Slashdot Mirror
Ambient Light Sensors Can Be Used To Steal Browser Data (bleepingcomputer.com)
An anonymous reader writes: "Over the past decade, ambient light sensors have become quite common in smartphones, tablets, and laptops, where they are used to detect the level of surrounding light and automatically adjust a screen's intensity to optimize battery consumption... and other stuff," reports Bleeping Computer. "The sensors have become so prevalent, that the World Wide Web Consortium (W3C) has developed a special API that allows websites (through a browser) to interact with a device's ambient light sensors. Browsers such as Chrome and Firefox have already shipped versions of this API with their products." According to two privacy and security experts, Lukasz Olejnik and Artur Janc, malicious web pages can launch attacks using this new API and collect data on users, such as URLs they visited in the past and extract QR codes displayed on the screen. This is possible because the light coming from the screen is picked up by these sensors. Mitigating such attacks is quite easy, as it only requires browser makers and the W3C to adjust the default frequency at which the sensors report their readings. Furthermore, the researcher also recommends that browser makers quantize the result by limiting the precision of the sensor output to only a few values in a preset range. The two researchers filed bug reports with both Chrome and Firefox in the hopes their recommendations will be followed.
... said no-one, ever.
the real problem is the spyware itself.
It's a completely soldout.
It's got me wanting. More. Quick. Anyone. Where can I buy a bridge? The more famous, the more I will PAY!
The DOM is ridiculously broken.
Okay, I can see something persistent like battery state of charge with predictable rise and fall being able to uniquely identify devices. Or just being able to listen to sound.
But a light sensor? Come on. We're really grasping at straws here with this one, because in an uncontrolled environment you can't really make predictions about anything that one little eyespot can see.
Besides, if they're in your phone already, why the hell would they care about your desktop web browsing? Do they really need to know your porn fetishes? And if the "light sensor hacker" is in your house using his phone, then he is a common senseless eccentric moron. Or, we got blind hackers coming soon. The Blind Hacker: his/your phone sees what he can't.
What we're seeing here is the result of feature creep being integrated into standards because the W3C is financed by donations of corporations. As a result they have lost their spine and the ability to say no to bad ideas. So now, the inmates are running the asylum.
Anons need not reply. Questions end with a question mark.
reading a QR code through a light sensor? really?
My nice old smartphone (note4) didn't have the API - so it is safe. I has a light sensor controlling the screen though. Web browsers don't need the ability. Tried several browsers too.
My PC reports light sensor readings - but failed to record their blinking mess. Not surprising, the sensor does not face the screen but the room. So of course it won't notice the blinking screen, the office is lit by lamps much more powerful than a white screen. Even holding up a white paper did not reflect enough light back that this hack worked.
At the very least every one of those APIs needs to be disabled by default. I'm tired of them increasing my attack surface for no good reason.
When would browser-level access to the ambient light sensors even be useful (to the end user, not to marketing organizations)? Screen brightness should already be managed by the OS, so... I'm sure there's a legitimate use-case; I just don't know what it is.
I wonder if you can drive them nuts with a random homemade ambient light stobe. Or aim the sensor with another computer, which is also browsing.
So can we be thankful for targeted advertisements. The various ads we get served are going to change the page on a per person basis and per visit basis. This would make having a master table of luminosities impossible without knowing the ads that were served.
But if you know the ads served you already know the page visited.
Access to a sensor, any sensor, enables information to leak. Microphone, camera, ambient light sensor, accelerometer, thermometer, battery level... These can all be used to glean some amount of information beyond what they're explicitly intended to gather.
Browser manufacturers, KNOCK THAT SHIT OFF! Quit giving websites access to everything. If there seems to be a good reason to give sensor data, average it over time or fuzz it to reduce malicious use. And give the user control over which sensors you report to which sites, with what degree of precision and accuracy. Too complicated? Too much for your users to handle? Then you should err on the side of privacy and just not give access to third parties.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.