Anyone can connect to your cheap smart glasses from Temu and gain control of them
No password needed.
Image by Stringer/Anadolu via Getty Images
- ABC News Australia tested two cheap smart glasses and found both could let strangers connect without a password.
- Attackers could take photos or videos, copy stored files, and intercept audio or images.
- A visible device ID could help expose a user’s email address and date of birth.
- Privacy concerns have pushed schools, courts, venues, and governments to consider or impose smart glasses bans.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Wearing a pair of cheap smart glasses from Temu may be an invitation for hackers to access the device and record without the owner’s knowledge.
An investigation by ABC News Australia has revealed serious privacy flaws in the new generation of ultra-cheap smart glasses.
Investigators tested 2 pairs of glasses, one of which, costing AUD$60 ($42), was purchased from a Chinese-owned online marketplace, Temu.
Another was bought from a Sydney-based importer, BDI Technology, via Big W Marketplace for AUD$110 ($78). Both pairs rely on the HeyCyan app to connect to a smartphone.
The analysis suggests that when the smart glasses are switched on, but the owner is not connected, other people can quickly connect to the device first, with no password required. There are no extra barriers to prevent it.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Connecting allows the attacker to gain control of the smart glasses, enabling them to take new photos and videos and copy those that are already stored.
Hackers can also intercept audio and images transmitted from the owner’s smart glasses to their smartphone.
The privacy risks of wearing ultra-cheap smart glasses may go way beyond attackers hacking the specs themselves.
The investigation suggests that attackers can impersonate smart glasses they don’t own to connect to the owner’s mobile app.
Most concerningly, the device ID number is visible to others within Bluetooth range while the smart glasses remain unpaired. This allows attackers to learn the user’s email address and date of birth as a result of a separate failure on the app's website.
Kimberlee Weatherall, a tech regulation specialist from the University of Sydney, told ABC News Australia that findings highlight “the failure to take even basic steps to protect personal data.”
Sweeping bans on smart glasses are on the way
Wearing more expensive smart glasses, such as Meta Ray-Bans, doesn’t necessarily guarantee complete privacy.
An investigation by Swedish daily Svenska Dagbladet found that outsourced Meta workers in Kenya were able to watch sensitive content recorded on its smart glasses, such as wearers using the toilet or engaging in intimate activity.
Anyone within the glasses’ line of sight may also be at risk. The devices are often referred to as “pervert glasses” due to being used to secretly record people without their consent.
Growing privacy concerns and backlash have prompted bans on smart glasses in courts and venues across the US and the UK, with countries like Norway, the Netherlands, and Germany considering restrictions on their use.
The government of Western Australia has announced a ban on smart glasses in public schools, which will also apply to sports events and excursions.
The federal Australian government, meanwhile, is mulling prohibiting smart glasses from its offices and service centers across the country.