Slashdot Mirror
Google Chrome Flaw Sets Your PC's Mic Live
First time accepted submitter AllTheTinfoilHats (3612007) writes "A security flaw in Google Chrome allows any website you visit with the browser to listen in on nearby conversations. It doesn't allow sites to access your microphone's audio, but provides them with a transcript of the browser's speech-to-text transcriptions of anything in range. It was found by a programmer in Israel, who says Google issued a low-priority label to the bug when he reported it, until he wrote about it on his blog and the post started picking up steam on social media. The website has to keep you clicking for eight seconds to keep the microphone on, and Google says it has no timeline for a fix." However, as discoverer Guy Aharonovsky is quoted, "It seems like they started to look for a way to quickly mitigate this flaw."
Yeah right.
I swear to God...I swear to God! That is NOT how you treat your human!
This flaw, plus heartbleed, makes it sound like all the conspiracy theorists got together for a secret cabal to convince the world that the NSA really is out to get everyone.
John
Of course it's built in, it's part of the "ok google" keyword that Google Now (recently added to the Chrome browser) uses to detect an incoming command. The flaw is that transcript is kept for any length of time and that it's available to websites being viewed.
I talk to myself in different voices all the time, and engage in detailed plots to take over the world.
If I haven't been picked up by the Men In White Coats by now, they aren't listening.
[End Of Line]
"The security flaw in the Chrome browser emerges just as the world is confronting the frightening prospect of an undetectable bug known as Heartbleed, that makes millions of passwords vulnerable to being stolen".
'It is being widely reported in the popular press as well as many technical sites that a Heartbleed exploitation "leaves behind no trace"`. That of course is not true.
SSL Server Test
Get the wife & kids to learn and speak Navajo at home. It worked for the USA in World War II so it can work for you too!
This kind of thing should push manufacturers to put hardware on-off switches for both the microphone and the webcam. A simple LED isn't enough, especially if those LEDs aren't directly tied to the power lines of the hardware anymore - I'm looking at you, Apple.
Get free satoshi (Bitcoin) and Dogecoins
speech-to-text
Not sure why everybody keeps writing text-to-speech even though that makes no logical sense in this context :)
I assume that this is the same thing as reported a few months ago? If so, then it is not so simple: the attacking website needs to create a pop-under so that the microphone symbol is hidden. And pop-unders are difficult to achieve with Chrome with the popup blocker activated (as is usually the case).
Since Kinect also has a model where it's always listening in order to be able to execute commands, I wonder if there's any similar vulnerability from the Kinect web browser (not that many people probably use the Xbox One for browsing, but still).
---> Kendall
"There is more worth loving than we have strength to love." - Brian Jay Stanley
"Let's give web browsers direct access to hardware!", they said, "it'll be great!"
WTF have I dicking miss loopy cotton for eight reconed to take this site to work?
Please [diety], let this guy be watching bull riding.
So, no thanks to TFA, I found the actual bug report, and it turns out the guy went public less than 2 days after reporting the bug to Google. Talk about impatient. And it's not true that "Google issued a low-priority label to the bug when he reported it, until he wrote about it on his blog and the post started picking up steam on social media". It's true that it was originally given a low-severity label at first, it was bumped to medium a day-and-a-half later, then up to high a few hours after that--around the same time that he went to reddit about it. Not exactly sure if it was before or after, since I don't know the timezone of the times reported on Chrome's issue tracker, but one of the comments from Google says that they had already bumped the severity rating before they knew about him going public.
Please [diety], let this guy be watching bull riding.
He is, but in my opinion it makes the furious masturbation more disturbing, not less.
the news here is that the website doesn't turn on the microphone, google turns on the microphone and starts making transcriptions of everything you say. the website just accesses the transcriptions. why is goog recording everything? rhetorical question, they are looking for keywords that they can advertise against. did you just say "cancun"? they will give you hotel and airline ads.
that is super creepy.
That's why it's always more secure to run software 6 or more versions out of date. No zero-day bugs for me!
Your ad here. Ask me how!
No laptop? The mid 1990s called. They want to know how you missed the last 20 years.
Since DOS fell into general disuse, neither audio input nor keyboard input is especially "direct access to hardware". The device driver handles the direct access under the control of the API infrastructure in the operating system. Thus being able to read an audio input device through an audio input API is not direct access any more than being able to read an alphabetic keyboard device through a keyboard API is direct access.
they say "To improve processing of your voice input, Google may record a few seconds of ambient background noise in temporary memory at any time.". I take this to mean, they are recording constantly into a buffer at all times.
So, your privacy hinges on the fact that Google programmers remain incompetent?