Consumer-grade brain computer interface, i.e., EEG headsets are getting popular in our daily life activities. These devices are low-cost, light-weight in design and powerful enough to interact with a computing device effectively. In medical-grade use, EEG signal helps to detect different brain disease, e.g., sleep disorder, Epilepsy, Parkinson's disease, Alzheimer's disease. In consumer-grade use, EEG signal helps to communicate with the computing system in an error-free way. The high density brain imaging techniques and the easy integration features of EEG headsets introduce serious privacy attack to end-users. In this paper, we introduce Disease Detector, an eavesdropping attack which infers information about brain disease from EEG signal collected during daily life activities, such as stationary activities (e.g., desk work, idle sitting), light ambulatory activities (e.g., stairs up and down, walking), and intense ambulatory activities (e.g., jogging, running). In this attack, we utilize a low-cost and light-weight consumer-grade EEG headset to integrate with a smartphone/smartwatch/computer using Bluetooth connection and collect data passively without user intervention. We show that how an attacker can infer user's private health conditions (i.e., Epilepsy) from uncontrolled EEG signal and use it for unknown malicious purposes (e.g., targeted advertisement, trigger disease symptoms with flashing strobe lights, high frequency sounds etc.). We evaluate the attack with spectral analysis and machine learning. Our machine learning results show accuracy of 82 % on stationary activities, 94 % on light ambulatory activities and 83 % on intense ambulatory activities in identifying an epileptic patient from a healthy person. Our work shows that, it is indeed feasible for an attacker to learn about serious health condition by analyzing EEG signal collected from a low-end EEG headset. We believe our work serves to raise awareness to a potentially hard-to address threat arising from consumer-grade EEG headset and provides insights to security researchers to consider robust security measurements to protect users' private sensitive information (e.g., health condition).

The spread of digital disinformation (aka "fake news") is arguably one of the most significant threats on the Internet today which can cause individual and societal harm of large scales. The susceptibility to fake news attacks hinges on whether or not Internet users perceive a fake news article/snippet to be legitimate (real) after reading it. In this paper, we attempt to garner an in-depth understanding of users’ susceptibility to text-centric fake news attacks via a neuro-cognitive methodology (thus corroborating as well as extending the traditional behavioral-only approach in significant ways). In particular, we investigate the neural underpinnings relevant to fake vs. real news through EEG, a well-established brainimaging technique. We design and run an EEG experiment with human users to pursue a thorough investigation of users’ perception and cognitive processing of fake vs. real news. We analyze the neural activity associated with the fake vs. real news detection task for different categories of news articles.Our results show that there may be no statistically significant or automatically inferable differences in the way the human brain processes the fake vs. real news, while marked differences are observed when people are subject to (real or fake) news vs. resting state and even between some different categories of fake news. This neurocognitive finding may help to justify users’ susceptibility to fake news attacks, as also confirmed from the behavioral analysis. In other words, the fake news articles may seem almost indistinguishable from the real news articles in both behavioral and neural domains. Our work serves to dissect the fundamental neural phenomena underlying fake news attacks and explains users’ susceptibility to these attacks through the limits of human biology. We believe that this could be a notable insight for the researchers and practitioners suggesting that the human detection of fake news might be ineffective, which may also have an adverse impact on the design of automated detection approaches that crucially rely upon human labeling of text articles for building training models.

Head-worn wearables, such as consumer-grade EEG headsets deployed in Brain Computer Interfaces (BCI), are getting popularity in the gaming and entertainment industry, and for people with certain disabilities. However, the increasing popularity of these wearables creates a significant privacy risk. For instance, tech companies are intending to use brainwave devices to detect workers' emotional state and mental condition. There are AI techniques that can learn what people are looking at in real-time. Silently conversing with the computing system is now possible using neuromuscular signals, for instance, untold digit recognition with higher accuracy is possible, which can retrieve untold PIN or password. These applications can reveal more private information than designated benign purpose, such as, while detecting performance of worker, sensitive information like Parkinson's disease, substance abuse disorder, heart disease, can be revealed from brainwave. The consequences of these privacy leakages may be potentially devastating, such as tracking users for targeted advertisements and launching targeted attacks against users. In this paper, we analyze current devices, explore previously studied attacks, research efforts to extract information from brainwave and analyze and synthesize potential future attacks from the current deployment. This systematization will provide right direction towards ensuring privacy risk of BCI devices, which is a pre-requisite to building future defense mechanisms against the attacks.