AI Smart Glasses have exploded in popularity ever since Meta launched the Ray-Ban Meta glasses in October 2023, which acted as sophisticated AI-integrated smart devices, being able to record, process and store video and audio footage in real time.
This emerging market has also brought with it concerns regarding data privacy of both individuals as well as businesses, as reports emerged of this technology being abused for surveillance, privacy violation and information theft.
NDTV Profit spoke to cybersecurity experts Ashok Kumar, founder and managing director of RAH Infotech and Harish Kumar, chief executive officer (CEO), Quick Heal Technologies on the risks AI Smart Glasses pose to enterprises and the general public, as well as the possible solutions to mitigate them.
ALSO READ: Meta AI Glasses Face Privacy Backlash Over Secret Recording Concerns
Outside of being used to film people without their consent, AI Smart Glasses can also be hacked into, to reveal the wearer's saved passwords, location data as well as audio from surroundings. This is due to the fact that the device is constantly synchronising information with the wearer's phone and the cloud via Bluetooth.
"If a threat actor compromises the Bluetooth pairing or that cloud account, they gain far more than just video footage," Ashok Kumar of RAH Infotech
For businesses, the risks can be more advanced, with a paired phone providing bad actors with access to the company's Corporate VPN (virtual private network), becoming an open gateway to its enterprise network.
Harish Kumar of Quick Heal Technologies stated that AI Smart Glasses create a "new wearable attack surface" and can also provide hackers with access to contacts, stored media and account tokens.
The expert stated that this hinged on whether the user had excessive permissions, insecure Bluetooth pairing, weak passwords, unpatched companion apps, or compromised cloud accounts; all of which can increase data exposure risks.
The recording feature can also intentionally or unintentionally reveal confidential information and trade secrets of businesses with the possibility of leaking access to conversations, prototypes, manufacturing techniques and much more.
"A single device can capture whiteboards, product prototypes, source code, client conversations, access badges, production processes, or personal data, and then upload that material to a personal cloud account or AI service outside corporate oversight. That creates intellectual property-related exposure, breaching confidentiality," Kumar said.
Ashok Kumar further identified a major firmware supply-chain risk where attackers could compromise a popular brand's update system, and take control of thousands of connected devices.
"Furthermore, as these glasses start feeding real-time audio cues back to the wearer, we face a subtle trust manipulation risk. Threat actors could intercept and alter that feed, exploiting the implicit trust users place in their own devices," he added.
Risk Mitigation Techniques And Practices
The experts advise individuals who use AI Smart Glasses to enable multi-factor authentication, apply firmware and app updates promptly, review app permissions, encrypt and lock connected devices, and avoid linking glasses to unnecessary accounts. These measures can significantly reduce the risk of suffering data breaches.
Ashok Kumar stated that measures such as spotting tampered LED lights on smart glasses users can be a "losing battle" and called for a systemic solution where secure facilities, and public venues enforce strict optical IoT (Internet of Things) policies.
He also called on regulators to mandate mandate hardwired recording indicators from manufacturers, especially with regards to countering device tampering to facilitate discreet recording.
"If the indicator light breaks or is tampered with, the camera must automatically fail. Relying on visual identification is no longer a viable security strategy," Kumar stated.
Harish Kumar recommended enforcing strict restrictions on such wearable devices in corporate and business environments.
"First, establish strict hardware registration; any optical IoT device entering the facility must be declared. Second, enforce physical air-gapping for sensitive areas. Data centres, legal departments, and boardrooms must be hard "no wearable" zones with clear physical signage," Kumar said.
"IT teams must update their Data Loss Prevention (DLP) parameters to flag anomalous Bluetooth syncing or unusual data outflows from paired devices. Finally, rewrite your Non-Disclosure Agreements and acceptable-use policies to explicitly name smart glasses. If you do not name the threat in your corporate policies, you cannot enforce the protection," he added.
Ashok Kumar further recommended implementing stringent Mobile Device Management (MDM) integration for businesses, in order to secure their networks from such threats.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
