The evolving PC technology is somehow contributing
to the increased threats and vulnerabilities. Latest on this front is that your
PCs can spy on your activity via not just the camera, but are able to hear you
as well and in a prudent way. And for this to take place, you just need Google
Chrome and a Microphone installed on your system.
Websites of today are capable of interacting with a
number of peripherals on PC, of course only after the users’ consent which can
take place by simply clicking the yes button. For picture uploading on a site
you just need to give the in-built camera the permission to click your picture.
This can however be prevented if the browser takes the user away from the webpage.
This throws light on an unnoticed truth that the websites, without consent of
users are continuing to control some part of the users activities carried
online.
A recent finding by an Israeli software developer
highlighted that vulnerabilities in the coding of Google Chrome which when
exploited by hackers, can turn any PC into an ideal source of spying. The only
thing needed will be convincing a user for a voice recognition capability, the
hacker after this will be able to record sound via a mic, even after the site
page has been closed. Also, a red blinking indicator present on the bar task of
the browser which shows recording in process is turned off, disguising users
that the process has terminated.
To present his proof of this finding, this Israeli hacker
recorded a video that how browsing a compromised site that uses speech to text
capabilities, can cause the sound to get recorded in the background. The sound
after recording is passed to Google servers to get in text form, which is
finally used by the hackers for unethical reasons.
What makes it worse is the fact that most such
speech-aware sites use secured https connection, which means Chrome recalled
the webpage about using microphone previously and so permission for the same
again is never asked. The vulnerability can be tweaked as well, where specific
words will trigger the start of the recording without even asking for any
permission. Means you have a readymade spying tool working on your PC.
Surprisingly however, Google already knew of this
loophole in September itself, and the software developer even made Google aware
about this vulnerability. Also, followed by this notification, representatives
at the company confirmed about the bug being fixed. Meanwhile, this was not
published even after four months, indicating how casually the developers at
this browser reacted.
No comments:
Post a Comment