{"id":"https://openalex.org/W4416549606","doi":"https://doi.org/10.1145/3719027.3765102","title":"<i>Virtual</i> Reality, <i>Real</i> Problems: A Longitudinal Security Analysis of VR Firmware","display_name":"<i>Virtual</i> Reality, <i>Real</i> Problems: A Longitudinal Security Analysis of VR Firmware","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549606","doi":"https://doi.org/10.1145/3719027.3765102"},"language":null,"primary_location":{"id":"doi:10.1145/3719027.3765102","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765102","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3719027.3765102","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5119946710","display_name":"Vamsi Shankar Simhadri","orcid":"https://orcid.org/0009-0003-0482-6010"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vamsi Shankar Simhadri","raw_affiliation_strings":["Department of Computer Science, George Mason University, Fairfax, VA, USA"],"raw_orcid":"https://orcid.org/0009-0003-0482-6010","affiliations":[{"raw_affiliation_string":"Department of Computer Science, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040651724","display_name":"Yichang Xiong","orcid":"https://orcid.org/0009-0004-2680-0302"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yichang Xiong","raw_affiliation_strings":["Department of Computer Science, George Mason University, Fairfax, VA, USA"],"raw_orcid":"https://orcid.org/0009-0004-2680-0302","affiliations":[{"raw_affiliation_string":"Department of Computer Science, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090347232","display_name":"Habiba Farrukh","orcid":"https://orcid.org/0000-0002-3582-5999"},"institutions":[{"id":"https://openalex.org/I204250578","display_name":"University of California, Irvine","ror":"https://ror.org/04gyf1771","country_code":"US","type":"education","lineage":["https://openalex.org/I204250578"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Habiba Farrukh","raw_affiliation_strings":["Department of Computer Science, University of California, Irvine, Irvine, CA, USA"],"raw_orcid":"https://orcid.org/0000-0002-3582-5999","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Irvine, Irvine, CA, USA","institution_ids":["https://openalex.org/I204250578"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071738824","display_name":"Xiaokuan Zhang","orcid":"https://orcid.org/0000-0002-4646-7146"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaokuan Zhang","raw_affiliation_strings":["Department of Computer Science, George Mason University, Fairfax, VA, USA"],"raw_orcid":"https://orcid.org/0000-0002-4646-7146","affiliations":[{"raw_affiliation_string":"Department of Computer Science, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"4289","last_page":"4303"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5849000215530396,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5849000215530396,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3174000084400177,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.01640000008046627,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/firmware","display_name":"Firmware","score":0.7843000292778015},{"id":"https://openalex.org/keywords/virtual-reality","display_name":"Virtual reality","score":0.6204000115394592},{"id":"https://openalex.org/keywords/security-policy","display_name":"Security policy","score":0.5012000203132629},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.4171999990940094},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4036000072956085},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.3813999891281128},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.367000013589859},{"id":"https://openalex.org/keywords/resource","display_name":"Resource (disambiguation)","score":0.361299991607666},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.3612000048160553}],"concepts":[{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.7843000292778015},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7821000218391418},{"id":"https://openalex.org/C194969405","wikidata":"https://www.wikidata.org/wiki/Q170519","display_name":"Virtual reality","level":2,"score":0.6204000115394592},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5295000076293945},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.5012000203132629},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.4171999990940094},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4036000072956085},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.38670000433921814},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3813999891281128},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.367000013589859},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.361299991607666},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.3612000048160553},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.35679998993873596},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.3490999937057495},{"id":"https://openalex.org/C3019565508","wikidata":"https://www.wikidata.org/wiki/Q444835","display_name":"Virtual world","level":2,"score":0.32760000228881836},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.2870999872684479},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.2827000021934509},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.2797999978065491},{"id":"https://openalex.org/C22174128","wikidata":"https://www.wikidata.org/wiki/Q175869","display_name":"Microcode","level":2,"score":0.2768000066280365},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.27630001306533813},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.27379998564720154},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.2736000120639801},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.272599995136261},{"id":"https://openalex.org/C178639896","wikidata":"https://www.wikidata.org/wiki/Q604035","display_name":"Logical security","level":5,"score":0.2651999890804291},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.25279998779296875}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3719027.3765102","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765102","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3719027.3765102","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765102","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":4,"referenced_works":["https://openalex.org/W2765843494","https://openalex.org/W2941915966","https://openalex.org/W3081622852","https://openalex.org/W3122252170"],"related_works":[],"abstract_inverted_index":{"Virtual":[0],"Reality":[1],"(VR)":[2],"technology":[3],"is":[4,44],"rapidly":[5],"growing":[6],"in":[7,157,216],"recent":[8],"years.":[9],"VR":[10,42,47,100,115,123,159,185,193,205,218],"devices":[11,43,48],"such":[12],"as":[13,199],"Meta":[14],"Quest":[15,129],"3":[16],"utilize":[17],"numerous":[18],"sensors":[19],"to":[20,24,30,59,73,187],"collect":[21,118],"users'":[22],"data":[23,33],"provide":[25],"an":[26,200],"immersive":[27,37],"experience.":[28],"Due":[29],"the":[31,36,39,86,90,109,138,141,148],"extensive":[32],"collection":[34],"and":[35,51,63,77,130,132,144,147,172,190,208,210],"nature,":[38],"security":[40,87,96,112,155,164,189,202],"of":[41,89,114,122],"paramount.":[45],"Leading":[46],"often":[49],"adopt":[50],"customize":[52],"Android":[53,91],"systems,":[54],"which":[55],"makes":[56],"them":[57],"susceptible":[58],"both":[60],"Android-based":[61],"vulnerabilities":[62],"new":[64],"issues":[65,156],"introduced":[66],"by":[67],"VR-specific":[68],"customizations":[69],"(e.g.,":[70],"system":[71,142],"services":[72],"support":[74],"continuous":[75],"head":[76],"hand":[78],"tracking).":[79],"While":[80],"prior":[81],"work":[82],"has":[83],"extensively":[84],"examined":[85],"properties":[88,97],"software":[92],"stack,":[93],"how":[94],"these":[95,158],"hold":[98],"for":[99,184,192,204],"systems":[101],"remains":[102],"unexplored.":[103],"In":[104],"this":[105],"paper,":[106],"we":[107,181],"present":[108],"first":[110],"comprehensive":[111],"analysis":[113,136],"firmware.":[116],"We":[117,151],"over":[119],"300":[120],"versions":[121],"firmware":[124],"from":[125],"two":[126],"major":[127],"vendors,":[128,209],"Pico,":[131],"perform":[133],"a":[134],"longitudinal":[135],"across":[137],"kernel":[139],"layer,":[140,146],"binary":[143,167],"library":[145],"application":[149],"layer.":[150],"have":[152],"identified":[153],"several":[154],"firmware,":[160],"including":[161],"missing":[162],"kernel-level":[163],"features,":[165],"insufficient":[166],"hardening,":[168],"inconsistent":[169],"permission":[170],"enforcement,":[171],"inadequate":[173],"SELinux":[174],"policy":[175],"enforcement.":[176],"Based":[177],"on":[178],"our":[179],"findings,":[180],"synthesize":[182],"recommendations":[183],"vendors":[186],"improve":[188],"trust":[191],"devices.":[194],"This":[195],"paper":[196],"will":[197,211],"act":[198],"important":[201],"resource":[203],"developers,":[206],"users,":[207],"also":[212],"direct":[213],"future":[214],"advancements":[215],"secure":[217],"ecosystem":[219]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-23T00:00:00"}