"Study Outlines Privacy Risks in Metaverse Virtual Worlds"

In the paper titled, "Exploring the Unprecedented Privacy Risks of the Metaverse," researchers from UC Berkeley and the Technical University of Munich tested an "escape room" Virtual Reality (VR) game to better understand how much data a potential attacker could access. They developed a framework for assessing and analyzing potential privacy threats through a 30-person study of VR usage. They identified over 25 examples of private data attributes that potential attackers could obtain, some of which would be difficult or impossible to obtain through traditional mobile or web applications. Not only is privacy an unresolved metaverse issue, but hardware security also falls short. A related recent study of AR/VR hardware, "Security and Privacy Evaluation of Popular Augmented and Virtual Reality Technologies," discovered vendor websites rife with potential security flaws, hardware and software lacking in multi-factor authentication (MFA), and poor privacy policies. The escape room study lists the specific data points available to various types of attackers, including hardware, client, server, and user adversaries. The researchers' definition of "attacker" includes external threat actors, participants, and companies. The potential data points identified by the researchers include geospatial telemetry, device specifications, network bandwidth, behavioral observations, and more. Different conclusions about a VR participant's gender, wealth, ethnicity, age, and disability can be drawn from these metrics. According to the team, data collecting and inference methods in VR settings will likely soon become more commonplace in our daily lives, as evidenced by the startling accuracy and stealth of these attacks as well as the drive of data-hungry businesses towards metaverse technologies. This article continues to discuss the study on privacy risks of the metaverse. 

The Register reports "Study Outlines Privacy Risks in Metaverse Virtual Worlds"