Enhancing the Security & Privacy of Wearable Brain-Computer Interfaces

Abstract

Brain computing interfaces (BCI) are used in a plethora of safety/privacy-critical applications, ranging from healthcare to smart communication and control. Wearable BCI setups typically involve a head-mounted sensor connected to a mobile device, combined with MLbased data processing. Consequently, they are susceptible to a multiplicity of attacks across the hardware, software, and networking stacks used that can leak users' brainwave data or at worst relinquish control of BCI-assisted devices to remote attackers.In this paper, we: (i) analyse the whole-system security and privacy threats to existing wearable BCI products from an operating system and adversarial machine learning perspective; and (ii) introduce Argus, the first information flow control system for wearable BCI applications that mitigates these attacks. Argus' domainspecific design leads to a lightweight implementation on Linux ARM platforms suitable for existing BCI usecases. Our proof of concept attacks on real-world BCI devices (Muse, NeuroSky, and OpenBCI) led us to discover more than 300 vulnerabilities across the stacks of six major attack vectors. Our evaluation shows Argus is highly effective in tracking sensitive dataflows and restricting these attacks with an acceptable memory and performance overhead (< 15%).

Brain-Computer Interface Integration With Extended Reality (XR): Future, Privacy And Security Outlook

“…Also, FDA approval does not remove the threat to the user's physical health if the device is maliciously programmed, e.g. neural attacks (Bernal et al 2023), and with MitM it is possible to capture data between devices (Tarkhani et al 2022). Big Tech's push for more power creates privacy and security challenges.…”

“…Attacks could include unauthorized access or traffic sniffing in the BCI network. Tarkhani et al (2022) were able to successfully capture data using Man-inthe-Middle (MitM) where the Bluetooth device was acting as a headset. The problem was that authentication was insufficient between the devices.…”