Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Chrome Google Security

Chrome Bugs Lets Sites Listen To Your Private Conversations 109

An anonymous reader writes "Last year Google rolled out a new feature for the desktop version of Chrome that enabled support for voice recognition directly into the browser. In September, a developer named Tal Ater found a bug that would allow a malicious site to record through your microphone even after you'd told it to stop. Quoting: 'When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can't start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won't notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn't even know was there.' Ater reported this to Google in September, and they had a fix ready a few days later. But they haven't rolled it out yet — they can't decide whether or not it's the proper way to block this behavior. Thus: the exploit remains. Ater has published the source code for the exploit to encourage Google to fix it."
This discussion has been archived. No new comments can be posted.

Chrome Bugs Lets Sites Listen To Your Private Conversations

Comments Filter:
  • by Anonymous Coward on Wednesday January 22, 2014 @06:14PM (#46040987)
    Chromes Bugs' Lets' Sites' Listens Tos Yours Privates Conversations'
  • 2014 (Score:5, Insightful)

    by DarkOx ( 621550 ) on Wednesday January 22, 2014 @06:15PM (#46040989) Journal

    Why in 2014 does any self respecting browser allow pop-ups or pop-unders without explicit permission?

    Security issues aside there is almost nothing quite so irritating as a website opening additional windows except in the rare list of exceptions most of us are quite used to manually keeping.

    • I don't quite understand why auto popups like Livejasmin or 888casino can be allowed to popunder (I find them on client machines all the time) but when ever I ask one of my firewall to display me a log, update firmware or whatever (sophos & pfsense) the browser blocks it. I 'king clicked a button and the browser blocks it. Users do apparently 'nothing' and gambling and porn appear.

      That said, uninstalling Chrome Browser and returning to firefox has been a great release.
      • They do something. They click on the page.

        Popups are allowed from a valid onclick event so the ads put a onclick event on the entire page.

        • Re:2014 (Score:4, Interesting)

          by vlueboy ( 1799360 ) on Wednesday January 22, 2014 @07:45PM (#46041737)

          They do something. They click on the page.

          Popups are allowed from a valid onclick event so the ads put a onclick event on the entire page.

          Not the whole story. Internet Explorer, that ol' browser none of us use when idle, is pretty aggressive blocking even onclick.
          It makes little sense that it's a default setting, and I can't recall.
          My first sense that browsers were in bed with the bad guys was 10+ years ago. I found some alt browser that expressly allowed me to block annoying behaviors:
          * scripted window movement and resizing
          * status bar text changes (crudely obfuscating hover text when you want to see where you'll land)
          * hide the menu bar, navigation bar and url so as to give a small HTML window popup (so you can't tell what url it loaded, how to turn back without keyboard [obscure to Joe Sixpack], and what domains to ban)

          All three of those may have had true uses before web 2.0 during your banking or e-commerce session. But today, css and floating divs can be used to blur the window selectively as to highlight the necessary context. They are vestiges that are not needed by legit sites, and yet are overused by sneaky sites. Browsers phased out blink tags, http + https iframe mix, urlbar javascript execution and other stuff, but don't get rid of pop unders, even as an option somewhere? intentional

          • I asked a forum dev-mod if he could add an option on a new forum (Oculus Rift) a while back if we could at least have an option to open external links (outside of the current forum) in new tabs with a left click. The majority of the research and tech forums (especially) I frequent have this as an option - it just make sense, somebody posts a reference link and you want to look at it without losing your place in the current thread, indeed if it's a picture or diagram having it load up whilst you continue re
            • that your tablet browser doesn't support middle click or right click elegantly, is your tablet browser's bug. website designers should not be expected to cater to every stupid tablet limitation.

            • Technically, target="_blank" is deprecated as-of HTML 5.

          • The alt browser with the restriction options I mentioned was either iCab or Opera, btw.
            -vlueboy

          • by AmiMoJo ( 196126 ) *

            I found some alt browser that expressly allowed me to block annoying behaviors:
            * scripted window movement and resizing
            * status bar text changes (crudely obfuscating hover text when you want to see where you'll land)
            * hide the menu bar, navigation bar and url so as to give a small HTML window popup

            Firefox used to have options to do all that, but they were removed. No Javascript simply can't hide the URL bar or move windows (it can select where to open them, within some limits).

      • by Anonymous Coward
        The problem is that Javascript specifically allows developers to hook directly into button actions: after all it wouldn't be a whole lot of use to display dialogs to users if you then couldn't handle the subsequent action.

        Of course the problem is that a web page can hook a legitimate button (like, say, "Show me the porn!") and add an action, like opening a new window. There's no way for the browser to know if that wasn't a legitimate request by the user, so you get LiveJasmin.com and such.

        The real quest
        • Re:2014 (Score:4, Insightful)

          by lgw ( 121541 ) on Wednesday January 22, 2014 @07:31PM (#46041603) Journal

          : after all it wouldn't be a whole lot of use to display dialogs to users if you then couldn't handle the subsequent action.

          Web pages don't need dialogs in separate windows. Seriously, they don't. That's an old-school UI concept dragged to an inappropriate place. You can present a dialog within the page, in a variety of ways. And if you really need to open a separate, permanent window, that's a new tab, and only if the user has explicitly granted permission for such.

          There's simply no legitimate requirement for a web browser to ever open another desktop UI window - render what you need to within the tabs you present.

          • One advantage of Microsoft standardizing on the metro interface is that popups and dialogues will become a thing of the past.

            • by lgw ( 121541 )

              Hmmm, I can't immediately spot the flaw in your claim, but since I take it on faith that nothing good can come from Metro, that just means I'm not looking hard enough. ;)

        • The real question is: why do browser still allow windows to pop under? There's literally no legitimate use for it.

          Site satisfaction surveys typically pop under so that when you close the main window you see the site satisfaction survey, it refreshes, and asks you shit about your visit.
          Same for a ton of those "eLearning" shits that make you sit through a video, click through pages of shit you're pretending to read, etc. while timing you, tracking your clicks and progress, etc. Often used for employer-mandated training sessions on shit like how not to rape people at work or how to properly walk so you don't trip and sue

      • Re:2014 (Score:4, Informative)

        by ackthpt ( 218170 ) on Wednesday January 22, 2014 @06:37PM (#46041207) Homepage Journal

        I don't quite understand why auto popups like Livejasmin or 888casino can be allowed to popunder (I find them on client machines all the time) but when ever I ask one of my firewall to display me a log, update firmware or whatever (sophos & pfsense) the browser blocks it. I 'king clicked a button and the browser blocks it. Users do apparently 'nothing' and gambling and porn appear.

        That said, uninstalling Chrome Browser and returning to firefox has been a great release.

        I've had to return to Firefox just to get away from recent bugs in Chrome. Chrome as a pretty good browser in its time, but it's heading towards the shark on greased water skis.

        • Indeed; never mind the rest I can't believe in 2014 a browser won't allow you to select text at usable rate!

          Firefox with noscript and ghostery is a joy to use in comparison (though it doesn't handle memory / scrolling very well with large pictures - even on an i7 with 24GB ram and twin GTX 690's) Add adblock on a firewall like untangle and even the tablets and phones in the house can get a decent internet boost.
        • by Sycraft-fu ( 314770 ) on Wednesday January 22, 2014 @08:41PM (#46042199)

          Not to say I like Firefox, but I am currently hating it the least. All the browsers are problematic in my opinion, just in different ways. I used FF for a long time but its Flash issues were just too much, among other things, so I switched to Chrome. Now I'm back on FF. I really like a lot about IE, but it has too many problems rendering a number of websites correctly so it is out.

          Nobody can seem to make a good browser, just a less bad one :P.

        • Comment removed based on user account deletion
      • Because the 888casino popup was triggered directly from a user action. You may have clicked something or pressed a button.
        Like when you go to thepiratebay, no popups come up until you click in the search box.

        Your firewall must be doing it a different way.

    • by s.petry ( 762400 )

      I think it's prudent to question whether this bug in Google's browser is intentional or unintentional. The list of underhanded and outright shitty things we know about being done is pretty long.

      If I bump into a person and it seems like an accident I can get away with apologizing. When I do it a second time, the apology should be taken with a grain of salt. When it happens a third time the person has the right to believe it was intentional and react. This is the point we should be at with not just the NS

      • I think it's prudent to question whether this bug in Google's browser is intentional or unintentional.

        I think it is safe to assume, for any verbal discussion of importance, that all smart phones in the room have their microphones on with voice recognition running. Sure, most of the time they are not, but:

        1. They are the perfect bugging tool.

        2. The person you are talking to might be recording everything anyway

        and 3. if you are in any kind of position that could possibly be envied, someone is bound to be doing this to you.

      • I think it's prudent to question whether this bug in Google's browser is intentional or unintentional.

        Chromium is open source. If this behavior exists in both Chrome and Chromium, then it's a bug, or most likely an unintended consequence.

        If it's only in Chrome, you're right, it'd be a very good idea to question Google's actions.

        • by s.petry ( 762400 )

          The bug being introduced in both does not show that it was not intentional. Google developers probably spend a lot of time working on the OSS version. For example, HP WebOS was open source. HP had several dozen developers working on the OSS source full time in addition to many dozens of other staff for the OSS software.

    • by Anonymous Coward

      Because just as with all other Google services, YOU are product being sold to advertisers.

  • I herd u liked bugs...
    • It's not a bug; it's a *feature!

      *Feature intended only for official government use. Unauthorized users will be penetrated to the full extent of gangrape.
      • It's not a bug; it's a *feature!

        No, this one is very definitely a bug [wikipedia.org].

      • It actually is a feature... The user explicitly gave the malicious website permission to use the mic until they explicitly revoke that permission. The problem is the malicious website didn't stop using them the user did something they thought would stop it, without revoking the permission.

        No. Shit. Really?

      • by gnupun ( 752725 )
        Why don't laptops have a physical shutter so the user can block both camera and mic? I don't like these hackable electronic switches for mic and camera. And I have to wonder whether not having a physical shutter is a feature or a bug?
  • surprise! (Score:5, Insightful)

    by Tom ( 822 ) on Wednesday January 22, 2014 @06:26PM (#46041121) Homepage Journal

    Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?

    • Re: (Score:2, Funny)

      by Anonymous Coward
      Ummmm... someone hears me burp and fart and type?
    • Re: (Score:2, Informative)

      by zacherynuk ( 2782105 )
      I thought this was a good one: "Xbox One Signout" "Xbox One Signout" [youtube.com]
      • by Tom ( 822 )

        Loved this. And no, it's totally on topic, because it's the same thing. Voice-control active during gaming which includes team chat. Yeah, what could possibly go wrong? ;-)

        (loved the girls reaction. she was the only one with enough cool to laugh about it)

    • Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?

      The world wide web and web browser has been a two-way means of communication for quite some years now.

      • by yanyan ( 302849 )

        I believe the voice recognition feature was added as a user interface for the browser, not the web pages themselves. Why or how the audio could get captured by another listener is the question.

    • It's news like this that makes me point my webcam at the wall when i'm not using it.

  • by ackthpt ( 218170 ) on Wednesday January 22, 2014 @06:33PM (#46041173) Homepage Journal

    I mean, besides the few that were just rolled out? Seriously, it's getting more like IE* every day.

    *The bad ol' IE, unlike the rather slow and inept IE of today, which probably still has lots of bugs, too.

    • Re:Bugs in Chrome?!? (Score:4, Informative)

      by Bengie ( 1121981 ) on Wednesday January 22, 2014 @06:49PM (#46041303)
      Chrome had a bug, stop the presses!
    • Part of Google's response (or lack of one) includes that this isn't so much a bug as a feature, and the feature is being misused.

      If you authorize your microphone for evil.site, and evil.site opens another window, your microphone is still authorized for it -- because you (a) permanently authorized evil.site microphone access and (b) because you clicked on the microphone this session.

      Google will likely have to reduce the functionality of the microphone.

      Ideally they'll also use this as an opportunity to give m

    • I would consider using it if it had more plugin support and if website makers still didn't feed IE 6 specific jscript code to it. IE 11 fixed this by ignoring jscript and only supporting ECMA compliant javascript. This broke corporate apps of course reliant on ancient IE behavior.

      Slashdot thanks it with a headline "IE BREAKS MORE SITES AGAIN" and the crowd hounds it for non standard behavior LOL. Even though making it act like Chrome and Firefox is what caused this.

      But you can get adblock plus for it now an

  • by stevegee58 ( 1179505 ) on Wednesday January 22, 2014 @06:47PM (#46041289) Journal
    Subcommander Tal, is that you?
  • by cold fjord ( 826450 ) on Wednesday January 22, 2014 @06:50PM (#46041309)

    Remain calm ....

    I'm sure that Oogle Peep View capture / Wi-Fi mapper / porn share finder vans will be by soon to distribute a patch in the background. It would be evil to not patch that, right?

    (Don't you love being able to search for your own posts within minutes from .... you know. )

  • So, Windows has voice recognition. There's Nuance too. In Windows, when you are using the feature, there's clear application on the top that shows you that it is listening. It works okay with a bit of training if you need that kind of thing.

    This trend by Google to replace more and more features of an desktop OS is really annoying. Notification features in the OS? Nah, just make a really small window in the corner that doesn't go away and just pops up not and then. Of course, the Microsoft voice recognition

  • You grant permission for a website to listen to you.
    It opens a new window to the same domain, that window inherits those permissions.

    There is more than one way to mitigate this problem
    eg:
    1) Don't let any window, regardless of user granted permissions listen while its in the background. This is going to break websites when you switch tabs.
    2) Don't propagate this permission to child windows. That's going to break websites that popup a window for speech recognition that can persist between page navigations
    3) P

  • The built-in camera on my Macbook turns on a hardware light whenever it's being used. Makes it pretty hard to not realize you are potentially being seen. All OSs should display an indicator on the top layer of the display, and enlarge/flash it in a pretty unmissable way every 5 minutes, whenever your camera OR microphone is active. Failure of an OS to do so should be labeled as what it is, a security hazard.
    • by MrKaos ( 858439 )

      The built-in camera on my Macbook turns on a hardware light whenever it's being used. Makes it pretty hard to not realize you are potentially being seen. All OSs should display an indicator on the top layer of the display, and enlarge/flash it in a pretty unmissable way every 5 minutes, whenever your camera OR microphone is active. Failure of an OS to do so should be labeled as what it is, a security hazard.

      There was a slashdot article about an exploit for this not so long ago, camera on, led off.

      Best way to secure the camera is with a piece of black electrical tape, to secure the microphone unplug it or turn it off. Laptop mics are a bit trickier.

    • That's a good point, however, it's been proven that these 'hardware' features can be overcome in software. Sad as it may seem I now have a USB extension lead to my webcam and only connect it when I need it. Example: Link [slashgear.com]

      What really interesting, in my book, is the fact that Skype only started detecting plug in devices 'on the fly' after MS took over, If I hadn't had the device plugged in I would usually have had to quit / re-open skype - or at least re-run through the video setup - nowerdays skype can
    • by vux984 ( 928602 ) on Wednesday January 22, 2014 @08:19PM (#46042087)

      The built-in camera on my Macbook turns on a hardware light whenever it's being used.

      That is an assumption.

      Mac's are now shipping with the camera power led on a separate software controlled circuit so its no longer the case that the light must be on for the camera to be on (or vice versa).

      Complete failure of secure hardware design. Way to go Apple.

  • The article isn't clear, but my first thought is that this should be simple to deal with by just revoking permission for a site to use the mic. Except that when I check in Chrome, there's no way to enable this at all. The only references involve adding the Chrome Voice Control extension, which isn't included in Chrome by default. So while this is a problem, it doesn't seem to be one that can't be easily solved. If you're truly worried about it, don't install the extension or remove it if you've got it insta

  • This is just another in a long line of baffling (and user hostile) decisions Google has made for Chrome. What made me uninstall Chrome was the decision not to clear session cookies after Chrome exits.

    Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.

    Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user

    • Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.

      Well I don't use Chrome, and always sign out of a site, if for nothing else to block a site's cookies (web beacons) from being active while surfing.
      -cookies are deleted when I shut the browser down.

    • Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.

      Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.

      Google's "behavior" yet again shows their twisted anti-privacy slant. I don't wanna know just how much Chrome has contributed to
      1) loved ones spying us
      2) lost passwords due to complacent workers who never hit log out

      Just today I got yet another user who made me wonder just HOW people never learn their passwords and manage to keep logging in for 2 years, till their laptops are lost or refreshed. Between site-controlled "remember me" boxes and lazy browser culling, I think this solves the mystery. Thanks for

  • Chrome recently added a speaker icon to indicate which tabs are playing sound. Why not add a corresponding microphone icon to indicate which (if any) tabs are recording it? Since this would be implemented in the browser, it shouldn't be possible for sites to bypass it.

  • If you think a website is controlled by your enemies or the government or someone who benefits from listening to you, don't give the website permission to your microphone in the first place. Then you're safe from this exploit, since the exploit only works with sites you've already expressly approved.
  • People should really expect this and disconnect everything when they're done.

    All my monitors since the 90's have had a WebCam built in but I didn't buy any for that reason, and have always disabled the webcam by not supplying a USB cable for it's use. Only once have I ever used one and just for a few hours.

    I have a Mic pluged in now for the POS BF4, and assume I can be heard at anytime. It's not Googles fault or Windows but Flash. I always have disabled flash's Webcam and Mic. Used to be it would reset afte

  • That is all.

  • > Google dismisses eavesdropping threat in Chrome feature
    > Google said there's no threat from a speech recognition feature in its Chrome browser that a developer said could be used to listen in on users.

    http://www.techworld.com.au/article/536592/google_dismisses_eavesdropping_threat_chrome_feature/

The fancy is indeed no other than a mode of memory emancipated from the order of space and time. -- Samuel Taylor Coleridge

Working...