How many of you use Google Chrome for surfing the Internet and feel safe while working on it? I think many of you. Chrome is one of the most trusted Web Browsers that provide a user friendly environment, but this we all know that every product has its negative side too, and so has Google’s Chrome.
Chrome has a 'Voice Recognition' feature, that use your system's microphone and allows you to speak instead of typing into any text box, to make hands-free web searches, quick conversions, and even to set reminders.
Google’s browser is also not immune to bugs and this time the new bug discovered in Chrome is capable to listen and record your whole private conversations without your knowledge, by abusing the voice recognition feature.
While working on ‘Annyang’, a speech-recognition script for websites, the web developer 'Tal Ater'discovered a vulnerability that can be exploited and lets malicious sites to turn your Google Chrome into a listening device, that can record anything said around your computer, even after you’ve left those sites.
Whenever a user visits a speech recognition site that offers them to control the site by using their voice, the Chrome asks permission to use a microphone, the user accepts. Chrome shows an icon in the notification area that your microphone is on which suppose to be turned off when you close that tab or visit another site.
All a malicious site has to do is get you to enable voice control for any legitimate purpose and shoot out a pop-under window disguised as an ordinary ad, to keep your microphone ON. As long as it remains open, every noise you make will be uploaded to the hacker's server without asking any permission.
He also explained that just by using secure HTTPS connections don’t mean that the site is safe. Once you give the permission to access your microphone for the HTTPS site, Chrome will remember and won’t ask your permission again for that site.
He reported the flaw to the Google security team in late September, 2013; they accepted the loophole, but never released the update to the desktop users.
A few weeks later, Tal Atar asked the Google Security Team about the reason for the delay in patch delivery, and they replied, “we are waiting for the web’s standards organization, the W3C group to agree on the best course of action”, and so your browser is still vulnerable.
After the public release of POC, the Google spokesperson said, "We’ve re-investigated and still believe there is no immediate threat, since a user must first enable speech recognition for each site that requests it. The feature is in compliance with the current W3C standard, and we continue to work on improvements."
He has published the source code for the exploit to encourage Google to fix it.
0 comments: