The developer of the annyang speech recognition JavaScript library has published exploit code for a bug in Google’s Chrome browser that could allow a malicious website to eavesdrop using a computer’s microphone long after a visitor has left a website.
The code disclosure is in response, said developer Tal Ater of Israel, to Google’s decision not to release a patch for the vulnerability after acknowledging to him it was a problem.
Ater wrote on a post to his personal website that he reported the issue to Google on Sept. 13 and 11 days later the company informed him that a patch was ready; he soon learned he was also eligible for a $30,000 bounty as part of the Chromium Reward Panel.
More than a month later, however, Ater said Google had yet to release the patch and told him that the issue was mired with the W3C standards organization. The W3c, in November, updated its Web Speech API Specification and indications are that the behavior may be in line with the standard.
“The security of our users is a top priority, and this feature was designed with security and privacy in mind,” a Google spokesperson said via email.
https://www.youtube.com/watch?v=s5D578JmHdU
In a demo, above, Ater’s exploit begins with a Chrome user engaging with a malicious website using the browser’s speech recognition capabilities. The exploit depends on a user giving the website permission to use the microphone. The site developed for the demo is a to-do list app, and once the user is done interacting with the list, the command is given to shut off the microphone. Chrome’s flashing red dot in the browser tab disappears leading the user to think speech recognition is off.
But the exploit proves just the opposite is true.
“As long as Chrome is running, nothing that is said next to your computer is private,” the demo said.
The demo continues and the user has closed the site authorized to use speech recognition and has moved on to another website. No indication is showing that audio is being recorded, however the browser is listening, Ater said.
A hidden pop-under, disguised as a banner advertisement, is revealed that is capturing the text of the audio, sending it to Google where it is automatically analyzed and sent back to the malicious site, Ater said. In the current version of Chrome, however, Google has fixed the code and now forces pop-under ads to appear on top of the window being viewed.
“What you see here essentially turns Google Chrome into an espionage tool,” the demo said. “It compromises your privacy in your office or your home, even when you’re not using the computer. Anything said within earshot of your computer can be captured by malicious parties.”
Ater said the exploit can be programmed to stay dormant and activate only when certain keywords are said. He also said that while most sites that use speech recognition do so over HTTPS, Chrome will still remember that a user granted the site permission to use the microphone and allow it to start listening once the user visits again. With Ater’s exploit, the indicator light in Chrome will not flash and the user will not know they’re being eavesdropped.
“When you click the button to start or stop the speech recognition on the site, what you won’t notice is that the site may have also opened another hidden pop under window. This window can wait until the main site is closed, and then start listening in without asking for permission,” Ater wrote on his site. “This can be done in a window that you never saw, never interacted with, and probably didn’t even know was there. To make matters worse, even if you do notice that window (which can be disguised as a common banner), Chrome does not show any visual indication that speech recognition is turned on in such windows – only in regular Chrome tabs.
