In Google Chrome, a visual indicator in the form of a red dot appears on the tab when a website records audio and video from the browser.
A Chrome bug was reported to Google by AOL web developer Ran Bar-Zik. He
told Bleeping Computer that he had discovered it while checking a website running WebRTC code. WebRTC allows websites to record streams for live streaming to other devices across the internet.
Due to the bug, websites can record audio and video content without showing the visual indicator. Still, the site requires user’s permission to access the microphone and webcam. So, the situation isn’t that serious. But it doesn’t mean it can’t be exploited.
According to Ran, the access permissions are given for a whole domain, so, it’s possible not to use the same tab to record streams. The attacker can show a pop-up (headless Chrome window) running the code to record audio and video streams. This pop-up won’t carry the red dot. To verify his claims, he created a test popup himself.
Demo pop-up can record audio when permissions are granted. No red dot.
The demo pop-up is included in the bug report Ran submitted to Google. After gaining permission, the pop-up records 20-second audio clips and provides a download link for the same. The code for his proof-of-concept is available as a zip file.
Contrary to what Ran believes, Google doesn’t consider the bug as a threat at all. That’s because the visual indicator isn’t present on all platforms where Chrome is available.
“This isn’t really a security vulnerability – for example, WebRTC on a mobile device shows no indicator at all in the browser. The dot is a best-first effort that only works on desktop when we have chrome UI space available. That being said, we are looking at ways to improve this situation,” Google replied.
Demo pop-up can’t record audio when permission not granted.
It might be possible that some people unknowingly grant access permissions and fail to recognize anything fishy due to the inconsistencies in the UI. This can lead to more sophisticated attacks.”Real attacks will not be very obvious,” said Ran when comparing these situations to the demo pop-up.
An evil pop-up might not even ask for a click like Ran’s demo. It can be as simple as an annoying advertisement which most of us don’t even realize is present alongside other browser windows until we close the web browser.
It’s possible for an attacker to time the pop-up according to their needs. It could possibly appear just for a moment to take a picture of the user or maybe even for hours.
Instead of setting up a whole website, according to Ran, it’s possible for an attacker to exploit cross-site scripting (XSS) flaws on trustworthy websites which have acquired access permissions from the user. The attacker can leverage the XSS flaws to deliver the attack code.
Google might not be entirely wrong
It’s unlikely that Google will push a bug fix as they don’t find Ran’s finding that alarming. Given the absence of the visual indicator on different Chrome variants, they might not be entirely wrong on their part. Also, the user plays a major role and has a choice of denying when asked for permissions.
Got something to add, drop your thoughts and feedback inside comments.
The Continue on PC feature is currently available to Windows Insiders, but it’ll arrive for regular users once the update starts landing on their PCs. If you’re running an Insider build, you can use the steps mentioned in this post to connect your phone to Windows 10 PC.
After months of wait, Poco has officially launched Poco F2 Pro. The phone is a sequel to the Poco F1 which was a huge success for the company back in 2018. It is also the second Poco contender in 2020. In February, the Poco brand revealed a new phone lineup and launched Poco X2. The phone was priced at Rs 15,999 and featured similar specs of Redmi K30, a Xiaomi flagship that was launched back in 2018. The company has applied the same strategy for today’s launch. As we expected, Poco F2 Pro bundles all the specs of Redmi K30 Pro that Xiaomi launched last month. Poco F2 Pro Specifications, Availability and Price Unlike the Poco X2, the phone offers a circular camera at the back and a pop-up selfie camera at the front as opposed to the regular dual-hole punch cutout on the display of Poco X2. Poco F2 Pro comes with a 6.67-inch FHD+ AMOLED display with a 92.7% screen to body ratio. On top of that, the phone has an in-display fingerprint sensor to keep up with...
Apart from all the major iOS 11 features and changes, there are some hidden and minor features as well. In this release, Apple has included a feature named Smart Invert Colors, which is the closest you can get while looking for an iOS 11 dark mode.
Qualcomm published in its official OnQ blog that the 5G data connection demonstration achieved gigabit download speeds using several 100 MHz 5G carriers. The demonstration utilized new 5G Protocol R&D Toolset and the UXM 5G Wireless Test
Comments
Post a Comment