Ultrasound Tracking Could Be Used To Deanonymize Tor Users (bleepingcomputer.com)

New submitter x_t0ken_407 quotes a report from BleepingComputer: Ultrasounds emitted by ads or JavaScript code hidden on a page accessed through the Tor Browser can deanonymize Tor users by making nearby phones or computers send identity beacons back to advertisers, data which contains sensitive information that state-sponsored actors can easily obtain via a subpoena. This attack model was brought to light towards the end of 2016 by a team of six researchers, who presented their findings at the Black Hat Europe 2016 security conference in November and the 33rd Chaos Communication Congress held last week. Their research focuses on the science of ultrasound cross-device tracking (uXDT), a new technology that started being deployed in modern-day advertising platforms around 2014. uXDT relies on advertisers hiding ultrasounds in their ads. When the ad plays on a TV or radio, or some ad code runs on a mobile or computer, it emits ultrasounds that get picked up by the microphone of nearby laptops, desktops, tablets or smartphones. These second-stage devices, who silently listen in the background, will interpret these ultrasounds, which contain hidden instructions, telling them to ping back to the advertiser's server with details about that device. Advertisers use uXDT in order to link different devices to the same person and create better advertising profiles so to deliver better-targeted ads in the future. The attack that the research team put together relies on tricking a Tor user into accessing a web page that contains ads that emit ultrasounds or accessing a page that contains hidden JavaScript code that forces the browser to emit the ultrasounds via the HTML5 Audio API.

Comments

Just when you thought

[waspleg]

ads couldn't be any fucking worse...

Re:Just when you thought

[Xenographic]

What are ads? I haven't seen them in so long that I forgot.

Good to see some real info on hacking on here for once, even if it's a bit dated. I was getting sick of talking about phishing scams and the idiots who fall for them.

Re:Just when you thought

[Leslie43]

Never, EVER say it couldn't be worse, because someone or something will prove you wrong.

Enjoy your bios rootkit now that you jinxed yourself.

Re:Just when you thought

[simplypeachy]

I try only to comment when I have something thoughtful to add, but decided I had to comment despite myself this time. You summed it up nicely. Those advertiser scum could barely be any worse. These is some of those most obtrusive, obscene and despicable ideas yet. They might as well video record me taking a shit and use the colour and texture of my faeces to determine which food or vitamin pills they're going to force down my gullet when I next pause between breathing. Breathtakingly despairing.

Re:Just when you thought

[simplypeachy]

When I use other people's computers to use the Internet...good god it's like I'm in some sort of fledgling Total Recall. So many of the adverts have reached past the threshold of being parodies of themselves, they seem like their own self-satire. The relevancy or attention span of any amount of text is reduced to almost nil by pictures of mostly-naked people on diet pill adverts, shiny shiny motor vehicles with angry-looking grilles or hilarious gambling animations. There is a massive joke that you and I are not seeing, and that's because we're not suffering the expense of being the butt of the joke that is Internet advertising.

Re: Just when you thought

[ememisya]

The browser could simply ask the user, "Allow access to audio API from script.js"? Seems like this was probably already a great idea so that you couldn't make a browser moan for the entire Starbucks to hear.

Re:Just when you thought

[jenningsthecat]

When I use other people's computers to use the Internet...good god it's like I'm in some sort of fledgling Total Recall ...There is a massive joke that you and I are not seeing, and that's because we're not suffering the expense of being the butt of the joke that is Internet advertising.

Hear, hear! If the majority of unsophisticated users could see our browsing experience for just one day, and then understand how easy it would be for them to have the same, I think a large portion of Internet ad revenue would dry up overnight.

I'm of two minds on this. On the one hand, I'd like everyone to experience the Web without ads. On the other hand, I'm grateful that they don't, because their acquiescence allows me to avoid ads without taking heroic measures.

Re: Just when you thought

[squiggleslash]

That might have worked once upon a time when we had simply Javascript scripts that were more or less self contained. Today you'd almost certainly get a bunch of "Allow access to audio API from cdn.google.com/oneofthreepopularplayers.js?" type requests coming from both legitimate applications and ads. At best, you'd have to include the equivalent of a stack trace within the dialog (oh! So opendashplayer.js is being called by honestads.ru huh? I'll block that!), but then you're making the dialog way more complicated. ("Always block audio by opendashplayer.js / Always block audio by opendashplayer.js called by honestads.ru / Always block audio by opendashplayer.js called by honestads.ru called by thissite-insert-ads-from-partners.js")

We do need better control, but how we go about it without essentially throwing the web out and starting again I don't know.

Re: Just when you thought

[TheRaven64]

Another variant of this attack used several other mechanisms for generating the sound. If you're doing a very targeted attack, spiking the CPU to 100% until the fans come on and then letting the machine cool gives you a good idea who it is. For a lot of machines, various different operation sequences can make some components emit high-frequency sound that a reasonable microphone can pick up. There was a really neat attack on Tor in data centres about a decade ago that monitored the ambient temperature (using a co-located box's own temperature monitors) to correlate Tor traffic from a particular node with warming of the room, so that (after a lot of samples) you could tell if traffic for a particular user was flowing through the data centre that you were looking at.

Re:Just when you thought

[TheGratefulNet]

what is a speaker and a mic? I leave both turned off on my pc. when I want to listen to music, I run a linux box that does not have a browser or normal network access enabled. and there is never a mic on a music playback system that I build or use.

I block ads and each time I read things like this article, it increases my belief that blocking ads is the right thing to do. I block incoming network connections at the firewall and nearly everyone does, too; but I find it odd that not everyone wants to fight ads as much. 'we' do, but the regular net-using populace doesn't usually care. I rarely see adblockers and noScript installed at co-workers workstations.

and because the raw web is nasty and dangerous - and because blocking is much harder on 'phones', I avoid using phone browsers. its rarely a good experience (mobile web) anyway.

there really are 2 classes of internet users. those like me (and probably you) who aggressively block this crap and those who could not care less. such a shame that people don't univerally fight back.

ads are malware. plain and simple. people really need to get hip to that fact.

Re: Just when you thought

[ememisya]

Yea but how would you pick up that data without any input sources around? At some point you would have to have an active mic, or allow for additional permissions, or maybe watch for the canvas element to freeze or whatever, but those are all new additions still not ordinary for HTML4 not snoopin' on yo mom 'n' pop browser. Up to this point we had 3 problems, object, activex, java plugin , flash etc. and all of those were opt-in, not out.

Re: Just when you thought

[TheRaven64]

You do need a microphone, but most people carry a mobile phone and don't look too carefully at the list of apps that are allowed access to the microphone, GPS and WiFi location data, and the network. If you are a state-level adversary, then compromising, say, the Facebook app will let you get this information in a lot of places.

Wont work for me either

[jonwil]

The only microphone I have is the microphone in my Nokia N900 and I doubt the N900 and its ancient web browser could run any of whatever backend code has to listen for the special sound.

Re:Wont work for me either

[Frosty Piss]

The only microphone I have is the microphone in my Nokia N900 and I doubt the N900 and its ancient web browser could run any of whatever backend code has to listen for the special sound.

All you people are rubes! I use a can and a string...

Re:Wont work for me either

[currently_awake]

Ultrasound could also be used to communicate with spyware running on embedded devices in your home or business, to get your secrets when all the phones are turned off or in airplane mode. Sounds like we need to put low pass filters on our speakers and microphones to block this. And physical switches to block microphones.

Speakers

[moschner]

I doubt my crappy speakers can emit anything in that frequency. Even then, my phone's mic is not probably up to the task.

Besides, I'm sure those who are worried could buy/build a filter to remove audio in that frequency.

Lots of sophistication required here

[Anonymous Coward]

Anyone who's paranoid enough to use Tor should also be blocking ads and trackers in order to make this difficult. Tor isn't a magic bullet for privacy. you have to take other measures, too.

Also, this requires that other devices be listening and possibly compromised. It doesn't seem like other devices should be listening for ultrasonic signals and sending data based on them unless they've already been compromised.

Yes, it's been established that, with extreme skill, malware can jump the air gap. However, this requires a large degree of sophistication. Furthermore, even if people can't hear those signals, wouldn't they attract the attention of animals like dogs? And of they're of a high enough frequency that dogs can't hear them, shouldn't it be possible to generate enough ultrasonic noise to block out the signals? If this is a real threat, shouldn't someone be writing programs that produce garbage ultrasonic noise or devices that are designed specifically to look for these signals?

Re:Lots of sophistication required here

[Anonymous Coward]

Anyone who's paranoid enough to use Tor should also be blocking ads and trackers in order to make this difficult.

And should be blocking ALL JAVASCRIPT, period, so a site can't sneak its own little ultrasonic .js file past the ad blocker.

Re:Lots of sophistication required here

[Koby77]

Potentially they would also be paranoid enough to simply disable sound, or at least run through some kind of headphones/speakers with a toggle. I can't even remember the last time that I browsed a webpage with my sound enabled. While this type of attack does seem devious, it also seems to be grasping at straws for any possible advantage.

Re:Lots of sophistication required here

[EvilSS]

Well to the first point, it could also be used by an agency taking over a tor site covertly, no need to embed it in an ad. To the second, it doesn't require the phone to be compromised at all, just the user to download an app from an official app store and not pay attention to the terms and permissions it's asking for. This technology is used in advertising beacons today. The app developer adds a library and it reports back to the agency that provides the beacons. There have been several stories in the past year about marketing companies getting into this business. They listen for advertising beacons from online ads, TV, radio, and in stores and other public places. It wouldn't be that hard for a government agency to hijack that and get them to feed them all the info they can gather on anyone reporting back with their snare beacon IDs. Considering that's pretty much what they do now for their regular customers.

I wouldn't expect a tech savvy person to do it (though some will) but there are enough non-tech savvy people who use things like Tor thanks to friends, online tutorials, or pre-packaged browsers that it would probably net a few fish from a big enough site.

Re:Lots of sophistication required here

[geekmux]

Also, this requires that other devices be listening and possibly compromised. It doesn't seem like other devices should be listening for ultrasonic signals and sending data based on them unless they've already been compromised.

Yes, it's been established that, with extreme skill, malware can jump the air gap. However, this requires a large degree of sophistication...

You mean the kind of sophistication that would lead advertisers to pay the source (hardware vendors) to plant this capability in hardware by default?

And that's just the power of money talking. Imagine what power governments could wield to ensure this technology is deployed across the masses, using the cause-terrorists-protect-the-children excuse.

It's hardly news anymore to find [popular app] putting a microphone into constant listening mode, along with all the other popular listening devices and services (Siri, Alexa, Google, et al) that millions of consumers use today. Now our "smart" TVs are app-enabled. Think we won't start installing microphones in televisions? Think again. It won't stop there either. At some point we'll be "talking" to an e-assistant for just about every smart device because ANY tech that allows a human to be as lazy as they possibly fucking can is HUGE these days.

Re:Lots of sophistication required here

[AmiMoJo]

Anyone using Tor should have Javascript disabled, which would completely mitigate this and most other attacks.

I'm not sure why Tails has Javascript enabled by default these days.

Re:Lots of sophistication required here

[ripvlan]

Yes - Facebook App for instance listens to the ambient sounds and you'll see the ads in your feed change based upon the words said. I saw this reported on a few years ago and couldn't believe it - so I tried it out myself and was very surprised when it worked. Granted that was a few years ago and I don't know if they still do it (too lazy to try it right now).

Which is why I have disabled audio Input for FB. Actually - it is why I do not allow access to the microphone from any app. Or terminate those apps when I'm not using them. Siri is the only thing that I believe is listening (and I have a watch too). For Apple to be sending back audio beacons would be a huge finding. The currently promise to only be listening under specific scenarios - a key trigger "Hi Siri" and only when plugged into power source.

FB / Google/ Amazon beacons do follow me across devices already. There's a Firefox plugin that shows your beacon propagating across the ad networks and draws a pretty network graph. I know - I've seen Amazon ads show up on my iOS FB feed...for items that I purchased on my laptop. I won't go into the usefulness of ads for already purchased items -- but they are tracking me across devices.

But - the multi-device case seems too brittle to work consistently. I appreciate raising the alarm. Now need time to digest and think about what it "really" means.

Re:Lots of sophistication required here

[geekmux]

At some point we'll be "talking" to an e-assistant for just about every smart device because ANY tech that allows a human to be as lazy as they possibly fucking can is HUGE these days.

That is farther off than you may think. Have you tried using Siri (or whatever) for real work - to actually save time? Too much mishearing, too noise sensitive, too much need to repeat/rephrase - so the lazy human types/clicks because that is faster.

A good digital assistant should be able to hear me telling a friend on the phone " ... and to turn off, I say 'Assistant, shutdown the computer!' ..." and NOT shut down the computer because it was merely a direct quotation. No AI is anywhere near that level of comprehension - and they're also too confused if there is a fan or a radio on in the room.

Although products like Dragon have been around for decades, one could argue the e-assistant era started with Siri, which is barely five years old.

Since then, there's been a LOT of advancement and proliferation across multiple devices and services, which have gained considerable popularity (such as Amazon's infamous listening devices selling out over the holidays), which only serve to highlight just how much humans have embraced convenience for the sake of security.

The lazy human will go so far as to turn off the fan or radio to ensure their precious lazy button works effectively. Bottom line is this tech is hardly "far off".

How to block

[Anonymous Coward]

What devices/apps listen, and how do I disable them?

Re:How to block

[Anonymous Coward]

I'm pretty sure this is all theoretical at best. The headline says "could be" and then it'd require you to have one of the apps that would listen for this, assuming your phone was even capable of hearing it(and there's not much of a chance of that), and on and on and on.... Not a lot of anything supporting this. This sounds like that idiot who was claiming his airgapped computers were rooted even before he got them turned on kinda shit. And what have we heard about that guy? *crickets*, that's what.

Re:How to block

[stealth_finger]

What devices/apps listen, and how do I disable them?

All of them, a hammer.

Re:How to block

[allo]

The NSA even used a firefox zeroday. So you're better too paranoid.

Re:How to block

[naris]

Don't plug any speakers (or a microphone) into your computer. If you have a laptop with built-in speakers and/or mic, turn them off.

Speaker quality

[Anonymous Coward]

This requires both speakers and microphone that are capable of using that frequency range. How many actually are?

Is this theoretical?

[guruevi]

I understand this is theoretically possible but what speakers in these devices have powerful ultrasonic blasters? Unless they're doing some form of distance measuring, the majority of speakers is limited well under 18kHz with the response curve dropping sharply after that.

Re:Is this theoretical?

[Midnight_Falcon]

This! As somewhat of an audio engineer I know various speaker drivers very well, and laptop speakers essentially never have advertised frequency responses above 20KHz. And you're right, realistically, it's more like 18Khz with a steep drop off after 16KHz. Many people can hear 20KHz -- I've done tone tests and found I can hear up to 22KHz. So what speakers is this person using and what manner of computer has this kind of built in tweeters?

Re:Is this theoretical?

[Anonymous Coward]

Not sure why you are calling it bullshit?
I have heard 60 Ketchup HeinZ (khz) go off at once, it sounds like a big-ass-fart, or (high velocity WIND if your not form the USA)

Re:Is this theoretical?

[F.Ultra]

And isn't there a cut-off filter in the DACs used by phones/computers to filter out anything above the Nyquist sampling rate? Or is that frequency so high now a days due to oversampling that it's in the ultrasound range?

Re:Is this theoretical?

[Cmdln Daco]

Said speakers don't need to have a 'flat' frequency response above 20KHz. They just need to be capable of emitting a detectable level. The speakers may be very inefficient, but quite capable of producing enough high frequency output to be detectable.

Re:Is this theoretical?

[EvilSS]

This! As somewhat of an audio engineer I know various speaker drivers very well, and laptop speakers essentially never have advertised frequency responses above 20KHz. And you're right, realistically, it's more like 18Khz with a steep drop off after 16KHz. Many people can hear 20KHz -- I've done tone tests and found I can hear up to 22KHz. So what speakers is this person using and what manner of computer has this kind of built in tweeters?

You guys realize this is not some theoretical flight of fancy, right? It's being used today for ad tracking: http://arstechnica.com/tech-policy/2015/11/beware-of-ads-that-use-inaudible-sound-to-link-your-phone-tv-tablet-and-pc/

Apps using SilverPush

Re:Is this theoretical?

[hankwang]

What kind of audio source did you use to find that you can hear 22 kHz? Unless you have an ultra low noise analog sine wave generator and amplifier, you are likely to hear noise, artifacts of the DA converter, and effects of clipping when you crank up the volume. The stated limit of 20 kHz for the human ear is the frequency where the pain threshold and the hearing threshold coincide for an average young person, so it is likely that you need >110 dB SPL to have any chance of hearing above 20 kHz. A device with 90 dB S/N ratio will likely blast you with lower frequencies, which you could easily mistake for "I can hear 20+ kHz".

I did once fry the tweeters of my (60 watt rated) loudspeakers while trying to test the limits of my hearing as I was sending all amplifier output power to the tweeters.

Re:Is this theoretical?

[hankwang]

A modern dac is supposed to digitally filter at 20 kHz (very hard cutoff), in exchange for lots of noise above 100 kHz. A soft roll-off analog filter takes care of the content above 100 kHz.

I suspect that ultrasound in this context really means 16 kHz or so, at volumes that are too low for the ear, but easily picked up by a microohone and some signal processing.

Re:Is this theoretical?

[AmiMoJo]

According to TFA the range is 18-20kHz, with 75Hz bands that represent individual symbols. Most TVs can produce 20kHz sounds, and you probably wouldn't hear them. Even if you can hear a 20kHz tone over headphones in a quiet room, with the noise of a commercial mixed in and the audio played at low volume you won't notice.

I'm more sceptical that typical laptop speakers could produce such high pitch noises, but I guess for Tor attacks you could use lower frequencies. The TV ads need to work at a few metres range with background noise. Someone using Tor on a laptop is likely in a quiet room with their smartphone near by, and the main source of noise will be the laptop's fan and HDD.

Re:Is this theoretical?

[sociocapitalist]

"The inaudible code is recognized and received on the other smart device by the software development kit installed on it."

So the other device has to be compromised as well which at least complicates delivery of this attack to targets.

Although they claim:
As of April of 2015, SilverPush’s software is used by 67 apps and the company monitors 18 million smartphones.

Maybe true, maybe marketing.

Re:Is this theoretical?

[bill_mcgonigle]

Right. Most people who 'hear' in the 20-28KHz range are picking up that their ear bones are vibrating a bit and that can get translated into sound but it's not real 'hearing' at the high frequencies.

For the vast majority of the population, there's plenty of bandwidth in the 12-16KHz range that speakers can reproduce and most people wouldn't discriminate from fan noise on the system.

Re:Is this theoretical?

[currently_awake]

It doesn't have to be ultrasound. The Sub sonic range is usable by machines but you won't hear a thing, or a signal in the audio range but at a low signal strength would work.

Re:Is this theoretical?

[Thelasko]

So what speakers is this person using and what manner of computer has this kind of built in tweeters?

TFA shows a picture of a MacBook Air. It figures that Apple would include speakers so fancy they open up a new attack vector.

I don't believe it either, but as other users have pointed out, this thing is already in the wild.

Re:Is this theoretical?

[EvilSS]

They pay devs to put it in their apps, just like other advertising.

Re:Is this theoretical?

[RockDoctor]

Someone using Tor on a laptop is likely in a quiet room with their smartphone near by,

Since you're specifically talking about someone who is using Tor, I'll add the relevant FTFY :

with their smartphone near by, turned off, with the phone battery a metre or two away from the smart phone

I've never got a good answer as to WHY...

[Anonymous Coward]

explain to me why we even have browsers that allow javascipt to 'play audio' without permission in the first F***ing place?

The entire reason I started to use adblock in the first place (I 'theoretically' highly approve (both morally and economically, etc.) of ad-supported content) was because I worked phone support and could browse the internet while telling people to plug the cable back in and try rebooting.... and then I started to get NOTHING but flash ads that would play audio (while I was on the call) so I got firefox 0.x.x.x when it was released and got adblock plugin as soon as it was released.

To this day I still -want- to be able to allow ads.... but 3rd party ads are just too much of a 1) security risk 2) annoyance risk and 3) usability interruption risk (ads that redirect the page (especially on mobile)

and just wait.... HTML5 'all JS' pages will start to come soon (other than sites located in California which THANK the GODS has a law stating sites must be text browsable for usability (handicapped) reasons.... which ends up just helping everyone...

Re:I've never got a good answer as to WHY...

[Anonymous Coward]

Since you receive desired content on web pages, it is your moral obligation to allow the ads to play. They play sounds and display video to capture and hold you attention long enough for the message to get into your brain for processing, and paying attention to this is your end of the social contract built around ad-supported content.

Allowing the tracking is also obligatory on your part.

You can protect yourself from viruses and such by running such tools as McAfee antivirus, and also by keeping your browsing focused on the web portals of professional, on the up-and-up, well-established businesses.

This is how members of a civilized society comport themselves. If you don't like this, you are free to stay off the internet.

Ad blocking undermines the social fabric that keeps the modern world functioning, and so it is morally tantamount to terrorism. The only reason it isn't illegal yet is because the wheels of politics turn too slowly to keep up with tech. But rest assured, reprobate criminal parasites that block ads will be getting the punishments they are due before too long.

Better think this over. The future has no problem leaving you behind.

so they're emitting tracking ultrasound :(

[strstr]

this is bullshit. a cop / law enforcement could use this to walk around and receive identity information without even needing to interferometry scan your brain/DNA/pocket book full of ID/credit cards/cellphone etc.

this also enables low tech citizens to perform the same feat. often times once a low tech person has info about you such as tracking ID, IP address, phone number, address, name, social security number, date of birth+location information, or email address they can take that to databases and find out mounds of information about you- basically all that data the companies have amassed about you, is retrievable with any identifiable information. NSA databases work the same way.

obamasweapon.com

How does the receiver work?

[PatientZero]

I understand how ads could emit these sounds, but how do advertisers install apps on your device to pick them up and phone home? Is this capability built into iOS and Android, or do they work with handset manufacturers?

Re:How does the receiver work?

[PatientZero]

According to Mavroudis, the mobile phone must have an app installed that has embedded one of the many advertising SDKs that include support for uXDT.

I guess advertisers probably pay app developers to include the toolkit. I really hope it's not in the OS.

Re:How does the receiver work?

[bragr]

It is part of the advertising SDKs in some apps that you install from the app stores. The idea is that if the advertising network can link the tracking cookie IDs on your devices (e.g. sending a signal on your desktop and picking it up on your phone), they can build a better profile on you with more targeted ads.

Silverpush is one SDK that does that though there are several others. You can find some apps that use it here, though they are mostly junk apps: https://public.addonsdetector....

Re:How does the receiver work?

[ripvlan]

It isn't built into phones (that I know of) ... Do you have the Facebook App installed? Any "Rewards" apps? This is the channel they are using. Any apps that causes the phone to prompt "allow access to microphone" has the potential to do this. I believe that iOS apps can only listen when running in the foreground.

When you are creating a Post on FB - FB is listening for songs and TV/Movies. Think Shazam. If they recognize something they suggest a tag "You are listening to XYZ song" I swear a few years ago that I tried out saying "I really like Ford cars" and my ad feed changed. They claim this can't happen. Maybe I said Ford because they had an ad blitz and was top of mind - and made it to my feed around the same time by coincidence. FB "app is only listening while you’re writing a status."

Still - I don't allow FB access to my microphone. Even Skype is disabled - I enable it only when I use Skype. But Siri & my watch are of concern - I have to trust Apple. And as Mark Zuckerberg has said before : what are you doing that others shouldn't know about?

How is this even legal?

[Snotnose]

They're installing software I don't know about on my phone/laptop, then using that software to send personal ID details to unknown servers. This has to fall under at least one of the myriad hacking laws we already have on the books.

Oh, I forgot. They donate more to congressclowns than I do.

Re:How is this even legal?

[PhrostyMcByte]

They're installing software I don't know about on my phone/laptop, then using that software to send personal ID details to unknown servers. This has to fall under at least one of the myriad hacking laws we already have on the books.

If the FBI does it, yes. A law recently activated that lets them legally try to hack someone using Tor or anything else that could hide traffic (like, perhaps a VPN).

Re:How is this even legal?

[naris]

Because it's theoretical and not real (other than a proof of concept installed on the researcher's own computer)...

Save us APK!

[Anonymous Coward]

You're our only hope :(

Attack model

[manu0601]

This attack model assumes there is an app on the phone able to listen all time for ultrasounds. Obviously granting microphone access to an app is dangerious and should not be taken lightly.

Re:Attack model

[UnanimousCoward]

No it doesn't. You are at a cafe that has microphones installed at the tables for voice-activated ordering. That infrastructure, along with the GPS data that is constantly tracking you, pinpoints you...

Re:Attack model

[sconeu]

In a cafe, I'll either be muted, or be using earbuds/headphones

Re:Attack model

[EvilSS]

This attack model assumes there is an app on the phone able to listen all time for ultrasounds. Obviously granting microphone access to an app is dangerious and should not be taken lightly.

They already exist! Leave it to ad agencies to beat the government to the punch on tracking out lives. Best part is we stupidly agree to it (or just don't read the fine print when installing some crap app on our phones)

One thing iOS does that I wish Android did is they way they handle applications using the microphone. Not only do you need to grant mic permissions, when an app uses the mic, the status bar changes color, continuously flashes if the app is in the background, and it adds a banner under the status bar that tells you that the mic is in use and what application is using it. There is no hiding that an application is trying to listen to the mic.

Re:Attack model

[wvmarle]

This attack model assumes there is an app on the phone able to listen all time for ultrasounds.

TFA suggests that this even is the case for many phones already: they say many advertising APIs (which programmers simply link to in order to get ads in their apps) already include ultrasound listening options. This is supposedly yet another way for the advertisement provider to get more information on individual users, in this case by linking separate devices as belonging to the same user.

Audio compression?

[scorp1us]

Why is ultrasound being preserved in compressed audio? Unless they are hinging on uncompressed au or wav formats?

Re:Audio compression?

[Jbcarpen]

They might not be sending any audio at all. A software signal generator capable of producing only a single tone (or maybe two tones if you don't want to use silence as one of your bit states) is not complex.

Re:Audio compression?

[Locke2005]

CD quality sound is sampled at 44.1Khz, so it's only capable of faithfully sound that IS audible to the human ear (about 20Khz). Who builds systems capable of accurately reproducing sounds that humans cant here? That seem pretty pointless.

Re:Audio compression?

[Orgasmatron]

The flippant response is that there is a large and lucrative idiot market out there, and someone was bound to go after it sooner or later.

The better answer is that we have two ears. By limiting audio signals to the hearing range of a single ear, we lose the ability to capture and reproduce subtle phase information. This is an unexpected side benefit of the 48k audio being sold to the morons mentioned above.

Re:Audio compression?

[RockDoctor]

Who builds systems capable of accurately reproducing sounds that humans cant here? That seem pretty pointless.

To quote a song of about 1960,

"All the highest notes, neither sharp nor flat,
The ear can't hear as high as that!
Still, I ought to please any passing bat.
With my HIGH FIDELITY

(I'm not sure where the "sharp nor flat" thing comes into it. I've never understood those terms despite both piano and music teachers trying to beat the idea into me.)

/. is getting slow with actual news

[bussdriver]

Clearly, this is now a problem with all the always-on listening devices that are now becoming wide spread! Barbie dolls that listen, Google, Amazon are listening all the time.

Then you have permissions given to websites, apps on other devices plus security holes for when permission is not given. Don't forget company policy changes which can turn allowed permissions against you without your knowledge (unless you are a lawyer and read updated user agreements... many which are broad and vague already.)

So now Google and Amazon know even more of what is going on in the house and can link your devices. Furthermore, they can link you to PEOPLE who come within range of the microphone. Your associations can be analyzed which means the NSA is going to use it (do you really believe they haven't forced their way into these systems somehow already?)

Google watch could notify where you are moving around which could provide their assistant context information to better understand your speech. They might have some useful things to do with it, I can't think of any so far where bluetooth couldn't do it better and more likely with our knowledge..... but would something less covert really matter if they did the same stuff? people don't seem to care.

Re:/. is getting slow with actual news

[Cmdln Daco]

If you have children, be careful, because they might kill you in your sleep.

Re:/. is getting slow with actual news

[allo]

it isn't slow, but there was a recent presentation at the big hacker event in hamburg, bringing up the topic again.

javascript. fully stop. details don't matter.

[Anonymous Coward]

JavaScript code

Stop right there. That's all you have to say.

If you're trying to be anonymous and then letting unknown untrusted parties run scripts on your computer, you are (a) a colossal idiot, and (b) not actually anonymous at all. This is one of about a thousand ways to de-anonymize you. The details hardly matter: if it's not this, it's the next, or the next.

Turning javascript off by default is a good idea even if you are NOT trying to be anonymous, due to the endless stream of exploits it has enabled, but especially when you are trying to be anonymous, don't run that shit!.

I don't know who they're going to catch with this.

[h33t l4x0r]

I Tor with javascript disabled, and I'm not even a pedophile / drug dealer.

Detectors and Countermeasures

[AlienSexist]

Certainly the ads have no idea if there is a device listening for them and will broadcast anyway. I suppose ultrasound detectors could detect the activity. Maybe you could spam with some conventional source of ultrasound to drown these devices with indecipherable noise. Or just the network approach, whatever.

Huh?

[Locke2005]

That relies on people being stupid enough to leave compromised apps running on a machine with a microphone, and only tells you what broadcast coverage area the user is in... it's not like it narrows the location down that much! If you've got a compromised app constantly sending data over the internet, wouldn't it be easier to just trace the IP packets back to the source?

Re:Huh?

[Cmdln Daco]

The compromised app doesn't send a constant stream of data over the internet. It sends a very short burst of information infrequently.

And the compromised app is located on anybody else's device within hearing range.

Re:Thanks Audiophiles!

[Locke2005]

That's the other restriction: it relies on ads being played on audio systems capable of generating frequencies higher than 30KHz at energy levels high enough to be detected by a device with a microphone capable of accurately picking up and digitizing frequencies above 30KHz. Possible, but not really the global norm yet. In fact, pretty much only works on rich people, doesn't it?

Re:Jokes on them

[gweihir]

That is what you think. Actually it will be something like 6dB/octave dampening, so it still puts out about 12% of maximum volume at 24kHz. Receiving ultrasound is easier than normal sound, as there is less of it around in a normal environment. And in this application there is no need to worry about signal quality, a straight rectangle signal will do just fine, because of the dampening. The next generation of this malware will probably use ultra-wideband audio-pulses and be even more resilient.

Defense: Unplug speakers or headphones

[gweihir]

Can't do that because you are on a laptop? Too bad, you are screwed.

Re:Defense: Unplug speakers or headphones

[EvilSS]

Can't do that because you are on a laptop? Too bad, you are screwed.

Stick a 3.5mm plug into the headphone jack. solved.

Re:Defense: Unplug speakers or headphones

[locofungus]

Stick a 3.5mm plug into the headphone jack. solved.

I'm not convinced - on my galaxy note at any rate - that this is guaranteed to work.

I've noticed that when I push the plug in, it detects the plug being inserted and then switches the sound from the internal speakers. I'm not convinced that, unlike old fashioned radios, inserting the plug physically disconnects the internal speakers.

But I could be wrong - it's something I've noticed in passing rather than something I've been looking out for.

Re:Defense: Unplug speakers or headphones

[gweihir]

Nothing depending on software is secure here. Remember that this is an attack, and while the required zero-days my initially only be available to nation-state-level criminals, they often become the tools of other hackers pretty fast.

Re:Defense: Unplug speakers or headphones

[gweihir]

Unless that is done by the firmware of the sound-chip. Then it may be possible to hack it. Have you verified this?

Re:Defense: Unplug speakers or headphones

[allo]

on laptops it is not. You can activate both speakers and headphones in the mixer. Maybe not (that easy) on windows, but on linux there is no problem. It's a feature, not a bug.

Re:Defense: Unplug speakers or headphones

[EvilSS]

Unless that is done by the firmware of the sound-chip. Then it may be possible to hack it. Have you verified this?

If it's possible for a bad actor to override it, they already own your laptop and don't need to use this kind of trick to find you anyway. A web ad with embedded ultrasonic beacon won't have the level of system access to do it, which is what we are talking about here.

Re:Defense: Unplug speakers or headphones

[EvilSS]

on laptops it is not. You can activate both speakers and headphones in the mixer. Maybe not (that easy) on windows, but on linux there is no problem. It's a feature, not a bug.

Yes but a web ad using an ultrasonic beacon won't have access to do that. If it did, you're owned anyway so what's the point.

Re:Defense: Unplug speakers or headphones

[gweihir]

Not necessarily. First, attacking the sound-chip firmware may not even need a compromise of the rest of the system and may be doable with user-rights only or by getting the user to install a compromised driver, possibly for an entirely different component.

Now assume, for example that the attacker changes the firmware of your soundcard at some time, say to let frequencies >= 20kHz always through to the speakers, but behave normal otherwise. Then the user boots Tails and the machine is in a non-compromised state (well, except for said sound-chip). The web ad can then use the beacon successfully.

The whole thing is an attack on a very high difficulty-level. Simplistic countermeasures will not cut it.

Re:Defense: Unplug speakers or headphones

[EvilSS]

If they are in a position that they can attack the sound-card firmware, they have the access and skill to own the machine hands down. There are far easier ways to get your identity at that point. The whole point of this exploit is that it can be run via the browser using embedded ads when other methods fail. It's an exploit that can be used without needing to actually exploit the PC itself.

Re:Defense: Unplug speakers or headphones

[gweihir]

Have you really overlooked that this is a 3-phase attack? If so, you do not have what it takes to even comment on this competently.

Re:Defense: Unplug speakers or headphones

[EvilSS]

Of course not, but it makes no sense. If the goal is to deanonymize a user, and I have access to their machine to flash firmware on the sound card, then I have all the access I need to deanonymize the user without jumping through that hoop in the first place. If I am able to run arbitrary code there are plenty of ways, much easier and more accurate ways to do this. Hell just pulling access point MAC addresses from the WiFi card would work without jumping through all the hoops you propose.

I'm not saying it's not possible, but it's overly complicated for no good reason. All you need to make it perfect is a sign for free bird seed and a obsessed coyote.

Re:Jokes on them

[Pseudonym]

So that's why Apple is killing the headphone jack!

Re:Jokes on them

[the_Bionic_lemming]

What are these ads or javascripts that run on my machine without me knowing about them? Do people actually surf the web without crippling the sites that attempt to do so?

That's like web aids, or web gonorrhea .For gods sake, strap on some protection!

Run Tor in a VM without audio support

[aNonnyMouseCowered]

A relatively simple, if not 100% secure solution. Download your favourite anonymizing live USB distribution and run it under a virtual machine with only the bare minimum of media support (e.g. disable any virtual sound card option). Enable at most a generic VGA video driver using a resolution different from your default monitor aspect or resolution. Run the browser with ad-blockading software and JavaScript white-listing only. The attacker will of course realize of course that you're using a VM.

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

Or the simpler solution: Recognize that the claim (s) bring made here are PHENOMENALLY ridiculous. Even if the coupling was 100%, so what? You can't just emit a sound and cause my computer to do anything. There would have to be special software running on the target system that was listening. In other words it is the classic "I could break into your computer, but first I need admin access to it".

Re: Run Tor in a VM without audio support

[Zero__Kelvin]

I just barely use 3 GB with of data in a month and I DO watch videos sometimes. You are either completely full of shit or your phone is infected.

Re: Run Tor in a VM without audio support

[maxm]

It is not far fetched at all! Chromecast has already offered my phone to recognize it via sound via the chromecast app. So it is already implemented as standard practice. There is no bottom to the depths ...

Re:Run Tor in a VM without audio support

[GameboyRMH]

That'll work but it's overkill. This particular technique can be defeated by muting audio at the OS level - even just for the browser.

Wouldn't it be more cost-effective . . .

[mmell]

. . . to just station an observer within line of sight of your monitor? Or tap the stray EM coming off of monitor, keyboard and mouse? Or physically tap your hardware? Or ensure you've bought pre-compromised hardware? Or . . .

Alternatively

[ceoyoyo]

Alternatively you could just have an ad that screams "hey, this evil hacker is using evil hacking tools!" at full volume.

I certainly leave the volume on my computer turned up nice and high when I'm browsing questionable content in public.

So this is why my ...

[CaptainDork]

... dogs bark during that goddam Weight Watchers commercial!

Quick fix

[MrKaos]

Plug headphones into laptop. Alternatively, get some old headphones, chop the jack off and plug that in.

Bourne Movie?

[irrational_design]

Didn't I see this in the last Bourne movie? And here I thought that was just they typical Hollywood tech cluelessness.

Wait!

[invictusvoyd]

Javascript on Tor ?

Re:Wait!

[fisted]

Tor is transport.

Re:Wait!

[ninthbit]

My thoughts exactly.... Plus, why would I have sound unmuted. That's just asking for a bunch of porn ads to start blasting out moans and that hot married women near me want to bone.

Yes, the technique has a degree of merit in that it may work, but it's another one of those solutions that will only catch the dumbest of the dumb.

Re:Wait!

[peawormsworth]

Stupid is designing a secure operating system around Tor and then provide a browser where javascript is enabled by default and the home page is pre-set to call home (open the OS homepage). But don't worry, they do this to simply collect general non-identifiable statistics about their users.

Re:Wait!

[invictusvoyd]

+1 insightful

Re: So, um, ...

[newbie_fantod]

Or turn off JavaScript if yow want to remain anonymous on Tor.

Non-problem?

[bradley13]

I wonder, though: how many people surf with their sound on? Most people I see (granted, not a representative sample) either have headphones or have the sound off, so as not to disturb everyone around them. If I were surfing something via Tor, i.e., sensitive, then I'd be double sure not to have publicly audible sound.

The worthless power of Privacy Advocates.

[geekmux]

"Advertisers use uXDT in order to link different devices to the same person and create better advertising profiles so to deliver better-targeted ads in the future"

If any citizen were caught deploying this kind of tech to electronically profile the masses, they would be labeled a terrorist and locked up for life. But hey, spend a few hundred and file your questionable activities under a corporation, and it's ALL good! What a fucking joke of a loophole.

I swear, reading about shit like this makes me wonder what power privacy advocate groups really wield anymore.

Who surfs the web with the sound on?

[Threni]

And why? It'll just be ads and auto-start-playing videos, and who wants them?

I could see this used for the Amazon Echo

[BlueCoder]

Also the XBone.

Other than that how many other apps keep microphones open and recording?

And not so much hackers as they are paranoid. But it would be a good tactic for finding and tracking Journalists.

Journalists can be quite dim; just look at the one that released his key for the the Manning data in a book.

Re:Jokes on them

[AmiMoJo]

For most people, the disadvantages of wearing a tinfoil hat all the time outweigh the benefits. Believe it or not they actually like being able to use web sites without them being horribly broken. Crazy, I know.

What really is hard to understand is why the Tor browser, at least on Tails, seems to have Javascript enabled by default. If the user has gone to the effort of using Tor, it seems reasonable to require them to whitelist manually.

Re:Jokes on them

[stealth_finger]

My crappy Dell laptop speakers are limited to about 3 kHz.

I have some fairly decent speakers but they still don't do anything outside human range hearing, probably don't go above 16k. How do they think they are going to get it to do ultrasound?

Re:Jokes on them

[fisted]

as there is less [ultrasound] around in a normal environment.

Is that true? How do you know?
I hope this claim isn't based on the fact that you normally don't hear any ultrasound in your normal environment...

I for one can think of a crapton of stuff in my 'normal environment' that likely emits ultrasound, first and foremost every switching PSU (except the crappy ones that switch in the audible spectrum, producing a sound like a muted TV....)

Re:PC speakers can't emit 'utralsounds' nor can

[allo]

Maybe you should watch the presentation recording.

Re:It won't work but I'm sickened and impressed

[allo]

The browser isn't the only attack vector. Imagine, you download a message from snowden as video via tor (okay okay ...) and watch it with sound on your pc. The NSA inserted a ultrasound-id in YOUR download and your phone receives the id and reports its IMEI to the advertiser, which cooperates with the NSA.

Could this be circumvented by...

[wardrich86]

Could you not just create a program to run that pumps out a bunch of random ultrasounds? It could flood the environment and make the original ultrasound signal impossible to discover, no?

Re:Could this be circumvented by...

[retroworks]

Who killed antiphorm, and why can't I seem to post a /. comment referring to it? https://www.cnet.com/news/rand...

Re:Jokes on them

[hodet]

I was surprised by this the first time I installed Tor Browser as well.

Missing the obvious?

[folderol]

I don't have speakers on my computer, and the external amp is only on when I want to listen to music.

Insufficiently paranoid?

[jenningsthecat]

I would have thought that anyone serious about using Tor, would also be savvy and suspicious enough to have data turned off on their smartphones and tablets when it's not being used. I don't even use Tor, but WiFi and cellular data on my phone are turned on only when I'm browsing or emailing. As for computers, any cameras are taped over, and microphones are unplugged, or, in the case of a laptop, muted.

Is this even real?

[ripvlan]

I read a similar article several days ago and came to the same conclusion that you did - this is very sophisticated. Maybe too sophisticated. Which made me wonder whether this is theoretical "in the lab" by researchers or actually out in the wild. As for dogs hearing it? sure - maybe. There are lots of noises. My furnace fan makes a blowing air sound. I don't howl because of it - it's just annoying white noise that I ignore.

Need a Raspberry Pi project to listen for this. Then becomes a keyfob that you carry with you that blinks when these secret US signals are detected.

At the time I wasn't able to find links to the actual work - just blog posts that circularly reported on this subject from each other. The quote "ultrasound cross-device tracking (uXDT), [..]. deployed in modern-day advertising platforms" -- really? like what and who?

The link to c3subtitle.de has vague statements in it too "newly-founded company faced the nemesis of the security community and the regulators (e.g., the Federal Trade Commission)" Really? Who?

The underlying premise that I have a phone near my computer that is listening to a beacon played by Ads seems incredulous. The idea that an ad agency would go to these lengths for such a brittle system is surprising. It would have to work "often" to pay off --- and for what gain that GeoIP doesn't provide today? What is that extra 1% that they are after? Plus in this day of auto-playing videos I have my audio muted (or headphones plugged in) - which I think many others do as well - or at least the volume is low. This again closes the door from an ad viability perspective. I get that advertisers want to link my laptop to phone to tablet together so that they can track Me! But there are other ways to do this already (FB beacons for example) that aren't as brittle.

While I appreciate Raising the Alarm - I doubt that (say) Google Ads is doing this. Sure -- maybe some govt spy agency is using this technique to spy on people (i.e. break through Tor). Yes I believe that. If I was a criminal I'd wrap my head and devices in tinfoil.

I'd like to see more evidence that advertising networks are actually doing this.

Re:Is this even real?

[ripvlan]

and I forgot to mention Tor. Sure wanting to uncover people is interesting. But do advertisers believe there are enough people using Tor to invest and develop this technology - that the target audience is big enough?

Maybe a feedback loop on the same computer. A Tor ad playing and the computer listening to send it back through non-Tor channels. But that also assumes a computer has been compromised with an app that can listen. How many people have installed a Time Sync app? Fake/Hacked Java or Flash does not seem tactics of an advertiser --- maybe one selling fake drugs. But again - sounds more like the goal of a hacker and not an advertiser.

Why???

[Impy the Impiuos Imp]

These second-stage devices, who silently listen in the background, will interpret these ultrasounds, which contain hidden instructions, telling them to ping back to the advertiser's server with details about that device.

Why are people not in prison for this?

Re:Why???

[currently_awake]

There are 2 sets of rules: #1 for the rich and #2 for everyone else.

Re: So, um, ...

[TheRaven64]

I would love a legal requirement that any device that comes with a camera or microphone have a physical switch to disconnect them.

US-emitting tabs.

[DrYak]

Even if some pages emit ultrasound - others will play sound and remind me to always mute.

And the default behaviour in firefox is to display a small "speaker" icon next the title of any tab that plays audio.
You can cut the audio off simply by clicking on the icon.
On android, the non-focused tabs don't even play audio by default (it's not possible to listen to music in a background tab).

Even if some PCs emits ultrasound, who will leave a mic on and run receiving sw? Not me, for sure.If this gets popular, muting the mic will be standard . . .

The thing is : YOU might not be in control of the mic (that does the recording).
The whole point is locating YOUR laptop. So by definition, the mic that is doing the recording is on some other hardware.

- That could be hardware purposefully left to record.
- That could be the smartphone of some other user who's a lot less carefully than you (has a mic and location service both available, and currently abused by some random JS ad)
- That could be the government. (In some phone, the portion of the radio chipset that is not under your personal control is able to record audio and position. Happens in some Qualcom SoC, where the radio chips works as a kind of "north bridge" to the rest.
If mandated correctly, the information services of a country could remotely start to eavesdrop on whatever the phone is hearing around - as long as the radio chip is within range of a cell tower).

Ridiculous

[Sperbels]

This is a ridiculous over thought bond movie gimmick of a threat.

Re:Jokes on them

[Qzukk]

they still don't do anything outside human range hearing

And you know this because you tried it and didn't hear anything?

Re: So, um, ...

[Blaskowicz]

It's not that hard by software means. Misconfigure your ALSA or Pulseaudio, or try to install OSS to replace them.

Re:Jokes on them

[stealth_finger]

No, because that's what they're rated at and it's pointless to make speakers that go over 20k unless you're specifically looking to make an ultrasound device.

Re:javascript. fully stop. details don't matter.

[michael_wojcik]

Sigh. Disabling scripting does not magically remove the uXDT covert channel.

The HTML5 Audio API does not require Javascript. A server is perfectly capable of sending a unique uXDT audio signature to each user agent, and tracking using session cookies, hidden form fields, query-string parameters, "ultracookies", and other mechanisms.

Yes, if you put bars on your windows, you make it harder for burglars to enter that way. And if you leave the door open, they won't have to.

And, as other people have already noted, many sites don't work at all if scripting is disabled. Sure, that's obnoxious, and the people responsible will no doubt end up in a special new circle of Hell. And sure, some users can get by without any of those sites. But others - including, say, people who are trying to anonymously use social-networking sites to report on the activities of repressive regimes - may have good reasons for needing to enable some scripts (which, with typical whitelisting blockers like NoScript, means "scripts served by some domains"). That gets technically complex quite quickly. Not everyone who needs online anonymity has the opportunity to become a web security expert.