More than half of Apple Vision Pro apps violate privacy in network traffic
AVP-Inspect: Coordinated Cyber-Physical Testing for Privacy Analysis of COTS Apple Vision Pro Applications
Cryptography and Security
Summary
Extended reality devices like Apple Vision Pro collect a lot of data, raising privacy concerns. The authors created a new system called AVP-Inspect that automatically tests these devices by controlling both software and hardware to see if apps share private data improperly. After testing over 300 apps, they found that more than half of them violated privacy rules, often by not properly telling users about the data they send over the internet. This work helps reveal hidden privacy risks in Apple Vision Pro applications.
What this means in practice
- •For mobile app developers: Identify and fix privacy leaks in Apple Vision Pro applications during development by using coordinated software and hardware testing.
- •For security analysts: Use AVP-Inspect to automatically detect undisclosed data transmissions and privacy violations in Apple Vision Pro apps from network traffic.
Authors
Yichang Xiong, Vamsi Shankar Simhadri, Yue Xiao, Xiaokuan Zhang
Abstract
XR devices introduce substantial privacy concerns due to their comprehensive data collection capabilities that surpass traditional computing platforms. While existing works have demonstrated privacy concerns on Android-based XR devices such as Meta Quest series by performing network traffic analysis, little attention has been paid to the Apple Vision Pro (AVP) devices, mainly due to the closed nature and the technical challenges associated with AVP devices. In this work, we make a bold attempt to detect privacy violations of AVP applications from network traffic through automatic testing on AVP devices. Our key insight is that effective AVP application testing requires coordinated control of both cyber (software) and physical (hardware) components, which we term Coordinated Cyber-Physical Testing. Building on this insight, we design and implement AVP-Inspect, an automatic dynamic analysis framework for AVP applications, overcoming significant challenges enforced by the closed-source nature of AVP ecosystem. AVP-Inspect consists of three components: an automatic device controller by building customized hardware devices, a 3D UI explorer by designing a new exploration engine, and a privacy violation detector by constructing a unified privacy taxonomy for AVP. We first evaluated AVP-Inspect on a manually constructed ground truth dataset, then performed a large-scale analysis on 324 AVP applications downloaded from the App Store, with each app tested for 20 minutes. We found that 188 (58.0%) of apps exhibit at least one violation, and more than 60% of the network traffic flows are not properly disclosed.