privacy attack on major web browsers. We propose VR-Sniffer, a deep learning-based browsing history identification platform. For the privacy attack, it collects inputs from the user’s VR controller, transforms the data into a suitable format for our deep learning network, feeds the processed data into the network, and then infers the WebVR site the user is visiting. Our extensive evaluation with 18 participants shows that VR-Sniffer effectively identifies the visiting WebVR site with an accuracy of up to 95.8%. This result implies that the proposed attack may result in severe privacy threats to major WebVR applications.