- Jan 24, 2011
- 9,378
The developer of the annyang speech recognition JavaScript library has published exploit code for a bug in Google’s Chrome browser that could allow a malicious website to eavesdrop using a computer’s microphone long after a visitor has left a website.
The code disclosure is in response, said developer Tal Ater of Israel, to Google’s decision not to release a patch for the vulnerability after acknowledging to him it was a problem.
Ater wrote on a post to his personal website that he reported the issue to Google on Sept. 13 and 11 days later the company informed him that a patch was ready; he soon learned he was also eligible for a $30,000 bounty as part of the Chromium Reward Panel.
More than a month later, however, Ater said Google had yet to release the patch and told him that the issue was mired with the W3C standards organization. The W3c, in November, updated itsWeb Speech API Specification and indications are that the behavior may be in line with the standard.
“The security of our users is a top priority, and this feature was designed with security and privacy in mind,” a Google spokesperson said via email.
In a demo, above, Ater’s exploit begins with a Chrome user engaging with a malicious website using the browser’s speech recognition capabilities. The exploit depends on a user giving the website permission to use the microphone. The site developed for the demo is a to-do list app, and once the user is done interacting with the list, the command is given to shut off the microphone. Chrome’s flashing red dot in the browser tab disappears leading the user to think speech recognition is off.
Read more: http://threatpost.com/chrome-eavesdropping-exploit-published/103798
The code disclosure is in response, said developer Tal Ater of Israel, to Google’s decision not to release a patch for the vulnerability after acknowledging to him it was a problem.
Ater wrote on a post to his personal website that he reported the issue to Google on Sept. 13 and 11 days later the company informed him that a patch was ready; he soon learned he was also eligible for a $30,000 bounty as part of the Chromium Reward Panel.
More than a month later, however, Ater said Google had yet to release the patch and told him that the issue was mired with the W3C standards organization. The W3c, in November, updated itsWeb Speech API Specification and indications are that the behavior may be in line with the standard.
“The security of our users is a top priority, and this feature was designed with security and privacy in mind,” a Google spokesperson said via email.
In a demo, above, Ater’s exploit begins with a Chrome user engaging with a malicious website using the browser’s speech recognition capabilities. The exploit depends on a user giving the website permission to use the microphone. The site developed for the demo is a to-do list app, and once the user is done interacting with the list, the command is given to shut off the microphone. Chrome’s flashing red dot in the browser tab disappears leading the user to think speech recognition is off.
Read more: http://threatpost.com/chrome-eavesdropping-exploit-published/103798