Hacking the meta ray-ban smartglasses

A security researcher set out to inspect Meta’s Ray-Ban smartglasses as potential targets for Pwn2Own and achieved arbitrary code execution without physically opening the device. By reverse-engineering Meta’s companion app, they intercepted the over-the-air update URL, then modified a GraphQL request to obtain a complete firmware package rather than an incremental update. The extracted Android images provided a view of the device software, while the glasses’ Device Access Toolkit (DAT) offered a route to run code: through firmware version 126, the glasses did not verify that DAT apps were signed by Meta. The researcher used Frida to substitute a self-signed app for the legitimate one.

Because the glasses have no display or console, the researcher used programmed beeps to track execution and diagnose failures. They then kept the DAT session alive by disabling a readiness check and used the phone’s Wi-Fi Direct connection to establish a TCP listener on the glasses, enabling an interactive shell with the app’s user privileges - not root access. After signature checks were added in firmware 127, the researcher found they could be disabled by altering a configuration file delivered by the paired phone: the glasses checked its structure but not whether its contents had been tampered with. This restored the ability to install a custom app. The vulnerability was reported through Meta’s bug bounty program; the researcher says Meta approved public disclosure and believes the issues have since been fixed.