Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Chrome Bug Lets Sites Record Audio and Video Without a Visual Indicator (bleepingcomputer.com)

Posted by BeauHD on from the visual-learning dept.

New submitter aafrn writes: "Ran Bar-Zik, a web developer at AOL, has discovered and reported a bug in Google Chrome that allows websites to record audio and video without showing a visual indicator," reports BleepingComputer. "The bug is not as bad as it sounds, as the malicious website still needs to get the user's permission to access audio and video components, but there are various ways in which this issue could be weaponized to record audio or video without the user's knowledge. The bug's central element is a 'red circle and dot' icon that Chrome usually shows when recording audio or video streams." Bar-Zik discovered that if the JavaScript code that does the actual audio and video recording is launched inside a small popup, the icon is not shown anymore. This opens the door for various types of scenarios, where an attacker that has tricked a user into granting him permission to record audio and video records user data but when the user doesn't expect this (no visual indicator). For example, an attacker could disguise audio/video recording code inside popup ads. If the user doesn't close the popup, the popup continues to stream audio and video from the victim's house. Google declined to consider this a security bug.

5 of 36 comments (clear)

  1. A bug.. or is it? by Anonymous Coward · · Score: 5, Insightful

    "Google declined to consider this a security bug."

    For companies like Google, this is a feature, not a bug.

    1. Re:A bug.. or is it? by TWX · · Score: 3, Insightful

      Makes me wonder if they got one of those national security letters warning them against fixing the vulnerability that allows this to happen.

      --
      Do not look into laser with remaining eye.
    2. Re:A bug.. or is it? by Anonymous Coward · · Score: 0, Insightful

      Hey dipshit,

      Google recording something on a google site using google chrome (which I've allowed) but without making me aware of it (which I don't consent to) is a security bug. Shut the fuck up with your "Because the user has still explicitly " because you've given a stupid excuse for this bad behavior.

  2. Re:the real bug by viperidaenz · · Score: 3, Insightful

    Google/Phone manufacturer already has access to the camera on your phone.
    Who do you think makes the Camera app? That's an app you're pretty much guaranteed to require the Camera and Audio permissions and it pre-installed. It's probably also got location permissions as well for geo-tagging.
    If they wanted to spy on you, that's the easiest way to do it.

  3. I agree, it's a non-issue by viperidaenz · · Score: 5, Insightful

    It's only impacting Chrome on a PC, not Android.
    Most cameras on PC's have an activity LED that's going to show up when it's active. This offers no way to bypass that LED.
    The "red dot" has always been a "best efforts" indicator, since it's not visible to a user if they have too many tabs open or the browser is running in full-screen mode, same with the "audio playing" indicator.

    The popup that is recording video still has the camera icon in its address bar.
    The permission popup is non-modal so doesn't stop you accessing the page, lowering the risk of "UI fatigue" induced accepting. It's got no hot-key bound to "Accept". Escape will block the permission.

    You could argue full-screen mode is an even worse security bug, since it hides the whole address bar, including HTTPS issues. All you have to do is trick the user into pressing F11. No broken HTTPS icon, no recording icon, no audio playing icon, no URL is shown.