Meta's virtual reality headsets have been implicated in a potential security breach through the use of Big Mama VPN, a free VPN service that sells access to users' home internet connections. Teenagers have been using this VPN to cheat in the game Gorilla Tag by creating a delay to easily ‘tag’ opponents. However, the same service has been linked to cybercriminal activities, as it allows buyers to hide their online activities by piggybacking on the VR headset's IP address. While this tactic mainly targets individual users for in-game advantage, it has been associated with residential proxy services, which are popular among cybercriminals for conducting cyberattacks using proxy networks and botnets. This could lead to more significant privacy and security breaches for Meta's VR headset users.
Source: https://www.wired.com/story/residential-proxy-network-cybercrime-vpn/
TPRM report: https://scoringcyber.rankiteo.com/company/meta
"id": "met000122024",
"linkid": "meta",
"type": "Breach",
"date": "12/2024",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'industry': 'Technology',
'name': 'Meta',
'type': 'Company'}],
'attack_vector': 'Big Mama VPN',
'description': "Meta's virtual reality headsets have been implicated in a "
'potential security breach through the use of Big Mama VPN, a '
"free VPN service that sells access to users' home internet "
'connections. Teenagers have been using this VPN to cheat in '
'the game Gorilla Tag by creating a delay to easily ‘tag’ '
'opponents. However, the same service has been linked to '
'cybercriminal activities, as it allows buyers to hide their '
"online activities by piggybacking on the VR headset's IP "
'address. While this tactic mainly targets individual users '
'for in-game advantage, it has been associated with '
'residential proxy services, which are popular among '
'cybercriminals for conducting cyberattacks using proxy '
'networks and botnets. This could lead to more significant '
"privacy and security breaches for Meta's VR headset users.",
'impact': {'systems_affected': 'Meta VR Headsets'},
'initial_access_broker': {'entry_point': 'Big Mama VPN',
'high_value_targets': 'VR Headset Users'},
'motivation': ['In-game advantage', 'Cybercriminal activities'],
'post_incident_analysis': {'root_causes': 'Use of Big Mama VPN'},
'threat_actor': 'Teenagers and Cybercriminals',
'title': 'Meta VR Headset Security Breach via Big Mama VPN',
'type': 'Security Breach',
'vulnerability_exploited': 'Home internet connection access via VPN'}