Slashdot Mirror
Ambient Light Sensors Can Be Used To Steal Browser Data (bleepingcomputer.com)
An anonymous reader writes: "Over the past decade, ambient light sensors have become quite common in smartphones, tablets, and laptops, where they are used to detect the level of surrounding light and automatically adjust a screen's intensity to optimize battery consumption... and other stuff," reports Bleeping Computer. "The sensors have become so prevalent, that the World Wide Web Consortium (W3C) has developed a special API that allows websites (through a browser) to interact with a device's ambient light sensors. Browsers such as Chrome and Firefox have already shipped versions of this API with their products." According to two privacy and security experts, Lukasz Olejnik and Artur Janc, malicious web pages can launch attacks using this new API and collect data on users, such as URLs they visited in the past and extract QR codes displayed on the screen. This is possible because the light coming from the screen is picked up by these sensors. Mitigating such attacks is quite easy, as it only requires browser makers and the W3C to adjust the default frequency at which the sensors report their readings. Furthermore, the researcher also recommends that browser makers quantize the result by limiting the precision of the sensor output to only a few values in a preset range. The two researchers filed bug reports with both Chrome and Firefox in the hopes their recommendations will be followed.
... said no-one, ever.
It's a completely soldout.
Just turn off javascript.
And all of the Interwebs as we know it will disappear.... including Facebook and FBI's exploits
I'm pretty sure the blind hacker is the same guy that catches the hot girl answering the door naked when she asks "who is it?" and he replies "blind man," so she opens the door and he's standing there slack-jawed holding the new blinds she forgot she ordered.
What we're seeing here is the result of feature creep being integrated into standards because the W3C is financed by donations of corporations. As a result they have lost their spine and the ability to say no to bad ideas. So now, the inmates are running the asylum.
Anons need not reply. Questions end with a question mark.
The real story is "Crackpots make ridiculous claims and theoretically intelligent people are proven to be anything but". If anyone seriously believes an ambient light sensor can leak your URLs, please leave this site and head over to digg for something. You don't belong here. Editors, I am including you in that statement.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
My nice old smartphone (note4) didn't have the API - so it is safe. I has a light sensor controlling the screen though. Web browsers don't need the ability. Tried several browsers too.
My PC reports light sensor readings - but failed to record their blinking mess. Not surprising, the sensor does not face the screen but the room. So of course it won't notice the blinking screen, the office is lit by lamps much more powerful than a white screen. Even holding up a white paper did not reflect enough light back that this hack worked.
tell that to /.
all I need/want is to load all comments on the story (be them 20 or 800), read at -1. I don't know how to do that with js off and/or when logged off.
Intelligence you say? Here's an idea: malicious code uses sensor to measure light output of whole screen. It then - like a CRT scanning from top left to bottom right - pixel by pixel obscures the original page with a certain colour. If the total light output decreases, the underlying pixel must have been one with a higher intensity. For text this probably means a light background. Conversely, if it increases, it may be a text pixel. Repeat with different intensities, perhaps relying on differences gleaned from putting a pixel next to the one you measure (font aliasing, display specific RGB patterns) and you can even distinguish between different colours with the same light intensity (might be why you see a green pixel in the QR demo).
If your light sensor is sensitive enough and it can measure with a high frequency (and the victim is not a disco fan) the attack becomes not just possible (i.e. NOT theoretical), but actually practical. Which is exactly why the researcher proposes lowering both the resolution and measurement sensitivity of the sensor in browsers. This offers a good middle ground between commercial interests (having the sensor enabled by default) and security.
In a way you would be turning your light sensor into a light pen. Yes, this is grandpa speaking, who can still remember how beautiful his Commodore 64 was with a light pen. In effect, the screen is built up of horizontal lines that are "painted" sequentially. So the light pen would detect a light peak, send a signal to the computer, who looked at the where the video chip was currently painting. That way, the computer "knew" where you pointed the light pen at.
So yes, I can totally imagine that you would be able to read a QR code from your own screen that way.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Yes, please revoke the grandparent's mod points and give them to this. It seems that we have reached the bottom of the "trying too hard without any perspective" slippery slope. Maximum contrivance achieved.
Strange things are afoot at the Circle-K.
It's a feature for the advertisers. I'm going to be severely annoyed when an ad pauses when my phone gets tossed under a pillow. My typical ad-watching experience is to focus on whatever I've got on TV until the noise under the pillow stops.
He's getting rather old, but he's a good mouse.
This is one of those "attacks" which probably needs laboratory conditions to work, since ambient light from outside sources could easily interfere, especially if the device is not held still. Nice proof of concept, but in the real world? Meh.
Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.
I wonder if you can drive them nuts with a random homemade ambient light stobe. Or aim the sensor with another computer, which is also browsing.
I'm imagining how this would work while in rave like conditions...
New Digg member found. (See also others comments below. They already pointed out why this guy is an idiot.)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Access to a sensor, any sensor, enables information to leak. Microphone, camera, ambient light sensor, accelerometer, thermometer, battery level... These can all be used to glean some amount of information beyond what they're explicitly intended to gather.
Browser manufacturers, KNOCK THAT SHIT OFF! Quit giving websites access to everything. If there seems to be a good reason to give sensor data, average it over time or fuzz it to reduce malicious use. And give the user control over which sensors you report to which sites, with what degree of precision and accuracy. Too complicated? Too much for your users to handle? Then you should err on the side of privacy and just not give access to third parties.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.