Slashdot Mirror
Privacy Flaws In Chatroulette Expose Users
itwbennett writes "In a paper posted online this week, researchers from the University of Colorado at Boulder and McGill University outline three different types of attacks that could be launched against Chatroulette users. While the new research doesn't expose any gaping privacy holes, it does show how the service could be misused by determined criminals. For example, the researchers were able to use IP-mapping services to get a general idea of users' location (a public Web site, called Chatroulettemap.com already does this). Then by searching Facebook using information obtained in chats and comparing pictures, researchers were able to identify chatters. 'Even in a city as big as Chicago, you can drill down and find the person you're actually talking to,' said Richard Han, an associate professor with the University of Colorado who co-authored the paper."
Privacy Flaws In Chatroulette Expose Users
Trust me, on Chatroulette it's the users that have been exposing themselves.
My work here is dung.
For one simple reason. Facebook does not let you set your profile picture to a shot of your genitals.
So the security flaw is that by asking someone for personal information you can obtain personal information about them? This is called social engineering (or maybe just talking).
Not sure what you'd do with this anyway, go meet that masturbator you saw online?
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
"Chatroulette is a website that pairs random strangers from around the world together for webcam-based conversations. Visitors to the website randomly begin an online chat (video, audio and text) with another visitor. At any point, either user may leave the current chat by initiating another random connection. As of July 11 the site is offering an experimental "localized" version which pairs people by state". -wikipedia
So 1.) people find each-other intentional and 2.) "using information obtained in chats" I can get you SSN... if you tell me.
Literal nothing worthy of note in this research folks... move on.
Has anyone ever used it and engaged in an interesting conversation with a person who became a regular point of contact? Or is it all just penises and overweight bald guys?
Living With a Nerd
That is one ugly exposure !! EEuh
Omg omg omg! I'm having a face to face chat with someone, but - I can find out who they are!
Next article: Privacy flaws In Public Streaking Expose Users
How can I believe you when you tell me what I don't want to hear?
At least 2 of the 3 things mentioned in the paper can be done on ANY cam site (blogtv, ustream, tinychat, etc).
It's truly ridiculous to only mention Chatroulette here and I don't consider any of the things mentioned a real security flaw. 4chan has been "exploiting" these sites for years already, it's nothing new.
I am not bald.
researchers in universities are seriously out of ideas of what to research
I wasnt aware that enough people posted pictures of their genitalia on Facebook to make accurate comparisons with Chatroulette. I stand corrected.
D
The first, last, and only tech news site on the net
Exposing your face and allowing it to be recorded can lead to your identification! Who knew?
All I did was /whois USERNAME and I got all their details.
Another trick I use is google their name on Facebook. Or lookup FourSquare. :)
"... researchers were able to use IP-mapping services to get a general idea of user's location... Chatroulette is now testing a new feature called Localroulette, which connects people from specific cities with one another."
:( "... researchers from the University of Colorado at Boulder and McGill University ..."
..... no, no doesn't ring a bell
Congratulations researchers, you've discovered chatroulette's new features.
Please tell me taxpayers didn't pay for this research
DOH!
they weren't researching anything, network admin probably noticed IP logs of them spending all day on chatroulette and they had to come up with some excuse.
*phone rings*
Person answering: Hello?
Admin: is this the research office of (BLANK)?
"Researcher": Yes it is
Admin: I'm the network admin for (insert "prestigious" university) and we've noticed someone in your office has spent the last 4 months on a website by the name of "chatroulette". Do you know anything about this?
"Researcher": Um.... what's the website?
Admin: Chatroulette
"Researcher":
Admin: Well if you notice anyone please let us know. The website is known for inappropriate content (NSFW) and we'll be monitoring the PC logins of the individuals and alert campus security once we know who is visiting the website.
"Researcher": OH Chatroulette! Oh yes I'm very familiar with that website, we're researching it
Admin: Research?
"Researcher": Yes research. We're... um, "probing" it's vulnerabilities, looking for "gaping holes" that "expose" users (chuckle)
Admin: gaping holes?
"Researcher": smiling Yes gaping holes... in security
Admin: Oh i see... well thank you for letting me know, I'll note this in the logs
"Researcher": You do that, have a good afternoon
Admin: You too
my karma will be here long after I'm gone
gaping privacy holes
Why would that phrase ever be used when discussing Chatroulette.
Additionally, you should be modded redundant.
-Arthur
Cave ne ante ullas catapultas ambules
I thought this was the exact issue the U.S. miltary had when they had soldiers posting geotagged pictures to facebook which identified where they were in Afghanistan. Same idea - people, given a few small details, can very easily find out about you by the use of Google.
Back when I was in first year university (1996) it was still pretty wild west on the internet. I was talking to a friend who I had never given any of my real details (name, address, etc) when she popped up and asked if I went to AMHS (my high school). After picking my jaw off the floor I found out that I had mistakenly forwarded them an E-mail which I had originally forwarded from my school account to my hotmail account. They found the e-mail address, and googled it. It was all laid out there on the Universities' website.
I call it 'The Aristocrats'
1) Guys pretending to be women
2) Using IP addresses to find a general location
3) Finding someone on Facebook based on their interests
How are any of these things new?
I still talk to a girl in Sicily I ran into on roulette a few months ago. It is rare, but you can find normal people there.
Nothing mentioned in TFA is a flaw with Chatroulette, they're simply byproducts of this type of communication. If I printed a picture of myself and stapled it to a telephone pole someone could possibly identify me and try to scam me, too. Does this mean telephone poles have flaws?
I thought this was only made for some /b/tards and bored journalists.
Your story reminded me of an experience I had back around that same time period ('96 or '97), when ICQ was fairly new and I was in my last year of college.
My sister spent a lot of time on ICQ and made a few friends. Apparently some guy on there used what little information she had shared with him (I don't know exactly what that was) and was able to put together enough information on her to figure out exactly where she lived. Soon after, he made some some thinly veiled threats to show up at her home and possibly cause her and her son harm. She was concerned, so she came to me.
I took little information that she could provide me with about him (along with his IP), and managed to determine not only what his real name, but also his place of employment, names and e-mail addresses of members of management at his company, and determined that he had sent these threats to my sister from his work computer during work hours.
He was in another country (Canada), so I doubted he was a real threat to her, but management at that company still was not happy to hear about this guy's behavior when I reported it to them.
When you plug in a camera, sit down in front of said camera, and broadcast said camera to random strangers, the very notion of a "privacy flaw" becomes moot.
MSIE: The world's most standards-complaint web browser.
Privacy flaws in Chatroulette? Based on what I've seen on Chatroulette, these are not people who care much about privacy!
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
in before a million comments about 'exposing' ...too late
Your friend is a gay apple fanboy that goes on Chatroulette, and he enjoys seeing penises on the internet, never mind that he can recognize one immediately by the shape, color or size.
Starbucks, Harbuckle of Breath.
I performed a dead-simple MITM on ChatRoulette. Take two different virtual webcam programs. Open two browser windows. Set it up so browser window A is using a "webcam" that's actually a live screen capture of the other person in browser window B, and vice versa. It's crappily slow, and it doesn't forward chats. The chat forwarding could be easily automated with AutoHotKey. I just forwarded it by hand with copy and paste if it seemed interesting. Plus you can inject your own comments if you want which is fun.
Ummm, gee it's simple enough to get someone's facebook account. I generally do it by saying, "What's your facebook account?" How is this a security flaw?
/* TODO: Spawn child process, interest child in technology, have child write a new sig */
IP can be used to track area.
Social engineering can provide you with people's details.
Film at eleven.
What a depressingly stupid machine.
Someone notify CmdrTaco that kdawson got a hold of his password.
What a depressingly stupid machine.