Slashdot Mirror
Google Chrome Bug Lets Sites Record Audio and Video Without a Visual Indicator (bleepingcomputer.com)
New submitter aafrn writes: "Ran Bar-Zik, a web developer at AOL, has discovered and reported a bug in Google Chrome that allows websites to record audio and video without showing a visual indicator," reports BleepingComputer. "The bug is not as bad as it sounds, as the malicious website still needs to get the user's permission to access audio and video components, but there are various ways in which this issue could be weaponized to record audio or video without the user's knowledge. The bug's central element is a 'red circle and dot' icon that Chrome usually shows when recording audio or video streams." Bar-Zik discovered that if the JavaScript code that does the actual audio and video recording is launched inside a small popup, the icon is not shown anymore. This opens the door for various types of scenarios, where an attacker that has tricked a user into granting him permission to record audio and video records user data but when the user doesn't expect this (no visual indicator). For example, an attacker could disguise audio/video recording code inside popup ads. If the user doesn't close the popup, the popup continues to stream audio and video from the victim's house. Google declined to consider this a security bug.
"Google declined to consider this a security bug."
For companies like Google, this is a feature, not a bug.
The real bug is that someone gave Chrome access to the camera and microphone in the first place.
Google should be on the default blacklist for Windows and Android for "do not even let the app ask the user for permission; it's denied unless the user actively seeks out the permission and grants it after getting a 'only a stupid person would give Google access to their camera or microphone' warning followed by 'are you really sure you want to let Google spy on you 24/7?'."
Jewish Google? I think you mean Hindu Google.
And he Raaaaan, so far awaa-aaa-aaaaa,
And he Raaaaann to google right awaaa-aaa-aaa,
But they turned him away.
Come on, Flock of Seagulls , anyone? Beuller?
Google is recording YOU! Above what it already does! Yes, you SHOULD care!
Google being testy when someone else does what they do to them. Since Google stated this isn't a security flaw, there's no reason for AOL to withhold the bug until the fix.
It's only impacting Chrome on a PC, not Android.
Most cameras on PC's have an activity LED that's going to show up when it's active. This offers no way to bypass that LED.
The "red dot" has always been a "best efforts" indicator, since it's not visible to a user if they have too many tabs open or the browser is running in full-screen mode, same with the "audio playing" indicator.
The popup that is recording video still has the camera icon in its address bar.
The permission popup is non-modal so doesn't stop you accessing the page, lowering the risk of "UI fatigue" induced accepting. It's got no hot-key bound to "Accept". Escape will block the permission.
You could argue full-screen mode is an even worse security bug, since it hides the whole address bar, including HTTPS issues. All you have to do is trick the user into pressing F11. No broken HTTPS icon, no recording icon, no audio playing icon, no URL is shown.
Who has a legitimate use for popups other than ads? Especially popups of diminuitive size?
Keep digging your own graves, ad networks. We'll blocker harder and harder until there's either nothing left to exploit, or 'java' script dies the death it truly deserves.
Physical shutters on all webcams on laptops
if the JavaScript code that does the actual audio and video recording is launched inside a small popup,
I can't even recall the last time one of these vulnerabilities came by that was NOT enabled in some manner by javascript.
Anyone still running Javascript by default at this point is more or less asking for what they get. The attack surface is simply too huge to secure. We've seen problem after problem after problem since the dawn of the JS era.
Disable that shit by default, people, or stop griping about what you allow someone else to do with your computer.
Unsolved mystery since 1995: Why do web browsers support popup windows? It might be the worst idea since the <marquee> tag.
That's a record even for the Microsoft slashdot.
Beats me. I never understood why popup windows were useful in the first place
AOL has web developers? AOL has employees?
load "linux",8,1