A Decoy-Aware Adversary Defeats Ghost-Keystroke Defenses in Virtual Reality

Abstract

Virtual reality headsets leak passwords. A camera that watches the typing hand recovers the secret with high accuracy, and a recent line of defenses answers this by injecting decoy keystrokes, called ghosts, into what the attacker sees. The genuine input reaches the application, the ghosts are dropped inside the keyboard, and the attacker is left to guess which presses to keep. The most complete instance, VRSafe, reports that ghost injection drives keystroke inference close to zero. We show that this protection rests on an assumption that does not hold: that a ghost press looks like a real one in the side channel. A prompted ghost is a cued action, so it runs slower than fluent typing and bends the hand path. We build Winnow, a decoy-aware adversary that scores each press by timing, path geometry, and a character language model, removes the ghosts, and reads off the secret. Against a faithful reimplementation of the defense, a decoy-unaware attacker recovers the secret within 20 guesses for 0% of users once any decoys appear, while Winnow recovers 70% to 79% across injection ratios up to 0.5. An ablation isolates the cause: timing alone carries most of the signal. We give a countermeasure that closes the gap.