Exploring Ransomware on the Oculus Quest 2

PROBLEM

Standalone VR headsets are full Android-based computers with novel attack surfaces — but whether real ransomware threat models apply to them was unexplored. The Quest 2 runs Android 10; the open question was whether its attack surface actually contains what ransomware needs to execute.

APPROACH

Evaluate existing Android ransomware against the Quest 2's specific attack surface, then build a proof-of-concept to test feasibility head-on rather than argue it in the abstract. I developed SRS (Simple Ransomware Sample) — a minimum-viable ransomware — and ran it alongside two real-world Android ransomware families, WannaLocker and Koler, directly against the Quest 2. This built on the attack-surface reconnaissance from my earlier Cursory Assessment paper.

EXECUTION

After doing work for the Air Force in the first year of grad school, I grew both weary of continuing the project and I also wanted to graduate with a thesis. It felt wrong to do a coursework-only master's, like that was some dumb recent thing put upon higher education for commercial reasons. I was still quite romantic about the ivory tower. We had collectively made attempts to get some kind of paper or other work out of our project, but it had really been a bit of a bust. So I called it quits, and went on loans. Let's not talk about how little I was informed about how most graduate programs are run in proper schools.

Previous work on the Oculus Quest 2, plus catching the eye of a prof, led to this work. It's passable. I don't have particular things I would change about it. I would go back and do my education differently, try to get out of state and into a proper graduate track. But the thesis was an interesting effort. I got to throw in and use directly a Touhou reference! COVID era. I took walks in a nearby graveyard, hunkered in a computer lab to write by hand, and hung out with the hacker lab. It was a halcyon time in some ways. I picked up my first serious stint in meditation, sitting on concrete in the mornings before walking to the local cafe. This was also when I really fell into TPOT proper, something that would truly change my life.

After the thesis work was finished, I spent 3 months waiting to graduate, no coursework, but just making sure signatures happened at allotted times from various collegiate deans. I read Jung's Man and His Symbols, and started really delving into world mysticisms and occult works. Hung out with an iteration of the school's philosophy club at times. Good folk. I would not go back to that time; it was good, but it is past. I'll hold it in my heart as a significant period of change and evolution for myself.

The work itself? It's fine; I think it proves that I understood how to write and work in science. Is it interesting? Depends on you.

OUTCOME

Demonstrated that the Oculus Quest 2's attack surface does contain the necessary aspects for the successful execution of ransomware — the proof-of-concept and both real-world samples ran. Completed as my MS thesis in Computer Science at Louisiana Tech (Spring 2022, advisor Dr. W. Bradley Glisson), building directly on the attack-surface assessment groundwork. Open-access via Louisiana Tech Digital Commons.

LINKS

▸ Read the thesis (PDF)▸ Louisiana Tech Digital Commons (open access)▸ ProQuest record