Exploring cybersecurity and forensics of Virtual Reality systems and their impact on cybersecurity education

虚拟现实（VR）是一种有可能改变日常生活的媒介。它让用户沉浸在一个完整的、360度的虚拟环境中，模糊了用户对物理空间的看法。VR是一项新兴技术，但已经在许多现代应用中出现，包括工程、军事、医疗、教育、房地产、旅游、社交网络、游戏、零售和现场活动。2016年，全球共售出8900万台VR头显，VR技术也得到了大量投资；然而，目前几乎没有针对此类系统的网络安全教育和研究探索。该项目的目标是在网络安全和取证的交叉点调查VR系统安全问题的教育方法。拟议的课程将由讲座和实验室支持，并将传播给更广泛的采用，以激发与网络安全和VR技术取证相关的科学和劳动力准备。该项目的重要部分将由学生研究人员进行。这些学习模块将在纽黑文大学使用，立即影响60名学生，并将通过与近400个非营利、学术和政府合作伙伴的伙伴关系传播给更广泛的受众。这是第一次尝试为虚拟现实系统的网络安全方面创建教育材料，这是网络安全领域的一个新兴话题。虽然有很多大学课程专注于人机交互，也有一些专注于VR开发者课程，但目前还没有涵盖VR系统安全和取证的课程材料。VR为新型的对手攻击提供了机会，例如“房间里的人”（MIR）攻击，这种攻击可能会将对手置于模拟空间中。如果是这样的话，我们能重建数字证据来告诉我们发生了什么吗？至于为VR使用而开发的硬件单元：它们是安全的还是可以被利用？攻击者是否有可能远程确定用户的物理位置或远程打开用户的前置摄像头？这些都是在教育未来VR开发者时需要解决的重要安全问题。

Virtual Reality (VR) is a medium that has the potential to transform everyday lives. It immerses the user into a full, 360-degree virtual environment, obscuring the user's view of physical space. VR is an emerging technology but is already present in many modern applications, including engineering, military, healthcare, education, real estate, tourism, social networking, games, retail, and live events. In 2016, 89 million VR headsets were sold worldwide accompanied by substantial investments in VR technology; however, there is almost no cybersecurity education or research exploration of such systems. The goal of this project is to investigate educational approaches to security issues of VR systems in the intersection of cybersecurity and forensics. The proposed curriculum will be supported by lectures and labs and will be disseminated for wider adoption to spark scientific and workforce readiness related to cybersecurity and forensics of VR technology. A significant part of the project will be conducted by student researchers. The learning modules will be used at the University of New Haven, immediately affecting 60 students, and will be disseminated to wider audience through a partnership with almost 400 non-profit, academic, and government partners. This is the first attempt to create educational material for cybersecurity aspect of VR systems, an emerging topic in cybersecurity. Although there are many university programs focusing on Human Computer Interaction, and some on VR developer programs, currently there is no curriculum material covering the security and forensics of VR systems. VR presents opportunities for new types of adversary attacks such as the Man In the Room (MIR) attack, which may place an adversary into a simulated space. If this were the case, would we be able to reconstruct the digital evidence that can tell us what happened? As for the hardware units developed for VR usage: are they secure or can they be exploited? Is it possible for an adversary remotely determine a user's physical location or remotely turn on a user's front mounted camera? These are important security questions that need to be addressed while educating future VR developers.