  Virtual Reality (VR) is an exciting new consumer technology which offers an
immersive audio-visual experience to users through which they can navigate and
interact with a digitally represented 3D space (i.e., a virtual world) using a
headset device. By (visually) transporting users from the real or physical
world to exciting and realistic virtual spaces, VR systems can enable
true-to-life and more interactive versions of traditional applications such as
gaming, remote conferencing, social networking and virtual tourism. However, as
with any new consumer technology, VR applications also present significant
user-privacy challenges. This paper studies a new type of privacy attack
targeting VR users by connecting their activities visible in the virtual world
(enabled by some VR application/service) to their physical state sensed in the
real world. Specifically, this paper analyzes the feasibility of carrying out a
de-anonymization or identification attack on VR users by correlating visually
observed movements of users' avatars in the virtual world with some auxiliary
data (e.g., motion sensor data from mobile/wearable devices held by users)
representing their context/state in the physical world. To enable this attack,
this paper proposes a novel framework which first employs a learning-based
activity classification approach to translate the disparate visual movement
data and motion sensor data into an activity-vector to ease comparison,
followed by a filtering and identity ranking phase outputting an ordered list
of potential identities corresponding to the target visual movement data.
Extensive empirical evaluation of the proposed framework, under a comprehensive
set of experimental settings, demonstrates the feasibility of such a
de-anonymization attack.
