Ultrasound Tracking Could Be Used To Deanonymize Tor Users (bleepingcomputer.com)

New submitter x_t0ken_407 quotes a report from BleepingComputer: Ultrasounds emitted by ads or JavaScript code hidden on a page accessed through the Tor Browser can deanonymize Tor users by making nearby phones or computers send identity beacons back to advertisers, data which contains sensitive information that state-sponsored actors can easily obtain via a subpoena. This attack model was brought to light towards the end of 2016 by a team of six researchers, who presented their findings at the Black Hat Europe 2016 security conference in November and the 33rd Chaos Communication Congress held last week. Their research focuses on the science of ultrasound cross-device tracking (uXDT), a new technology that started being deployed in modern-day advertising platforms around 2014. uXDT relies on advertisers hiding ultrasounds in their ads. When the ad plays on a TV or radio, or some ad code runs on a mobile or computer, it emits ultrasounds that get picked up by the microphone of nearby laptops, desktops, tablets or smartphones. These second-stage devices, who silently listen in the background, will interpret these ultrasounds, which contain hidden instructions, telling them to ping back to the advertiser's server with details about that device. Advertisers use uXDT in order to link different devices to the same person and create better advertising profiles so to deliver better-targeted ads in the future. The attack that the research team put together relies on tricking a Tor user into accessing a web page that contains ads that emit ultrasounds or accessing a page that contains hidden JavaScript code that forces the browser to emit the ultrasounds via the HTML5 Audio API.

Comments

Jokes on them

[Anonymous Coward]

My crappy Dell laptop speakers are limited to about 3 kHz.

Re:Jokes on them

[gweihir]

That is what you think. Actually it will be something like 6dB/octave dampening, so it still puts out about 12% of maximum volume at 24kHz. Receiving ultrasound is easier than normal sound, as there is less of it around in a normal environment. And in this application there is no need to worry about signal quality, a straight rectangle signal will do just fine, because of the dampening. The next generation of this malware will probably use ultra-wideband audio-pulses and be even more resilient.

Re:Jokes on them

[Pseudonym]

So that's why Apple is killing the headphone jack!

Re:Jokes on them

[the_Bionic_lemming]

What are these ads or javascripts that run on my machine without me knowing about them? Do people actually surf the web without crippling the sites that attempt to do so?

That's like web aids, or web gonorrhea .For gods sake, strap on some protection!

Re: Jokes on them

[Anonymous Coward]

Yes, to force you to use speakers and a mic.

Re:Jokes on them

[AmiMoJo]

For most people, the disadvantages of wearing a tinfoil hat all the time outweigh the benefits. Believe it or not they actually like being able to use web sites without them being horribly broken. Crazy, I know.

What really is hard to understand is why the Tor browser, at least on Tails, seems to have Javascript enabled by default. If the user has gone to the effort of using Tor, it seems reasonable to require them to whitelist manually.

Re:Jokes on them

[stealth_finger]

My crappy Dell laptop speakers are limited to about 3 kHz.

I have some fairly decent speakers but they still don't do anything outside human range hearing, probably don't go above 16k. How do they think they are going to get it to do ultrasound?

Re:Jokes on them

[fisted]

as there is less [ultrasound] around in a normal environment.

Is that true? How do you know?
I hope this claim isn't based on the fact that you normally don't hear any ultrasound in your normal environment...

I for one can think of a crapton of stuff in my 'normal environment' that likely emits ultrasound, first and foremost every switching PSU (except the crappy ones that switch in the audible spectrum, producing a sound like a muted TV....)

Re:Jokes on them

[Anonymous Coward]

Because they tried it. Your speakers can do more than you think, just not the way you tried it. It's not like they are just playing a bit of music.

Re:Jokes on them

[hodet]

I was surprised by this the first time I installed Tor Browser as well.

Re:Jokes on them

[Anonymous Coward]

For most people, the disadvantages of wearing a tinfoil hat all the time outweigh the benefits. Believe it or not they actually like being able to use web sites without them being horribly broken.

Disabling javascript may break stuff horribly. Using an adblocker or muting the sound does not break anything significant.

Even if some pages emit ultrasound - others will play sound and remind me to always mute. I use sound on the pc only when playing music.

And what about the listening? Even if some PCs emits ultrasound, who will leave a mic on and run receiving sw? Not me, for sure.If this gets popular, muting the mic will be standard . . .

Re:Jokes on them

[Anonymous Coward]

That is what you think. Actually it will be something like 6dB/octave dampening, so it still puts out about 12% of maximum volume at 24kHz. Receiving ultrasound is easier than normal sound, as there is less of it around in a normal environment.

Or so you think, because your can't hear the multiples sources of ultrasound around.

Re:Jokes on them

[Qzukk]

they still don't do anything outside human range hearing

And you know this because you tried it and didn't hear anything?

Re: Jokes on them

[Anonymous Coward]

Jokes on you, I'm a freak of nature that absolutely can hear all that ultrasonic whine from everything!

I win at genes. Wait...

Re:Jokes on them

[stealth_finger]

No, because that's what they're rated at and it's pointless to make speakers that go over 20k unless you're specifically looking to make an ultrasound device.

Just when you thought

[waspleg]

ads couldn't be any fucking worse...

Re:Just when you thought

[Xenographic]

What are ads? I haven't seen them in so long that I forgot.

Good to see some real info on hacking on here for once, even if it's a bit dated. I was getting sick of talking about phishing scams and the idiots who fall for them.

Re:Just when you thought

[Anonymous Coward]

..and social justice.. don't forget that.

Re:Just when you thought

[Leslie43]

Never, EVER say it couldn't be worse, because someone or something will prove you wrong.

Enjoy your bios rootkit now that you jinxed yourself.

Re:Just when you thought

[simplypeachy]

I try only to comment when I have something thoughtful to add, but decided I had to comment despite myself this time. You summed it up nicely. Those advertiser scum could barely be any worse. These is some of those most obtrusive, obscene and despicable ideas yet. They might as well video record me taking a shit and use the colour and texture of my faeces to determine which food or vitamin pills they're going to force down my gullet when I next pause between breathing. Breathtakingly despairing.

Re:Just when you thought

[simplypeachy]

When I use other people's computers to use the Internet...good god it's like I'm in some sort of fledgling Total Recall. So many of the adverts have reached past the threshold of being parodies of themselves, they seem like their own self-satire. The relevancy or attention span of any amount of text is reduced to almost nil by pictures of mostly-naked people on diet pill adverts, shiny shiny motor vehicles with angry-looking grilles or hilarious gambling animations. There is a massive joke that you and I are not seeing, and that's because we're not suffering the expense of being the butt of the joke that is Internet advertising.

Re: Just when you thought

[ememisya]

The browser could simply ask the user, "Allow access to audio API from script.js"? Seems like this was probably already a great idea so that you couldn't make a browser moan for the entire Starbucks to hear.

Re:Just when you thought

[jenningsthecat]

When I use other people's computers to use the Internet...good god it's like I'm in some sort of fledgling Total Recall ...There is a massive joke that you and I are not seeing, and that's because we're not suffering the expense of being the butt of the joke that is Internet advertising.

Hear, hear! If the majority of unsophisticated users could see our browsing experience for just one day, and then understand how easy it would be for them to have the same, I think a large portion of Internet ad revenue would dry up overnight.

I'm of two minds on this. On the one hand, I'd like everyone to experience the Web without ads. On the other hand, I'm grateful that they don't, because their acquiescence allows me to avoid ads without taking heroic measures.

Re:Just when you thought

[Anonymous Coward]

...you go and do something like this...and TOTALLY REDEEM yourself. /scarcasm

Re: Just when you thought

[squiggleslash]

That might have worked once upon a time when we had simply Javascript scripts that were more or less self contained. Today you'd almost certainly get a bunch of "Allow access to audio API from cdn.google.com/oneofthreepopularplayers.js?" type requests coming from both legitimate applications and ads. At best, you'd have to include the equivalent of a stack trace within the dialog (oh! So opendashplayer.js is being called by honestads.ru huh? I'll block that!), but then you're making the dialog way more complicated. ("Always block audio by opendashplayer.js / Always block audio by opendashplayer.js called by honestads.ru / Always block audio by opendashplayer.js called by honestads.ru called by thissite-insert-ads-from-partners.js")

We do need better control, but how we go about it without essentially throwing the web out and starting again I don't know.

Re: Just when you thought

[TheRaven64]

Another variant of this attack used several other mechanisms for generating the sound. If you're doing a very targeted attack, spiking the CPU to 100% until the fans come on and then letting the machine cool gives you a good idea who it is. For a lot of machines, various different operation sequences can make some components emit high-frequency sound that a reasonable microphone can pick up. There was a really neat attack on Tor in data centres about a decade ago that monitored the ambient temperature (using a co-located box's own temperature monitors) to correlate Tor traffic from a particular node with warming of the room, so that (after a lot of samples) you could tell if traffic for a particular user was flowing through the data centre that you were looking at.

Re:Just when you thought

[TheGratefulNet]

what is a speaker and a mic? I leave both turned off on my pc. when I want to listen to music, I run a linux box that does not have a browser or normal network access enabled. and there is never a mic on a music playback system that I build or use.

I block ads and each time I read things like this article, it increases my belief that blocking ads is the right thing to do. I block incoming network connections at the firewall and nearly everyone does, too; but I find it odd that not everyone wants to fight ads as much. 'we' do, but the regular net-using populace doesn't usually care. I rarely see adblockers and noScript installed at co-workers workstations.

and because the raw web is nasty and dangerous - and because blocking is much harder on 'phones', I avoid using phone browsers. its rarely a good experience (mobile web) anyway.

there really are 2 classes of internet users. those like me (and probably you) who aggressively block this crap and those who could not care less. such a shame that people don't univerally fight back.

ads are malware. plain and simple. people really need to get hip to that fact.

Re: Just when you thought

[ememisya]

Yea but how would you pick up that data without any input sources around? At some point you would have to have an active mic, or allow for additional permissions, or maybe watch for the canvas element to freeze or whatever, but those are all new additions still not ordinary for HTML4 not snoopin' on yo mom 'n' pop browser. Up to this point we had 3 problems, object, activex, java plugin , flash etc. and all of those were opt-in, not out.

Re: Just when you thought

[TheRaven64]

You do need a microphone, but most people carry a mobile phone and don't look too carefully at the list of apps that are allowed access to the microphone, GPS and WiFi location data, and the network. If you are a state-level adversary, then compromising, say, the Facebook app will let you get this information in a lot of places.

Doesn't work on me

[Anonymous Coward]

Too bad I block my adds.

So, um, ...

[Anonymous Coward]

Turn off your speakers?

Re: So, um, ...

[Anonymous Coward]

Or, turn off your microphones when not in use.

Phones should have a visual indicator like webcams when they are listening in.

Re: So, um, ...

[newbie_fantod]

Or turn off JavaScript if yow want to remain anonymous on Tor.

Re: So, um, ...

[Anonymous Coward]

I'd have to install it first....

Re: So, um, ...

[TheRaven64]

I would love a legal requirement that any device that comes with a camera or microphone have a physical switch to disconnect them.

Re: So, um, ...

[Blaskowicz]

It's not that hard by software means. Misconfigure your ALSA or Pulseaudio, or try to install OSS to replace them.

Wont work for me either

[jonwil]

The only microphone I have is the microphone in my Nokia N900 and I doubt the N900 and its ancient web browser could run any of whatever backend code has to listen for the special sound.

Re:Wont work for me either

[Anonymous Coward]

Until you eventually upgrade. But hell, you probably will forget or become apathetic to all of the tracking and just submit like a good little sheep.

Re:Wont work for me either

[Frosty Piss]

The only microphone I have is the microphone in my Nokia N900 and I doubt the N900 and its ancient web browser could run any of whatever backend code has to listen for the special sound.

All you people are rubes! I use a can and a string...

Re:Wont work for me either

[Cmdln Daco]

The thing is, many things can be used as microphones if properly manipulated. The first to come to mind is the speakers. If they're not being used to emit sound and they have a permanent magnet and a coil, they are already a microphone, and a path backwards from the circuit that usually drives them just needs to be established.

Resistors, capacitors, all sorts of electronic components react to sound and vibration by altering their characteristics. If there's an A/D on your phone monitoring battery voltage, it might be possible to use it to 'pick up' battery supply line current fluctiations based on sound/vibration your mobile device is exposed to.

Re:Wont work for me either

[Anonymous Coward]

microphones are irrelevant when. there. is. no. fucking. sound. coming. from. the. machine. twats.

Re:Wont work for me either

[currently_awake]

Ultrasound could also be used to communicate with spyware running on embedded devices in your home or business, to get your secrets when all the phones are turned off or in airplane mode. Sounds like we need to put low pass filters on our speakers and microphones to block this. And physical switches to block microphones.

Speakers

[moschner]

I doubt my crappy speakers can emit anything in that frequency. Even then, my phone's mic is not probably up to the task.

Besides, I'm sure those who are worried could buy/build a filter to remove audio in that frequency.

Lots of sophistication required here

[Anonymous Coward]

Anyone who's paranoid enough to use Tor should also be blocking ads and trackers in order to make this difficult. Tor isn't a magic bullet for privacy. you have to take other measures, too.

Also, this requires that other devices be listening and possibly compromised. It doesn't seem like other devices should be listening for ultrasonic signals and sending data based on them unless they've already been compromised.

Yes, it's been established that, with extreme skill, malware can jump the air gap. However, this requires a large degree of sophistication. Furthermore, even if people can't hear those signals, wouldn't they attract the attention of animals like dogs? And of they're of a high enough frequency that dogs can't hear them, shouldn't it be possible to generate enough ultrasonic noise to block out the signals? If this is a real threat, shouldn't someone be writing programs that produce garbage ultrasonic noise or devices that are designed specifically to look for these signals?

Re:Lots of sophistication required here

[Anonymous Coward]

Anyone who's paranoid enough to use Tor should also be blocking ads and trackers in order to make this difficult.

And should be blocking ALL JAVASCRIPT, period, so a site can't sneak its own little ultrasonic .js file past the ad blocker.

Re:Lots of sophistication required here

[Koby77]

Potentially they would also be paranoid enough to simply disable sound, or at least run through some kind of headphones/speakers with a toggle. I can't even remember the last time that I browsed a webpage with my sound enabled. While this type of attack does seem devious, it also seems to be grasping at straws for any possible advantage.

Re:Lots of sophistication required here

[EvilSS]

Well to the first point, it could also be used by an agency taking over a tor site covertly, no need to embed it in an ad. To the second, it doesn't require the phone to be compromised at all, just the user to download an app from an official app store and not pay attention to the terms and permissions it's asking for. This technology is used in advertising beacons today. The app developer adds a library and it reports back to the agency that provides the beacons. There have been several stories in the past year about marketing companies getting into this business. They listen for advertising beacons from online ads, TV, radio, and in stores and other public places. It wouldn't be that hard for a government agency to hijack that and get them to feed them all the info they can gather on anyone reporting back with their snare beacon IDs. Considering that's pretty much what they do now for their regular customers.

I wouldn't expect a tech savvy person to do it (though some will) but there are enough non-tech savvy people who use things like Tor thanks to friends, online tutorials, or pre-packaged browsers that it would probably net a few fish from a big enough site.

Re:Lots of sophistication required here

[geekmux]

Also, this requires that other devices be listening and possibly compromised. It doesn't seem like other devices should be listening for ultrasonic signals and sending data based on them unless they've already been compromised.

Yes, it's been established that, with extreme skill, malware can jump the air gap. However, this requires a large degree of sophistication...

You mean the kind of sophistication that would lead advertisers to pay the source (hardware vendors) to plant this capability in hardware by default?

And that's just the power of money talking. Imagine what power governments could wield to ensure this technology is deployed across the masses, using the cause-terrorists-protect-the-children excuse.

It's hardly news anymore to find [popular app] putting a microphone into constant listening mode, along with all the other popular listening devices and services (Siri, Alexa, Google, et al) that millions of consumers use today. Now our "smart" TVs are app-enabled. Think we won't start installing microphones in televisions? Think again. It won't stop there either. At some point we'll be "talking" to an e-assistant for just about every smart device because ANY tech that allows a human to be as lazy as they possibly fucking can is HUGE these days.

Re:Lots of sophistication required here

[AmiMoJo]

Anyone using Tor should have Javascript disabled, which would completely mitigate this and most other attacks.

I'm not sure why Tails has Javascript enabled by default these days.

Re:Lots of sophistication required here

[Anonymous Coward]

I presume the capture device is a compromised phone - i.e. it's expected to use it's GPS to report it's position and that it heard ultrasonic signal number #532521.
Just write a script to report the signals as emanating from the Kremlin/Pentagon/Tehran every time you encounter one.

Re:Lots of sophistication required here

[Anonymous Coward]

At some point we'll be "talking" to an e-assistant for just about every smart device because ANY tech that allows a human to be as lazy as they possibly fucking can is HUGE these days.

That is farther off than you may think. Have you tried using Siri (or whatever) for real work - to actually save time? Too much mishearing, too noise sensitive, too much need to repeat/rephrase - so the lazy human types/clicks because that is faster.

A good digital assistant should be able to hear me telling a friend on the phone " ... and to turn off, I say 'Assistant, shutdown the computer!' ..." and NOT shut down the computer because it was merely a direct quotation. No AI is anywhere near that level of comprehension - and they're also too confused if there is a fan or a radio on in the room.

Re:Lots of sophistication required here

[ripvlan]

Yes - Facebook App for instance listens to the ambient sounds and you'll see the ads in your feed change based upon the words said. I saw this reported on a few years ago and couldn't believe it - so I tried it out myself and was very surprised when it worked. Granted that was a few years ago and I don't know if they still do it (too lazy to try it right now).

Which is why I have disabled audio Input for FB. Actually - it is why I do not allow access to the microphone from any app. Or terminate those apps when I'm not using them. Siri is the only thing that I believe is listening (and I have a watch too). For Apple to be sending back audio beacons would be a huge finding. The currently promise to only be listening under specific scenarios - a key trigger "Hi Siri" and only when plugged into power source.

FB / Google/ Amazon beacons do follow me across devices already. There's a Firefox plugin that shows your beacon propagating across the ad networks and draws a pretty network graph. I know - I've seen Amazon ads show up on my iOS FB feed...for items that I purchased on my laptop. I won't go into the usefulness of ads for already purchased items -- but they are tracking me across devices.

But - the multi-device case seems too brittle to work consistently. I appreciate raising the alarm. Now need time to digest and think about what it "really" means.

Re:Lots of sophistication required here

[geekmux]

At some point we'll be "talking" to an e-assistant for just about every smart device because ANY tech that allows a human to be as lazy as they possibly fucking can is HUGE these days.

That is farther off than you may think. Have you tried using Siri (or whatever) for real work - to actually save time? Too much mishearing, too noise sensitive, too much need to repeat/rephrase - so the lazy human types/clicks because that is faster.

A good digital assistant should be able to hear me telling a friend on the phone " ... and to turn off, I say 'Assistant, shutdown the computer!' ..." and NOT shut down the computer because it was merely a direct quotation. No AI is anywhere near that level of comprehension - and they're also too confused if there is a fan or a radio on in the room.

Although products like Dragon have been around for decades, one could argue the e-assistant era started with Siri, which is barely five years old.

Since then, there's been a LOT of advancement and proliferation across multiple devices and services, which have gained considerable popularity (such as Amazon's infamous listening devices selling out over the holidays), which only serve to highlight just how much humans have embraced convenience for the sake of security.

The lazy human will go so far as to turn off the fan or radio to ensure their precious lazy button works effectively. Bottom line is this tech is hardly "far off".

Re:Lots of sophistication required here

[Anonymous Coward]

However, this requires a large degree of sophistication.

Sure. But isn't the primary purpose of Tor to evade detection by sophisticated entities? Like no one uses Tor so their wife doesn't catch them looking at porn. People use it to break the law (justly or not).

Re:Lots of sophistication required here

[Anonymous Coward]

Ok ultrasonic garbage not only sounds like a fun project, but it also makes for an excellent band name!

How to block

[Anonymous Coward]

What devices/apps listen, and how do I disable them?

Re:How to block

[Anonymous Coward]

I'm pretty sure this is all theoretical at best. The headline says "could be" and then it'd require you to have one of the apps that would listen for this, assuming your phone was even capable of hearing it(and there's not much of a chance of that), and on and on and on.... Not a lot of anything supporting this. This sounds like that idiot who was claiming his airgapped computers were rooted even before he got them turned on kinda shit. And what have we heard about that guy? *crickets*, that's what.

Re:How to block

[stealth_finger]

What devices/apps listen, and how do I disable them?

All of them, a hammer.

Re:How to block

[allo]

The NSA even used a firefox zeroday. So you're better too paranoid.

Re:How to block

[naris]

Don't plug any speakers (or a microphone) into your computer. If you have a laptop with built-in speakers and/or mic, turn them off.

Speaker quality

[Anonymous Coward]

This requires both speakers and microphone that are capable of using that frequency range. How many actually are?

Is this theoretical?

[guruevi]

I understand this is theoretically possible but what speakers in these devices have powerful ultrasonic blasters? Unless they're doing some form of distance measuring, the majority of speakers is limited well under 18kHz with the response curve dropping sharply after that.

Re:Is this theoretical?

[Midnight_Falcon]

This! As somewhat of an audio engineer I know various speaker drivers very well, and laptop speakers essentially never have advertised frequency responses above 20KHz. And you're right, realistically, it's more like 18Khz with a steep drop off after 16KHz. Many people can hear 20KHz -- I've done tone tests and found I can hear up to 22KHz. So what speakers is this person using and what manner of computer has this kind of built in tweeters?

Re:Is this theoretical?

[Anonymous Coward]

If you are an audion engineer, you should know there is no way on earth you can hear 22khz. You MAY hear sub harmonics or modulation effects, however you cannot hear a 22 khz fundemental.
In reality, you are talking out of your ass.
I am a real pro audio engineer of 40 years experience, calling your post bullshit.

Re: Is this theoretical?

[Anonymous Coward]

Also, signal processing is cheap (we have an abundance of compute power). Doesn't matter that the channel has loss and distortion if you can still discern the signal of interest. Crappy speaker drivers and mics aren't going to stop this, though they will make it more computationally expensive to pull off.

Re:Is this theoretical?

[Anonymous Coward]

Not sure why you are calling it bullshit?
I have heard 60 Ketchup HeinZ (khz) go off at once, it sounds like a big-ass-fart, or (high velocity WIND if your not form the USA)

Re:Is this theoretical?

[F.Ultra]

And isn't there a cut-off filter in the DACs used by phones/computers to filter out anything above the Nyquist sampling rate? Or is that frequency so high now a days due to oversampling that it's in the ultrasound range?

Re:Is this theoretical?

[Cmdln Daco]

Said speakers don't need to have a 'flat' frequency response above 20KHz. They just need to be capable of emitting a detectable level. The speakers may be very inefficient, but quite capable of producing enough high frequency output to be detectable.

Re:Is this theoretical?

[Anonymous Coward]

fucking stupid much? dont breed.

Re:Is this theoretical?

[EvilSS]

This! As somewhat of an audio engineer I know various speaker drivers very well, and laptop speakers essentially never have advertised frequency responses above 20KHz. And you're right, realistically, it's more like 18Khz with a steep drop off after 16KHz. Many people can hear 20KHz -- I've done tone tests and found I can hear up to 22KHz. So what speakers is this person using and what manner of computer has this kind of built in tweeters?

You guys realize this is not some theoretical flight of fancy, right? It's being used today for ad tracking: http://arstechnica.com/tech-policy/2015/11/beware-of-ads-that-use-inaudible-sound-to-link-your-phone-tv-tablet-and-pc/

Apps using SilverPush

Re:Is this theoretical?

[hankwang]

What kind of audio source did you use to find that you can hear 22 kHz? Unless you have an ultra low noise analog sine wave generator and amplifier, you are likely to hear noise, artifacts of the DA converter, and effects of clipping when you crank up the volume. The stated limit of 20 kHz for the human ear is the frequency where the pain threshold and the hearing threshold coincide for an average young person, so it is likely that you need >110 dB SPL to have any chance of hearing above 20 kHz. A device with 90 dB S/N ratio will likely blast you with lower frequencies, which you could easily mistake for "I can hear 20+ kHz".

I did once fry the tweeters of my (60 watt rated) loudspeakers while trying to test the limits of my hearing as I was sending all amplifier output power to the tweeters.

Re:Is this theoretical?

[hankwang]

A modern dac is supposed to digitally filter at 20 kHz (very hard cutoff), in exchange for lots of noise above 100 kHz. A soft roll-off analog filter takes care of the content above 100 kHz.

I suspect that ultrasound in this context really means 16 kHz or so, at volumes that are too low for the ear, but easily picked up by a microohone and some signal processing.

Re:Is this theoretical?

[AmiMoJo]

According to TFA the range is 18-20kHz, with 75Hz bands that represent individual symbols. Most TVs can produce 20kHz sounds, and you probably wouldn't hear them. Even if you can hear a 20kHz tone over headphones in a quiet room, with the noise of a commercial mixed in and the audio played at low volume you won't notice.

I'm more sceptical that typical laptop speakers could produce such high pitch noises, but I guess for Tor attacks you could use lower frequencies. The TV ads need to work at a few metres range with background noise. Someone using Tor on a laptop is likely in a quiet room with their smartphone near by, and the main source of noise will be the laptop's fan and HDD.

Re:Is this theoretical?

[sociocapitalist]

"The inaudible code is recognized and received on the other smart device by the software development kit installed on it."

So the other device has to be compromised as well which at least complicates delivery of this attack to targets.

Although they claim:
As of April of 2015, SilverPush’s software is used by 67 apps and the company monitors 18 million smartphones.

Maybe true, maybe marketing.

Re: Is this theoretical?

[Anonymous Coward]

It's not a matter of processing power -- if a speaker + driver are not capable of vibrating at, say, 25 kHz, then there will be no signal to process.

Re:Is this theoretical?

[Anonymous Coward]

I think it's true. The compromise is undoubtedly via a trojan horse, i.e. disguised as some useful app people want.

Re:Is this theoretical?

[Anonymous Coward]

"Near"-ultra-sonic is what the article should say and what most papers and commercial products use.

Nothing special about it being specifically ultrasound. A ~17kHz 1-3ms duration blip would be unnoticed but entirely possible on cheap ass commodity hardware.

"Guruevi's cell phone just intercepted an audio beacon we put on https://alaakbar.onion./ 4Chan Party van dispatched." no fancy measurements, trigonometry trickery, or powerful hardware required.

Re:Is this theoretical?

[Anonymous Coward]

Which is why one can & should mute your speakers whilst browsing. I do and cannot possibly be reporting back to ad-servers.
As a matter of fact I...

[BZZZ - AD PROTOCOL - ACTIVATED - REALIZE - NO - SOUND - AM - NOW - SENDING - USER - AD - FOR - HEARING AIDS]

Re:Is this theoretical?

[bill_mcgonigle]

Right. Most people who 'hear' in the 20-28KHz range are picking up that their ear bones are vibrating a bit and that can get translated into sound but it's not real 'hearing' at the high frequencies.

For the vast majority of the population, there's plenty of bandwidth in the 12-16KHz range that speakers can reproduce and most people wouldn't discriminate from fan noise on the system.

Re:Is this theoretical?

[Anonymous Coward]

Dear SIR please RTFA. I know there are technical difficulties but seems like other audio engineers found ways around this problems you just mentioned. Just apply some curiosity and not only scorn on the problem.

Re:Is this theoretical?

[currently_awake]

It doesn't have to be ultrasound. The Sub sonic range is usable by machines but you won't hear a thing, or a signal in the audio range but at a low signal strength would work.

Re:Is this theoretical?

[Thelasko]

So what speakers is this person using and what manner of computer has this kind of built in tweeters?

TFA shows a picture of a MacBook Air. It figures that Apple would include speakers so fancy they open up a new attack vector.

I don't believe it either, but as other users have pointed out, this thing is already in the wild.

Re:Is this theoretical?

[Anonymous Coward]

facebook used to give me ads aimed to the deaf community.

Re:Is this theoretical?

[EvilSS]

They pay devs to put it in their apps, just like other advertising.

Re:Is this theoretical?

[RockDoctor]

Someone using Tor on a laptop is likely in a quiet room with their smartphone near by,

Since you're specifically talking about someone who is using Tor, I'll add the relevant FTFY :

with their smartphone near by, turned off, with the phone battery a metre or two away from the smart phone

I've never got a good answer as to WHY...

[Anonymous Coward]

explain to me why we even have browsers that allow javascipt to 'play audio' without permission in the first F***ing place?

The entire reason I started to use adblock in the first place (I 'theoretically' highly approve (both morally and economically, etc.) of ad-supported content) was because I worked phone support and could browse the internet while telling people to plug the cable back in and try rebooting.... and then I started to get NOTHING but flash ads that would play audio (while I was on the call) so I got firefox 0.x.x.x when it was released and got adblock plugin as soon as it was released.

To this day I still -want- to be able to allow ads.... but 3rd party ads are just too much of a 1) security risk 2) annoyance risk and 3) usability interruption risk (ads that redirect the page (especially on mobile)

and just wait.... HTML5 'all JS' pages will start to come soon (other than sites located in California which THANK the GODS has a law stating sites must be text browsable for usability (handicapped) reasons.... which ends up just helping everyone...

Re:I've never got a good answer as to WHY...

[Anonymous Coward]

Since you receive desired content on web pages, it is your moral obligation to allow the ads to play. They play sounds and display video to capture and hold you attention long enough for the message to get into your brain for processing, and paying attention to this is your end of the social contract built around ad-supported content.

Allowing the tracking is also obligatory on your part.

You can protect yourself from viruses and such by running such tools as McAfee antivirus, and also by keeping your browsing focused on the web portals of professional, on the up-and-up, well-established businesses.

This is how members of a civilized society comport themselves. If you don't like this, you are free to stay off the internet.

Ad blocking undermines the social fabric that keeps the modern world functioning, and so it is morally tantamount to terrorism. The only reason it isn't illegal yet is because the wheels of politics turn too slowly to keep up with tech. But rest assured, reprobate criminal parasites that block ads will be getting the punishments they are due before too long.

Better think this over. The future has no problem leaving you behind.

Re:I've never got a good answer as to WHY...

[Anonymous Coward]

But there is a permission to record audio https://developer.mozilla.org/...

Re:I've never got a good answer as to WHY...

[Anonymous Coward]

OH sarcasm....

Wait, are you being serious? By all the Gods I hope that was sarcasm.

Yes, the ad companies have a right to send the info to me. But I have as much right to block that same ad.

The internet was not created with advertisements. I've been using the internet a long time, (when it was just a connection between Collages and Universities,) even before there where any advertisers on it. Aside from that, if they think they have the right to blast an ad with the volume turned up to 11, and no way to turn the S%^t down, then I D@#m well have the right to block them.

so they're emitting tracking ultrasound :(

[strstr]

this is bullshit. a cop / law enforcement could use this to walk around and receive identity information without even needing to interferometry scan your brain/DNA/pocket book full of ID/credit cards/cellphone etc.

this also enables low tech citizens to perform the same feat. often times once a low tech person has info about you such as tracking ID, IP address, phone number, address, name, social security number, date of birth+location information, or email address they can take that to databases and find out mounds of information about you- basically all that data the companies have amassed about you, is retrievable with any identifiable information. NSA databases work the same way.

obamasweapon.com

Re: so they're emitting tracking ultrasound :(

[Anonymous Coward]

Given that law enforcement is supposed to stop people doing bad things, I wonder what the reason is for your paranoia.

The risk of criminal groups and advertising companies (that are legally trying to steal from you) far outweighs your irrational fear of the government.

Covert advertising that is not merely product placement should be illegal. All this tracking crap is completely unnecessary.

In my jurisdiction advertisers and mobile phone companies have more right to track you than the government. The simplest form of burden this causes you is adjustment to your credit rating. Or ver charging specifically to you. All that is completely unethical.

Removing the freedom of those who do harm to others, in my opinion is not, this is why most politicians and executives should be put in jail, because they are corrupt and evil. ;'-D LOL!

Re: so they're emitting tracking ultrasound :(

[Anonymous Coward]

is supposed to

If only there was some punishment harsher than "paid vacation" when they don't do what they're supposed to do.

Impractical

[Anonymous Coward]

This attack is not particularly practical in a real world setting, as it relies on other computers picking up on sounds being emitted from the anonymous computer. Knowing which computers are within listening distance of the anonymous computer implies that either the anonymous user's location is essentially already known, or else the listening program (malware?) has been deployed on an immense scale.

How does the receiver work?

[PatientZero]

I understand how ads could emit these sounds, but how do advertisers install apps on your device to pick them up and phone home? Is this capability built into iOS and Android, or do they work with handset manufacturers?

Re:How does the receiver work?

[PatientZero]

According to Mavroudis, the mobile phone must have an app installed that has embedded one of the many advertising SDKs that include support for uXDT.

I guess advertisers probably pay app developers to include the toolkit. I really hope it's not in the OS.

Re:How does the receiver work?

[bragr]

It is part of the advertising SDKs in some apps that you install from the app stores. The idea is that if the advertising network can link the tracking cookie IDs on your devices (e.g. sending a signal on your desktop and picking it up on your phone), they can build a better profile on you with more targeted ads.

Silverpush is one SDK that does that though there are several others. You can find some apps that use it here, though they are mostly junk apps: https://public.addonsdetector....

Re:How does the receiver work?

[ripvlan]

It isn't built into phones (that I know of) ... Do you have the Facebook App installed? Any "Rewards" apps? This is the channel they are using. Any apps that causes the phone to prompt "allow access to microphone" has the potential to do this. I believe that iOS apps can only listen when running in the foreground.

When you are creating a Post on FB - FB is listening for songs and TV/Movies. Think Shazam. If they recognize something they suggest a tag "You are listening to XYZ song" I swear a few years ago that I tried out saying "I really like Ford cars" and my ad feed changed. They claim this can't happen. Maybe I said Ford because they had an ad blitz and was top of mind - and made it to my feed around the same time by coincidence. FB "app is only listening while you’re writing a status."

Still - I don't allow FB access to my microphone. Even Skype is disabled - I enable it only when I use Skype. But Siri & my watch are of concern - I have to trust Apple. And as Mark Zuckerberg has said before : what are you doing that others shouldn't know about?

How is this even legal?

[Snotnose]

They're installing software I don't know about on my phone/laptop, then using that software to send personal ID details to unknown servers. This has to fall under at least one of the myriad hacking laws we already have on the books.

Oh, I forgot. They donate more to congressclowns than I do.

Re:How is this even legal?

[PhrostyMcByte]

They're installing software I don't know about on my phone/laptop, then using that software to send personal ID details to unknown servers. This has to fall under at least one of the myriad hacking laws we already have on the books.

If the FBI does it, yes. A law recently activated that lets them legally try to hack someone using Tor or anything else that could hide traffic (like, perhaps a VPN).

Re:How is this even legal?

[Anonymous Coward]

Explicit Fourth Amendment violation. Unless you have a warrant, you can't enable this as an LEO- doing so would get you in deep trouble and cost you your case.

Just because Congress passed a "law", doesn't mean that it's actually an enforceable "law".

Marbury v. Madison, 5 US 137

It should be noted that this is an un-overturnable decision, typically called a "Landmark Decision".

"Thus, the particular phraseology of the Constitution of the United States confirms and strengthens the principle, supposed to be essential to all written Constitutions, that a law repugnant to the Constitution is void, and that courts, as well as other departments, are bound by that instrument."

A law, in contravention of the Constitution, is VOID out of the box.

Re:How is this even legal?

[naris]

Because it's theoretical and not real (other than a proof of concept installed on the researcher's own computer)...

Save us APK!

[Anonymous Coward]

You're our only hope :(

Attack model

[manu0601]

This attack model assumes there is an app on the phone able to listen all time for ultrasounds. Obviously granting microphone access to an app is dangerious and should not be taken lightly.

Re:Attack model

[UnanimousCoward]

No it doesn't. You are at a cafe that has microphones installed at the tables for voice-activated ordering. That infrastructure, along with the GPS data that is constantly tracking you, pinpoints you...

Re:Attack model

[sconeu]

In a cafe, I'll either be muted, or be using earbuds/headphones

Re:Attack model

[EvilSS]

This attack model assumes there is an app on the phone able to listen all time for ultrasounds. Obviously granting microphone access to an app is dangerious and should not be taken lightly.

They already exist! Leave it to ad agencies to beat the government to the punch on tracking out lives. Best part is we stupidly agree to it (or just don't read the fine print when installing some crap app on our phones)

One thing iOS does that I wish Android did is they way they handle applications using the microphone. Not only do you need to grant mic permissions, when an app uses the mic, the status bar changes color, continuously flashes if the app is in the background, and it adds a banner under the status bar that tells you that the mic is in use and what application is using it. There is no hiding that an application is trying to listen to the mic.

Re:Attack model

[wvmarle]

This attack model assumes there is an app on the phone able to listen all time for ultrasounds.

TFA suggests that this even is the case for many phones already: they say many advertising APIs (which programmers simply link to in order to get ads in their apps) already include ultrasound listening options. This is supposedly yet another way for the advertisement provider to get more information on individual users, in this case by linking separate devices as belonging to the same user.

Audio compression?

[scorp1us]

Why is ultrasound being preserved in compressed audio? Unless they are hinging on uncompressed au or wav formats?

Re:Audio compression?

[Jbcarpen]

They might not be sending any audio at all. A software signal generator capable of producing only a single tone (or maybe two tones if you don't want to use silence as one of your bit states) is not complex.

Re:Audio compression?

[Anonymous Coward]

They specially craft the files obviously. It's nontrivial but it's not like they rely on normal mp3's to do this anyway.

However one thing nobody seems to have noticed yet as of 5:50 pst is that this all relies on javascript implicitly.

Re:Audio compression?

[Locke2005]

CD quality sound is sampled at 44.1Khz, so it's only capable of faithfully sound that IS audible to the human ear (about 20Khz). Who builds systems capable of accurately reproducing sounds that humans cant here? That seem pretty pointless.

Re:Audio compression?

[Orgasmatron]

The flippant response is that there is a large and lucrative idiot market out there, and someone was bound to go after it sooner or later.

The better answer is that we have two ears. By limiting audio signals to the hearing range of a single ear, we lose the ability to capture and reproduce subtle phase information. This is an unexpected side benefit of the 48k audio being sold to the morons mentioned above.

Re:Audio compression?

[RockDoctor]

Who builds systems capable of accurately reproducing sounds that humans cant here? That seem pretty pointless.

To quote a song of about 1960,

"All the highest notes, neither sharp nor flat,
The ear can't hear as high as that!
Still, I ought to please any passing bat.
With my HIGH FIDELITY

(I'm not sure where the "sharp nor flat" thing comes into it. I've never understood those terms despite both piano and music teachers trying to beat the idea into me.)

bandpass filters to the rescue

[Anonymous Coward]

Yesterday security boiled down to installing virus scanners, firewalls, patching applications, adding add-blockers and no-script tools to browsers and email clients.

Now I have to add a filter to my drivers for the microphone and any speakers? What about HDMI "protected" content paths? What's to keep Disney from embedding a 'display more Disney ads' to the soundtracks on their DVDs?

(Also, how does this work if you use headphones? Will the sounds make it out?)

Re:bandpass filters to the rescue

[Anonymous Coward]

Yes, that is a huge disadvantage of DRM - you can't easily get rid of this sort of thing. You can put filter circuit on your speakers though, that short circuits "too high" frequencies.

Still, adblockers help a lot. For me, they gets rid of tracking to such an extent that I get generic ads only unless I turn the blocker off. (Then I get computer parts...)

/. is getting slow with actual news

[bussdriver]

Clearly, this is now a problem with all the always-on listening devices that are now becoming wide spread! Barbie dolls that listen, Google, Amazon are listening all the time.

Then you have permissions given to websites, apps on other devices plus security holes for when permission is not given. Don't forget company policy changes which can turn allowed permissions against you without your knowledge (unless you are a lawyer and read updated user agreements... many which are broad and vague already.)

So now Google and Amazon know even more of what is going on in the house and can link your devices. Furthermore, they can link you to PEOPLE who come within range of the microphone. Your associations can be analyzed which means the NSA is going to use it (do you really believe they haven't forced their way into these systems somehow already?)

Google watch could notify where you are moving around which could provide their assistant context information to better understand your speech. They might have some useful things to do with it, I can't think of any so far where bluetooth couldn't do it better and more likely with our knowledge..... but would something less covert really matter if they did the same stuff? people don't seem to care.

Re:/. is getting slow with actual news

[Anonymous Coward]

Now if more people lived like this...

Then marketers would target this behaviour and you'd lose your opportunity for smug self congratulation.

Re:/. is getting slow with actual news

[Anonymous Coward]

The biggest threat to your privacy has always been the corporations running the web search engines and running the web services such as Facebook and Twitter. These two examples along with the search engine leaders derive almost their revenue through advertising. Google is an advertising company who just happens to use leading edge technologies to maximize their advertising revenue.

Coming in a close second place are the criminals who are always two steps ahead of everyone else when it comes to finding and using exploits to cause havoc. The companies selling your information and the criminal elements are pro-active. The information they collect or gain access to is used for both legal and illegal purposes.

The intelligence agencies have no reason to use any of the data they collect or have access to until they target specific individuals or groups. The US intelligence agencies are a necessary evil used to counter threats to the country. That is their mandate. These agencies do not have unlimited resources or personnel which means they need to apply their resources to specific targets. The NSA has enough on their hands trying to deal with all the threats China, Russia, NK, Syria, Iraq, and Iran represent. The US is the number one target for every foreign intelligence service in the world. US political, military, industry, and individual citizens are all target rich environments. Even countries claiming to be US allies spy on the US. So anyone upset about US foreign intelligence operations can go fuck themselves.

Re:/. is getting slow with actual news

[Cmdln Daco]

If you have children, be careful, because they might kill you in your sleep.

Re:/. is getting slow with actual news

[Anonymous Coward]

If you have children, be careful, because they might kill you in your sleep.

Well duh. He is a Tor-using pedo after all.

Re:/. is getting slow with actual news

[Anonymous Coward]

...Marketeers are openly told off when needed.

Wow.... that must stop them in their tracks.

Re:/. is getting slow with actual news

[Anonymous Coward]

It's not as rare as you might think.
We have 4 laptops with Xubuntu 16, 1 desktop with Arch, 2 desktops with Xubuntu 16, and 3 Synology servers each with a Linux-based OS. We also have a router with OpenWRT and a 100/100 Mbps fiber connection. All browsers use Scriptblock, uBlock Origin, and HTTPS Everywhere (among others). Windows 10 is not allowed (actually, all versions of Windows are forbidden). We have no TV in the house, we do have a radio, but it's almost always not switched on.

Re:/. is getting slow with actual news

[allo]

it isn't slow, but there was a recent presentation at the big hacker event in hamburg, bringing up the topic again.

Re:/. is getting slow with actual news

[Anonymous Coward]

Local ad-free radios are great, but this is a very local thing. Want "no nattering fool announcer, no ads"?, get involved in some local non-profit FM station if that's a possibility at all in your area.
TV, it's full of crap. But I think I'm going to listen to TV back again after a 10 year hiatus. I will try to watch things not too crappy, there's even the EPG Guide over broadcast TV which didn't really exist back in analog days. Why? because the tech is so obsolete, I can't be spied on.
I wish had the money to buy newspapers etc., some of them are not crap (but all daily newspapers are), this varies by country too. Because reading loads of paper is quicker, better, more comprehensive than scrolling a small video and clicking on shit, and I can't be spied on.

That said I'm doing all what you do and STILL worry about all the unknown databases I'm in.

Re:/. is getting slow with actual news

[Anonymous Coward]

"than scrolling a small window", I meant. But either way, it's scrolling a video screen, even though most of it is text.

javascript. fully stop. details don't matter.

[Anonymous Coward]

JavaScript code

Stop right there. That's all you have to say.

If you're trying to be anonymous and then letting unknown untrusted parties run scripts on your computer, you are (a) a colossal idiot, and (b) not actually anonymous at all. This is one of about a thousand ways to de-anonymize you. The details hardly matter: if it's not this, it's the next, or the next.

Turning javascript off by default is a good idea even if you are NOT trying to be anonymous, due to the endless stream of exploits it has enabled, but especially when you are trying to be anonymous, don't run that shit!.

I don't know who they're going to catch with this.

[h33t l4x0r]

I Tor with javascript disabled, and I'm not even a pedophile / drug dealer.

posible but not practicle

[Anonymous Coward]

not to mention every device would need adaption or maleware. like a phone home and identify the unique sound signal and tie it to the individual via adoption route by tying it to the email you use and any other data they have from accounts. the malware log lots of info and phone home. ip and towers and more exact location via gps.

Thanks Audiophiles!

[Anonymous Coward]

I guess gearing up everything to be capable of "high resolution" audio wasn't a total waste after all!

Re:Thanks Audiophiles!

[Locke2005]

That's the other restriction: it relies on ads being played on audio systems capable of generating frequencies higher than 30KHz at energy levels high enough to be detected by a device with a microphone capable of accurately picking up and digitizing frequencies above 30KHz. Possible, but not really the global norm yet. In fact, pretty much only works on rich people, doesn't it?

Detectors and Countermeasures

[AlienSexist]

Certainly the ads have no idea if there is a device listening for them and will broadcast anyway. I suppose ultrasound detectors could detect the activity. Maybe you could spam with some conventional source of ultrasound to drown these devices with indecipherable noise. Or just the network approach, whatever.

PC speakers can't emit 'utralsounds' nor can

[Anonymous Coward]

phones' mics capture ultrasounds. This is not even nyquist at work (which of course trumps everything, but let's play along with this ULTRA! nonsense) since these transducers are not physically capable of reaching 'ULTRASOUND'.

Re:PC speakers can't emit 'utralsounds' nor can

[allo]

Maybe you should watch the presentation recording.

Huh?

[Locke2005]

That relies on people being stupid enough to leave compromised apps running on a machine with a microphone, and only tells you what broadcast coverage area the user is in... it's not like it narrows the location down that much! If you've got a compromised app constantly sending data over the internet, wouldn't it be easier to just trace the IP packets back to the source?

Re:Huh?

[Cmdln Daco]

The compromised app doesn't send a constant stream of data over the internet. It sends a very short burst of information infrequently.

And the compromised app is located on anybody else's device within hearing range.

Defense: Unplug speakers or headphones

[gweihir]

Can't do that because you are on a laptop? Too bad, you are screwed.

Re:Defense: Unplug speakers or headphones

[EvilSS]

Can't do that because you are on a laptop? Too bad, you are screwed.

Stick a 3.5mm plug into the headphone jack. solved.

Re:Defense: Unplug speakers or headphones

[locofungus]

Stick a 3.5mm plug into the headphone jack. solved.

I'm not convinced - on my galaxy note at any rate - that this is guaranteed to work.

I've noticed that when I push the plug in, it detects the plug being inserted and then switches the sound from the internal speakers. I'm not convinced that, unlike old fashioned radios, inserting the plug physically disconnects the internal speakers.

But I could be wrong - it's something I've noticed in passing rather than something I've been looking out for.

Re:Defense: Unplug speakers or headphones

[Anonymous Coward]

Mute tab in browser should also help, if javascript must be on.

Re:Defense: Unplug speakers or headphones

[gweihir]

Nothing depending on software is secure here. Remember that this is an attack, and while the required zero-days my initially only be available to nation-state-level criminals, they often become the tools of other hackers pretty fast.

Re:Defense: Unplug speakers or headphones

[gweihir]

Unless that is done by the firmware of the sound-chip. Then it may be possible to hack it. Have you verified this?

Re:Defense: Unplug speakers or headphones

[allo]

on laptops it is not. You can activate both speakers and headphones in the mixer. Maybe not (that easy) on windows, but on linux there is no problem. It's a feature, not a bug.

Re:Defense: Unplug speakers or headphones

[Anonymous Coward]

In hindsight, I wonder if this is why Apple had the 'courage' to remove the headphone jack. They already had the 'courage' to stop using removable batteries, so you could no longer shut your phone off completely if you wanted to have a private conversation.

Re:Defense: Unplug speakers or headphones

[EvilSS]

Unless that is done by the firmware of the sound-chip. Then it may be possible to hack it. Have you verified this?

If it's possible for a bad actor to override it, they already own your laptop and don't need to use this kind of trick to find you anyway. A web ad with embedded ultrasonic beacon won't have the level of system access to do it, which is what we are talking about here.

Re:Defense: Unplug speakers or headphones

[EvilSS]

on laptops it is not. You can activate both speakers and headphones in the mixer. Maybe not (that easy) on windows, but on linux there is no problem. It's a feature, not a bug.

Yes but a web ad using an ultrasonic beacon won't have access to do that. If it did, you're owned anyway so what's the point.

Re:Defense: Unplug speakers or headphones

[gweihir]

Not necessarily. First, attacking the sound-chip firmware may not even need a compromise of the rest of the system and may be doable with user-rights only or by getting the user to install a compromised driver, possibly for an entirely different component.

Now assume, for example that the attacker changes the firmware of your soundcard at some time, say to let frequencies >= 20kHz always through to the speakers, but behave normal otherwise. Then the user boots Tails and the machine is in a non-compromised state (well, except for said sound-chip). The web ad can then use the beacon successfully.

The whole thing is an attack on a very high difficulty-level. Simplistic countermeasures will not cut it.

Re:Defense: Unplug speakers or headphones

[EvilSS]

If they are in a position that they can attack the sound-card firmware, they have the access and skill to own the machine hands down. There are far easier ways to get your identity at that point. The whole point of this exploit is that it can be run via the browser using embedded ads when other methods fail. It's an exploit that can be used without needing to actually exploit the PC itself.

Re:Defense: Unplug speakers or headphones

[gweihir]

Have you really overlooked that this is a 3-phase attack? If so, you do not have what it takes to even comment on this competently.

Re:Defense: Unplug speakers or headphones

[EvilSS]

Of course not, but it makes no sense. If the goal is to deanonymize a user, and I have access to their machine to flash firmware on the sound card, then I have all the access I need to deanonymize the user without jumping through that hoop in the first place. If I am able to run arbitrary code there are plenty of ways, much easier and more accurate ways to do this. Hell just pulling access point MAC addresses from the WiFi card would work without jumping through all the hoops you propose.

I'm not saying it's not possible, but it's overly complicated for no good reason. All you need to make it perfect is a sign for free bird seed and a obsessed coyote.

Run Tor in a VM without audio support

[aNonnyMouseCowered]

A relatively simple, if not 100% secure solution. Download your favourite anonymizing live USB distribution and run it under a virtual machine with only the bare minimum of media support (e.g. disable any virtual sound card option). Enable at most a generic VGA video driver using a resolution different from your default monitor aspect or resolution. Run the browser with ad-blockading software and JavaScript white-listing only. The attacker will of course realize of course that you're using a VM.

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

Or the simpler solution: Recognize that the claim (s) bring made here are PHENOMENALLY ridiculous. Even if the coupling was 100%, so what? You can't just emit a sound and cause my computer to do anything. There would have to be special software running on the target system that was listening. In other words it is the classic "I could break into your computer, but first I need admin access to it".

Re: Run Tor in a VM without audio support

[Anonymous Coward]

yea, because a dozen android apps and android games don't do that, let alone Android OS itself. I track my router outbound TCP everyday and there are like 9 connections to Google, 4 to Microsoft, 5 to Apple. I don't know what those connections were but they slow down my internet connection and I always reach my ISP data cap of 3GB per day even without watching youtube nor dloading Linux torrents. No special software installation is needed on the listener device, because it's already there.

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

I just barely use 3 GB with of data in a month and I DO watch videos sometimes. You are either completely full of shit or your phone is infected.

Re: Run Tor in a VM without audio support

[maxm]

It is not far fetched at all! Chromecast has already offered my phone to recognize it via sound via the chromecast app. So it is already implemented as standard practice. There is no bottom to the depths ...

Re: Run Tor in a VM without audio support

[Anonymous Coward]

This.

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

Again, unless your system is compromised it doesn't work. You *CANNOT* compromise a system with this technique.

Re: Run Tor in a VM without audio support

[Anonymous Coward]

mod parent down.

Re:Run Tor in a VM without audio support

[GameboyRMH]

That'll work but it's overkill. This particular technique can be defeated by muting audio at the OS level - even just for the browser.

Re: Run Tor in a VM without audio support

[Anonymous Coward]

You do not need to compromise the target's system for this to work, nor do you need access to the microphone. You should probably reread TFA.

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

Or I could use common sense and not be a moron. I realize that isn't an option for you though.

Re: Run Tor in a VM without audio support

[Anonymous Coward]

I don't think you get to call someone a moron when they point out that you fundamentally misunderstood the discussion you're having. I know these threads tend to attract a lot of armchair experts, but as a security professional, I can tell you that reading and understanding the technical details carries a lot more weight than name-calling. I suggest you do your homework. Have a nice day.

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

Get back to me when you get the skills needed to create an account.

Re: Run Tor in a VM without audio support

[Anonymous Coward]

Could you let us know what company considers you a "security professional" so we know what company to avoid dealing with at all cost?

Re: Run Tor in a VM without audio support

[Anonymous Coward]

I know you're wrong. At this point, I think you've probably clicked the article, and realized that you know you're wrong, or you'd be talking facts and not namecalling. I'll just accept my victory and leave it here. :)

It won't work but I'm sickened and impressed

[Anonymous Coward]

Couldn't browsers defeat this fairly easily by muting tabs by default and notifying you when one wants to play a sound?

Re:It won't work but I'm sickened and impressed

[allo]

The browser isn't the only attack vector. Imagine, you download a message from snowden as video via tor (okay okay ...) and watch it with sound on your pc. The NSA inserted a ultrasound-id in YOUR download and your phone receives the id and reports its IMEI to the advertiser, which cooperates with the NSA.

Wouldn't it be more cost-effective . . .

[mmell]

. . . to just station an observer within line of sight of your monitor? Or tap the stray EM coming off of monitor, keyboard and mouse? Or physically tap your hardware? Or ensure you've bought pre-compromised hardware? Or . . .

Alternatively

[ceoyoyo]

Alternatively you could just have an ad that screams "hey, this evil hacker is using evil hacking tools!" at full volume.

I certainly leave the volume on my computer turned up nice and high when I'm browsing questionable content in public.

So this is why my ...

[CaptainDork]

... dogs bark during that goddam Weight Watchers commercial!

Quick fix

[MrKaos]

Plug headphones into laptop. Alternatively, get some old headphones, chop the jack off and plug that in.

Bourne Movie?

[irrational_design]

Didn't I see this in the last Bourne movie? And here I thought that was just they typical Hollywood tech cluelessness.

Wait!

[invictusvoyd]

Javascript on Tor ?

Re:Wait!

[fisted]

Tor is transport.

Re:Wait!

[Anonymous Coward]

Sure, but if you use tor for stuff that could make people able to perform that attack want to find you, you are stupid if you didn't deactivate javascript first.

Re:Wait!

[ninthbit]

My thoughts exactly.... Plus, why would I have sound unmuted. That's just asking for a bunch of porn ads to start blasting out moans and that hot married women near me want to bone.

Yes, the technique has a degree of merit in that it may work, but it's another one of those solutions that will only catch the dumbest of the dumb.

Re:Wait!

[peawormsworth]

Stupid is designing a secure operating system around Tor and then provide a browser where javascript is enabled by default and the home page is pre-set to call home (open the OS homepage). But don't worry, they do this to simply collect general non-identifiable statistics about their users.

Re:Wait!

[invictusvoyd]

+1 insightful

Physical removal

[Anonymous Coward]

Who lets the built in microphone and speakers be in their "secure laptop" or tablet?
You open the box and remove them when you get the computer.

Non-problem?

[bradley13]

I wonder, though: how many people surf with their sound on? Most people I see (granted, not a representative sample) either have headphones or have the sound off, so as not to disturb everyone around them. If I were surfing something via Tor, i.e., sensitive, then I'd be double sure not to have publicly audible sound.

The worthless power of Privacy Advocates.

[geekmux]

"Advertisers use uXDT in order to link different devices to the same person and create better advertising profiles so to deliver better-targeted ads in the future"

If any citizen were caught deploying this kind of tech to electronically profile the masses, they would be labeled a terrorist and locked up for life. But hey, spend a few hundred and file your questionable activities under a corporation, and it's ALL good! What a fucking joke of a loophole.

I swear, reading about shit like this makes me wonder what power privacy advocate groups really wield anymore.

Who surfs the web with the sound on?

[Threni]

And why? It'll just be ads and auto-start-playing videos, and who wants them?

Active content in browsers can be used, news at 11

[Anonymous Coward]

The elephant in the room is a program in my computer executing arbitrary code off the 'net.

I know most of you are in denial, because you are web designers and WEB 2.0! Shiny!, but that's why Javascript, Flash, ActiveX and all that is a bad idea. We are having the typical arms race between sandboxing and exploiting of yet-uncharted crevices, no end in sight.

Granted, sometimes an image format has an exploit, but it's much more difficult to control something that is *designed* to be Turing-complete and where manufacturers are always pushing for it to "see" more and more of your computing environment: Sound? "There you go!" USB access? "But we need that to talk to cryptographic tokens!" Video hardware? "Look at this cool trick!".

Seeing even free browser folks dazzled by this, I can only weep.

"Ah, but with Rust all will be well". Thankyouverymuch.

Sometimes glad I'm so old I'll only see two more rounds of this shit. It's becoming boring.

I could see this used for the Amazon Echo

[BlueCoder]

Also the XBone.

Other than that how many other apps keep microphones open and recording?

And not so much hackers as they are paranoid. But it would be a good tactic for finding and tracking Journalists.

Journalists can be quite dim; just look at the one that released his key for the the Manning data in a book.

Anonymity is Wrong Strategy. Data Obfuscation!

[Anonymous Coward]

Nature doesn't evolve "invisible" creatures. It evolves spots and stripes, camouflage. Tor will never take off because it compromises too many useful cookies, and most people don't have time to worry about tracking. Antiphorm was a very useful program which randomized searches etc., so that your actual data became a needle in a haystack. That's what really alarmed Google and Facebook etc... False positives. Cookie Camouflage... If I appear to be interested in minivans and pickup trucks (through automated false searches), they won't know I'm actually really shopping for a motorcycle. I wonder whatever happened to antiphorm and antiphorm lite? Did Big Data kill them? Can anyone suggest an alternative?

Oh wait, Slashdot's also paid for by advertising represented as targeted to our actual interests...

Re:Anonymity is Wrong Strategy. Data Obfuscation!

[Anonymous Coward]

http://retroworks.blogspot.com...

Could this be circumvented by...

[wardrich86]

Could you not just create a program to run that pumps out a bunch of random ultrasounds? It could flood the environment and make the original ultrasound signal impossible to discover, no?

Re:Could this be circumvented by...

[retroworks]

Who killed antiphorm, and why can't I seem to post a /. comment referring to it? https://www.cnet.com/news/rand...

Missing the obvious?

[folderol]

I don't have speakers on my computer, and the external amp is only on when I want to listen to music.

Insufficiently paranoid?

[jenningsthecat]

I would have thought that anyone serious about using Tor, would also be savvy and suspicious enough to have data turned off on their smartphones and tablets when it's not being used. I don't even use Tor, but WiFi and cellular data on my phone are turned on only when I'm browsing or emailing. As for computers, any cameras are taped over, and microphones are unplugged, or, in the case of a laptop, muted.

Link to 33c3 wrong

[Anonymous Coward]

Hey, you linked to the subtitle project, here's the actual recording

These claims grow more and more ridiculous

[Anonymous Coward]

I'm all for security researchers doing their thing and exposing vulnerabilities, but things like this always seem a little far-fetched.

Anyone who's willing to go to these sorts of lengths to deanonymize someone would likely already need a specific target in mind, at which point isn't it just easier to...I dunno, lie? Any group that'd willingly pull off some of these "vulnerabilities" likely has the resources to falsify any evidence they might have hoped to collect in the first place.

Personally, stuff like this is interesting but it always comes off to me as a somewhat desperate attempt to just find literally any hole in a system, no matter how obtuse and impractical it might be.

Is this even real?

[ripvlan]

I read a similar article several days ago and came to the same conclusion that you did - this is very sophisticated. Maybe too sophisticated. Which made me wonder whether this is theoretical "in the lab" by researchers or actually out in the wild. As for dogs hearing it? sure - maybe. There are lots of noises. My furnace fan makes a blowing air sound. I don't howl because of it - it's just annoying white noise that I ignore.

Need a Raspberry Pi project to listen for this. Then becomes a keyfob that you carry with you that blinks when these secret US signals are detected.

At the time I wasn't able to find links to the actual work - just blog posts that circularly reported on this subject from each other. The quote "ultrasound cross-device tracking (uXDT), [..]. deployed in modern-day advertising platforms" -- really? like what and who?

The link to c3subtitle.de has vague statements in it too "newly-founded company faced the nemesis of the security community and the regulators (e.g., the Federal Trade Commission)" Really? Who?

The underlying premise that I have a phone near my computer that is listening to a beacon played by Ads seems incredulous. The idea that an ad agency would go to these lengths for such a brittle system is surprising. It would have to work "often" to pay off --- and for what gain that GeoIP doesn't provide today? What is that extra 1% that they are after? Plus in this day of auto-playing videos I have my audio muted (or headphones plugged in) - which I think many others do as well - or at least the volume is low. This again closes the door from an ad viability perspective. I get that advertisers want to link my laptop to phone to tablet together so that they can track Me! But there are other ways to do this already (FB beacons for example) that aren't as brittle.

While I appreciate Raising the Alarm - I doubt that (say) Google Ads is doing this. Sure -- maybe some govt spy agency is using this technique to spy on people (i.e. break through Tor). Yes I believe that. If I was a criminal I'd wrap my head and devices in tinfoil.

I'd like to see more evidence that advertising networks are actually doing this.

Re:Is this even real?

[ripvlan]

and I forgot to mention Tor. Sure wanting to uncover people is interesting. But do advertisers believe there are enough people using Tor to invest and develop this technology - that the target audience is big enough?

Maybe a feedback loop on the same computer. A Tor ad playing and the computer listening to send it back through non-Tor channels. But that also assumes a computer has been compromised with an app that can listen. How many people have installed a Time Sync app? Fake/Hacked Java or Flash does not seem tactics of an advertiser --- maybe one selling fake drugs. But again - sounds more like the goal of a hacker and not an advertiser.

Why???

[Impy the Impiuos Imp]

These second-stage devices, who silently listen in the background, will interpret these ultrasounds, which contain hidden instructions, telling them to ping back to the advertiser's server with details about that device.

Why are people not in prison for this?

Re:Why???

[currently_awake]

There are 2 sets of rules: #1 for the rich and #2 for everyone else.

US-emitting tabs.

[DrYak]

Even if some pages emit ultrasound - others will play sound and remind me to always mute.

And the default behaviour in firefox is to display a small "speaker" icon next the title of any tab that plays audio.
You can cut the audio off simply by clicking on the icon.
On android, the non-focused tabs don't even play audio by default (it's not possible to listen to music in a background tab).

Even if some PCs emits ultrasound, who will leave a mic on and run receiving sw? Not me, for sure.If this gets popular, muting the mic will be standard . . .

The thing is : YOU might not be in control of the mic (that does the recording).
The whole point is locating YOUR laptop. So by definition, the mic that is doing the recording is on some other hardware.

- That could be hardware purposefully left to record.
- That could be the smartphone of some other user who's a lot less carefully than you (has a mic and location service both available, and currently abused by some random JS ad)
- That could be the government. (In some phone, the portion of the radio chipset that is not under your personal control is able to record audio and position. Happens in some Qualcom SoC, where the radio chips works as a kind of "north bridge" to the rest.
If mandated correctly, the information services of a country could remotely start to eavesdrop on whatever the phone is hearing around - as long as the radio chip is within range of a cell tower).

Re: US-emitting tabs.

[Anonymous Coward]

GMs OnStar system in-car-communication platform has been capable of eavesdropping since at least 2003. It was derived from a military program started by Hughs, which was owned by GM at the time.

Re:javascript. fully stop. details don't matter.

[Anonymous Coward]

That is nice, but there is a trend right now to rely on javascript to render the page instead of server supplied html. Each day more and more sites become unreadable unless you turn javascript on.

Isn't that illegal

[Anonymous Coward]

Isn't that similar to illegal eavesdropping? They are recording you without your express permission. Could be a class action law suit in the making.

Why ultrasound?

[Anonymous Coward]

just have the app on the phone listen to certain phrases, jingles used in a tv-commercial.

Ridiculous

[Sperbels]

This is a ridiculous over thought bond movie gimmick of a threat.

How the f...?

[Anonymous Coward]

Wait a minute. How would an instruction to dial be sent over ultrasound frequencies to a device that doesn't have code to interpret the sound as instructions in the first place...?
AAAUUURRRGH! Now my brain hurts.
Bad science reporting. Bad! Bad! Go die in a hole.

Block ads & trackers most efficient way

[Anonymous Coward]

Natively via NEW APK Hosts File Engine 9.0++ SR-5 32/64-bit https://www.google.com/search?...

Ads rob speed, security (malvertising) & privacy (tracking).

Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.

Works vs. caps & PUSH ads.

Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.

Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.

Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).

Gets data via 10 security sites.

APK

P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )

Re:javascript. fully stop. details don't matter.

[Anonymous Coward]

I don't think I even really know how to read Slashdot at -1 with javascript off.

Re:javascript. fully stop. details don't matter.

[michael_wojcik]

Sigh. Disabling scripting does not magically remove the uXDT covert channel.

The HTML5 Audio API does not require Javascript. A server is perfectly capable of sending a unique uXDT audio signature to each user agent, and tracking using session cookies, hidden form fields, query-string parameters, "ultracookies", and other mechanisms.

Yes, if you put bars on your windows, you make it harder for burglars to enter that way. And if you leave the door open, they won't have to.

And, as other people have already noted, many sites don't work at all if scripting is disabled. Sure, that's obnoxious, and the people responsible will no doubt end up in a special new circle of Hell. And sure, some users can get by without any of those sites. But others - including, say, people who are trying to anonymously use social-networking sites to report on the activities of repressive regimes - may have good reasons for needing to enable some scripts (which, with typical whitelisting blockers like NoScript, means "scripts served by some domains"). That gets technically complex quite quickly. Not everyone who needs online anonymity has the opportunity to become a web security expert.