In short:
The new generation of ultra-cheap smart glasses leaves Australians' personal data, images and videos exposed to hackers, due to security flaws.
asserted
generation → leave → flaws
Independent testing conducted for the ABC shows the devices can be accessed by a nearby attacker without a password, using only Bluetooth.
asserted
devices → conduct → Bluetooth
At least one supplier has made the decision to wind down its supply, because of the furore surrounding the devices.
asserted
supplier → make → devices
The new generation of ultra-cheap smart glasses is exposing Australians' sensitive data, images and videos to hackers, an investigation by ABC News has found.
asserted
investigation → expose → News
Independent testing by cyber security experts has revealed a suite of serious vulnerabilities, and found an attacker can gain control of the glasses and any stored images using only Bluetooth.
asserted
attacker → reveal → Bluetooth
"Another person with the same app can log into the glasses without a password, [because] there is no password," said David Crees, the lead researcher on testing conducted for the ABC by NSB Cyber and Abstract Shield.
asserted
Crees → log → Cyber
"It shouldn't be possible — it is not possible in pretty much every other proper consumer electronic," he said.
asserted
he → say → electronic
The ability to hijack a stranger's glasses with Bluetooth alone was one of more than a dozen flaws he found in six days of testing the AI-enabled smart glasses, the phone app, and its website.
"I would have expected to have found some vulnerabilities… but in this case, there wasn't a single thing that they had done correctly,"Mr Crees said.
asserted
Crees → hijack → that
The findings have also horrified legal experts, who said the security flaws were so serious the product likely breached the Privacy Act, Australian consumer law, and the government's new Cyber Security Act.
asserted
product → horrify → Act
"It's really disturbing to read the extent of the failure to take even basic steps to protect personal data," said Kimberlee Weatherall from the University of Sydney, a tech regulation specialist.
asserted
Weatherall → read → Sydney
"They don't seem to have encrypted it, they don't seem to have put passwords on it, they don't seem to have put even basic protections on the information that's on the website.
asserted
that → seem → website
The devices, which look like ordinary glasses, allow the wearer to capture images, video and audio with the press of a button, and have attracted the nickname "pervert glasses", because it is not always clear when they are in use.
asserted
they → look → use
Now, revelations about their security flaws raise a parallel set of privacy concerns for the owners of the glasses themselves.
asserted
revelations → raise → glasses
The testing conducted for ABC News assessed two pairs of glasses — one costing $60 with the online retailer Temu, and another pair costing $110, bought from a Sydney-based importer called BDI Technology, via Big W Marketplace.
asserted
testing → conduct → Marketplace
Similar versions of the tech in a comparable price range have also been available in recent months from Dick Smith, Kmart, and Amazon, and all appear to rely on the same mobile phone app, called HeyCyan.
asserted
all → appear → app
Like many ethical hackers, Mr Crees first honed his skills as a cyber criminal, but now runs his own company called Abstract Shield, which is often hired by companies to detect security flaws before an attacker can.
asserted
attacker → hone → flaws
"I'll spend anywhere from a week to a month going through a bit of software or a server or a website and finding everything that's wrong with it."
asserted
that → spend → it
But he said it was clear straight away there was "no chance" these glasses were tested to a basic minimum standard before they hit Australian shelves.
asserted
they → say → shelves
"If you think about AirPods or Samsung earbuds, you have to hold a button on the device for [several] seconds and then you can pair it with a new phone," Mr Crees said.
asserted
Crees → think → phone
"That protects the device, [but] this has nothing."
asserted
this → protect → nothing
As well as violating Australia's privacy laws, Professor Weatherall said the glasses were also likely to breach several sections of the yet-to-be-used Cyber Security Act, which came into effect in March.
asserted
which → violate → March
"The rules say that the password must be unique," she said.
asserted
she → say → ?
"It doesn't even seem like they were applying a password, which might mean that their standards are so low they don't even technically breach that rule, which I find amazing.
uncertain
I → seem → rule
Aside from the hacking risk, the testing also found Australian user data was being sent to China in many instances.
asserted
data → find → instances
It revealed anything spoken or typed to the in-built AI companion, along with any images submitted to AI, was sent first to a server in Shenzhen.
asserted
anything → reveal → Shenzhen
Depending on the function being performed, the data might then be passed to another Chinese server belonging to a different company, or to the US, although users are not explicitly told.
uncertain
users → depend → US
"The [Privacy] Act says if it's practical, you have to identify the country," Professor Weatherall said.
asserted
Weatherall → say → country
"It's not at all clear to me why they couldn't have put China into the privacy policy," she said, noting that the document only makes specific mention of Singapore.
asserted
document → put → Singapore
The AI companion embedded in the glasses would sometimes return inaccurate answers or error messages if asked about topics considered sensitive by the Chinese government.
asserted
companion → embed → government
In one instance, when asked about China's well-documented persecution of millions of Uyghur Muslims in Xinjiang province, the chatbot said there was "no credible evidence".
asserted
chatbot → ask → province
It declined to discuss the Tiananmen Square massacre and proposed "more positive topics" instead.
asserted
It → decline → topics
These findings, along with server locations, led researchers to conclude the chatbot companion relied at least in part on Chinese sovereign AI models.
"There is a high degree of uncertainty when it comes to where the data is going," said Evan Vougdis, from NSB Cyber, who oversaw the research.
asserted
who → lead → research
"Is it being used for further training [of Chinese AI models]?
asserted
it → use → models
Is it being used for surveillance?"
asserted
it → use → surveillance
The testing did not definitively determine how the data was being used, but Mr Vougdis said any Australians considering buying the product should be aware of the risk they were taking.
asserted
they → determine → risk
"We're looking at data collection at a scale that we've never seen before due to the adoption of … products such as smart glasses that are readily available for a low price.
asserted
that → look → price
The developer of the HeyCyan app is a company called Shenzhen Qingcheng Future Technology Co, based in mainland China.
asserted
developer → call → China
The ABC made repeated attempts to contact the company about its security flaws and seek a response, but received no reply.
asserted
ABC → make → reply
It appeared HeyCyan's developers had attempted to patch some security flaws since the ABC shared the findings with them, but most vulnerabilities remained unaddressed.
asserted
vulnerabilities → appear → them
Mr Crees said the flaws were so many and substantial that a total fix was impossible.
"
asserted
fix → say → ?
…and 7 more, not listed.
The Aporia
