Google Chrome Eavesdropping Exploit Published

[Jack]

Content source

http://threatpost.com/chrome-eavesdropping-exploit-published/103798

The developer of the annyang speech recognition JavaScript library has published exploit code for a bug in Google’s Chrome browser that could allow a malicious website to eavesdrop using a computer’s microphone long after a visitor has left a website.

The code disclosure is in response, said developer Tal Ater of Israel, to Google’s decision not to release a patch for the vulnerability after acknowledging to him it was a problem.

Ater wrote on a post to his personal website that he reported the issue to Google on Sept. 13 and 11 days later the company informed him that a patch was ready; he soon learned he was also eligible for a $30,000 bounty as part of the Chromium Reward Panel.

More than a month later, however, Ater said Google had yet to release the patch and told him that the issue was mired with the W3C standards organization. The W3c, in November, updated itsWeb Speech API Specification and indications are that the behavior may be in line with the standard.

“The security of our users is a top priority, and this feature was designed with security and privacy in mind,” a Google spokesperson said via email.

​

In a demo, above, Ater’s exploit begins with a Chrome user engaging with a malicious website using the browser’s speech recognition capabilities. The exploit depends on a user giving the website permission to use the microphone. The site developed for the demo is a to-do list app, and once the user is done interacting with the list, the command is given to shut off the microphone. Chrome’s flashing red dot in the browser tab disappears leading the user to think speech recognition is off.

Read more: http://threatpost.com/chrome-eavesdropping-exploit-published/103798

 

[ZeroDay]

Thanks for the share.

 

[Dima007]

A while back, Google introduced what seemed to be a really cool feature – the ability to tell Chrome what to search for, just as you’d tell your Android phone. Now, however, it looks like this might be a big security vulnerability.

Malicious websites could use the computer

microphone to eavesdrop on your private conversations, an expert said.

The Chrome feature works as follows – users can enable it

by clicking on the microphone-like button on the search bar or utter the famous “OK Google” before launching a search. Chrome places a blinking red light in the tab and adds a camera icon in the address bar just so the user can easily spot the tabs that are listening in.

The feature can be exploited, however, and some sites could continue eavesdropping. Israeli developer

Tal Ater demonstrated this in a video

posted on YouTube. A site is given permission to access the microphone, which then continues to record everything. The audio is sent to Google for analysis before being sent to the site that made the request.

Once permission is granted, Chrome can start recording, especially when hearing key words that were programmed beforehand.

Ater alerted Google to the issue in September, choosing to tell it rather than just make everything public. Nearly two weeks later, Google said that a patch was ready and that his discovery was even eligible to a large reward from the bug bounty program

.

When the patch was still missing in November, he asked again, only to be told that a decision had yet to be made on the issue.

Now that he’s gone public with the information, Google reacted. In a message sent to Ars Technica, Google said that the security

of their users was a top priority. “We’re re-investigating and still believe there is no immediate threat, since a user must first enable speech recognition for each site that requests it. The feature is in compliance with the current W3C standard, and we continue to work on improvements.”

 

[Exterminator]

Threads merged.Posted previously by Jack on 1/23/2014

 

[Dima007]

Thanks

 

[Deleted member 178]

nothing is perfect especially Google stuff

privacy and Google is not good mix ^^