Chrome Bugs Lets Sites Listen To Your Private Conversations

An anonymous reader writes "Last year Google rolled out a new feature for the desktop version of Chrome that enabled support for voice recognition directly into the browser. In September, a developer named Tal Ater found a bug that would allow a malicious site to record through your microphone even after you'd told it to stop. Quoting: 'When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can't start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won't notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn't even know was there.' Ater reported this to Google in September, and they had a fix ready a few days later. But they haven't rolled it out yet — they can't decide whether or not it's the proper way to block this behavior. Thus: the exploit remains. Ater has published the source code for the exploit to encourage Google to fix it."

Comments

Fixeds thats

[Anonymous Coward]

Chromes Bugs' Lets' Sites' Listens Tos Yours Privates Conversations'

2014

[DarkOx]

Why in 2014 does any self respecting browser allow pop-ups or pop-unders without explicit permission?

Security issues aside there is almost nothing quite so irritating as a website opening additional windows except in the rare list of exceptions most of us are quite used to manually keeping.

Re:2014

[ackthpt]

I don't quite understand why auto popups like Livejasmin or 888casino can be allowed to popunder (I find them on client machines all the time) but when ever I ask one of my firewall to display me a log, update firmware or whatever (sophos & pfsense) the browser blocks it. I 'king clicked a button and the browser blocks it. Users do apparently 'nothing' and gambling and porn appear.

That said, uninstalling Chrome Browser and returning to firefox has been a great release.

I've had to return to Firefox just to get away from recent bugs in Chrome. Chrome as a pretty good browser in its time, but it's heading towards the shark on greased water skis.

Re:2014

[lgw]

: after all it wouldn't be a whole lot of use to display dialogs to users if you then couldn't handle the subsequent action.

Web pages don't need dialogs in separate windows. Seriously, they don't. That's an old-school UI concept dragged to an inappropriate place. You can present a dialog within the page, in a variety of ways. And if you really need to open a separate, permanent window, that's a new tab, and only if the user has explicitly granted permission for such.

There's simply no legitimate requirement for a web browser to ever open another desktop UI window - render what you need to within the tabs you present.

Re:2014

[vlueboy]

They do something. They click on the page.

Popups are allowed from a valid onclick event so the ads put a onclick event on the entire page.

Not the whole story. Internet Explorer, that ol' browser none of us use when idle, is pretty aggressive blocking even onclick.
It makes little sense that it's a default setting, and I can't recall.
My first sense that browsers were in bed with the bad guys was 10+ years ago. I found some alt browser that expressly allowed me to block annoying behaviors:
* scripted window movement and resizing
* status bar text changes (crudely obfuscating hover text when you want to see where you'll land)
* hide the menu bar, navigation bar and url so as to give a small HTML window popup (so you can't tell what url it loaded, how to turn back without keyboard [obscure to Joe Sixpack], and what domains to ban)

All three of those may have had true uses before web 2.0 during your banking or e-commerce session. But today, css and floating divs can be used to blur the window selectively as to highlight the necessary context. They are vestiges that are not needed by legit sites, and yet are overused by sneaky sites. Browsers phased out blink tags, http + https iframe mix, urlbar javascript execution and other stuff, but don't get rid of pop unders, even as an option somewhere? intentional

surprise!

[Tom]

Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?

Re:Bugs in Chrome?!?

[Bengie]

Chrome had a bug, stop the presses!

What, me worry?

[cold fjord]

Remain calm ....

I'm sure that Oogle Peep View capture / Wi-Fi mapper / porn share finder vans will be by soon to distribute a patch in the background. It would be evil to not patch that, right?

(Don't you love being able to search for your own posts within minutes from .... you know. )

Re:Hardware/OS level indicator

[vux984]

The built-in camera on my Macbook turns on a hardware light whenever it's being used.

That is an assumption.

Mac's are now shipping with the camera power led on a separate software controlled circuit so its no longer the case that the light must be on for the camera to be on (or vice versa).

Complete failure of secure hardware design. Way to go Apple.

I've switched recently as well

[Sycraft-fu]

Not to say I like Firefox, but I am currently hating it the least. All the browsers are problematic in my opinion, just in different ways. I used FF for a long time but its Flash issues were just too much, among other things, so I switched to Chrome. Now I'm back on FF. I really like a lot about IE, but it has too many problems rendering a number of websites correctly so it is out.

Nobody can seem to make a good browser, just a less bad one :P.