Researcher Bypasses Signature Verification to Gain Shell Access on Meta Ray-Ban Smartglasses

A security researcher successfully gained arbitrary code execution and an interactive shell on Meta's Ray-Ban smartglasses by exploiting a flaw in how the glasses verify developer tools. The researcher bypassed Meta's signature verification by manipulating a configuration file sent from a paired smartphone, highlighting a significant trust boundary issue in the wearable's security architecture.

This image illustrates the hardware and the smartphone pairing mechanism used by the researcher to manipulate configuration files.

Firmware Extraction and APK Injection

The researcher began by extracting the glasses' firmware using the Meta AI app. By using Frida to hook the app's `OTAArtifactInfo` class, they intercepted the CDN update URL. They further manipulated the app's GraphQL inputs to request a full firmware update rather than an incremental one, allowing them to dump and mount the device's filesystem.

Once the firmware was acquired, the researcher identified a way to run custom code. In firmware version 126, the glasses did not verify if the Device Access Toolkit (DAT) APK—a tool for developers to interact with the glasses—was signed by Meta. This allowed the researcher to swap the legitimate DAT application with a self-signed version of their own.

“Introducing signature verification is one thing; ensuring that its enforcement cannot be bypassed through an untrusted configuration is another.”

— Hacking the meta ray-ban smartglasses

Debugging and Shell Acquisition

Because the smartglasses lack a screen or console, the researcher used a sequence of audio beeps via `android.media.ToneGenerator` to signal the progress of their injected code. This allowed them to debug issues, such as a timeout error where the official Camera Access app would close the connection if it did not detect the expected DAT application.

To establish a persistent connection, the researcher hooked the Camera Access app to request a 'high link lease' from the Meta AI app. This forced the glasses into a Wi-Fi Direct group on a specific subnet. By binding a listener to TCP port 31337 on the glasses, the researcher was able to use `nc` (netcat) from their phone to drop into an interactive shell with shell-level execution.

Bypassing Signature Enforcement

Meta eventually addressed the APK injection flaw in firmware 127 by enforcing signature verification for the DAT APK. However, the researcher discovered that this check was governed by a configuration flag (`signature_verification_enabled`) fetched from the paired phone. The glasses accepted this configuration file as long as it was structurally correct, even if it had been tampered with.

By flipping a single byte in the `0.mctable` file from `0x80` to `0x00`, the researcher disabled the signature check. This allowed them to re-install their self-signed APK and regain shell access. The researcher reported these findings to Meta through their bug bounty platform, and the issue is believed to be patched.