Cheap Smart Glasses Open to Bluetooth Hijacking, Tests Find
Independent testing found cheap smart glasses can be hijacked over Bluetooth with no password, exposing stored photos, video and personal data.
Two pairs of cheap smart glasses sold to Australian shoppers can be seized by anyone standing nearby, using only Bluetooth and no password. Independent testing by security firms NSB Cyber and Abstract Shield logged more than a dozen flaws in an A$60 pair bought from Temu and an A$110 pair from importer BDI Technology, sold through Big W Marketplace. The results, released this week, cover the glasses, the HeyCyan companion app both models depend on, and a related website.
The attack path needs no skill. When the glasses are switched on but disconnected from the owner's phone, any other handset running the same app can connect first. No pairing prompt appears, no PIN is requested, and no password exists to be guessed. Whoever gets there first can copy stored photos and video, trigger new recordings, and intercept media as it travels between the glasses and the phone.
David Crees led the assessment. His six days of testing covered the hardware, the companion app and the website. He found no part of the product secured to the standard expected of consumer electronics, and singled out the absent password as the clearest failure: on mainstream devices, pairing normally requires some form of owner confirmation before a second handset takes control.
What the testing found
Seven findings matter most to a buyer:
- Bluetooth pairing that accepts any phone running the HeyCyan app, with no owner confirmation.
- Stored photos and video readable, and copyable, by that uninvited device.
- Remote triggering of fresh photo and video captures.
- Interception of media moving between the glasses and the paired handset.
- A visible device identifier that can expose the wearer's email address and date of birth.
- Voice and image data transmitted to servers in Shenzhen, China.
- A website weakness allowing unauthorised access to user email addresses and birth dates.
The failures sit in the firmware, the permission model and the cloud design, set before the product reached a shelf. No user setting created them.
A price point, and the security that comes with it
The two pairs differ in price by nearly double and arrive through different retail channels. They run the same app. That points to where the security decisions were made: with the white-label module supplier both importers drew from, not with the brand printed on the box. That pattern runs through most cheap smart glasses assembled from shared modules.
| Device | Price | Seller | Platform | Core weakness |
|---|---|---|---|---|
| Budget AI glasses | A$60 | Temu | HeyCyan app | Password-free Bluetooth control |
| Budget AI glasses | A$110 | BDI Technology via Big W Marketplace | HeyCyan app | Password-free Bluetooth control |
Security work costs money and delays shipping. At an A$60 retail price, with margin split between a marketplace, an importer and a factory, little is left for threat modelling, penetration testing or a patch pipeline. The cost lands on the buyer, who cannot audit the firmware and has no lever to force a fix.
Some repairs have followed. The vendor has partially patched a number of the flaws, and at least one supplier has begun winding down supply of the affected hardware rather than keep selling it.
Marketplace listings make the problem harder to contain. The same module turns up under different names, sellers and prices, so a shopper cannot use the brand as a guide. Winding down one supply line does not pull the hardware out of circulation, and the importers who resell it carry little of the engineering responsibility for what runs on it.
The compliance picture is muddier than the technical one. Voice and image data leaving the glasses for servers in Shenzhen raises cross-border disclosure questions that Australian privacy rules were not drafted with wearable cameras in mind. A buyer has no practical way to see where a clip is stored, how long it stays there, or which third parties can query it.
Who carries the risk
Buyers are the obvious losers: a camera a stranger can command, sitting on your face. The harder question concerns everyone else. Cheap smart glasses record bystanders who never agreed to appear in anything, and when that footage leaks, liability specialists say responsibility is unresolved. Insurers have started treating the devices as an open question for cyber cover, because the chain from factory to marketplace to wearer has no clear owner of the risk.
Institutions are not waiting for that answer. Western Australia will ban smart glasses in all public schools, while schools, courts and venues elsewhere have moved to restrict camera-equipped eyewear on their premises. The pressure is landing on eyewear rather than phones because glasses are worn continuously, capture without a visible signal on the cheapest models, and blend into ordinary life in a way a handset never does.
What a buyer can check
Price is not proof of insecurity, and branded hardware is not automatically safe. A few checks separate the two categories. Ask whether the app requires a pairing confirmation or a code before a second phone can take control, and test it by connecting a spare handset while the owner's is disconnected. Look for a firmware update mechanism and a published privacy policy that names where data is stored.
For bystanders, the practical option is detection rather than avoidance. Bluetooth scanner apps sweep local frequencies for vendor IDs, system identifiers and hardware signatures linked to camera-equipped eyewear, and flag devices within range. Mainstream models such as Meta's Ray-Ban line include an indicator light that signals active recording, a cue the cheapest imports do not reliably provide.
Why this matters
An A$60 camera that any nearby phone can command changes the privacy argument. The question now covers both what a wearer chooses to film and who else can reach the device and the footage on it. Cheap smart glasses became common fast, and the same cost pressure left the door open. Buyers should read the price as a signal about the security work behind it, and regulators who spent a decade focused on phones now have their clearest test case attached to a pair of glasses.
Sources
Some cheap smart glasses are a security disaster
Related Articles
- Smart Glasses Sticker Bypass: Meta's $2 Privacy Blind Spot
- Shark Robot Vacuum Flaw Lets Attackers Spy Through Cameras and Access Home Networks
- Weekly Tech Roundup: Apple's Big Week and AI's Price Tag
✔Human Verified
Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.