Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ultrasound Tracking Could Be Used to Deanonymize Tor Users

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#21

Post by gtufano »

renaudg wrote: post #16

>If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back... Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse. Even then, does e.g. iOS allow backgrounded apps to listen in on the microphone ? Pretty sure only Siri has that level of privilege. Has this whole ultrasound beacon thi…

Yes it's possible, but it leaves a red band on top (like the blue band of hotspot active. You can see it with Shazam (or equivalent) after you quit it for a few moment (just before the system kills it).

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#22

Post by gmarx »

What frequency are these apps using? I haven't looked it up but I doubt most computer speakers go above 15Khz (why would they?) A young person should be able to hear really high but audible tones and an adult would rapidly lose the ability. If this is not the case it would make sense to set a limit on the tones such a device can send and receive.

On the other hand there might be legitimate uses for such tech so maybe better to have it as a security option to send and receive ultrasound per individual, i.e. if I can't hear above 10khz maybe I can set my audio to not send or receive above that without app specific permission

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#23

Post by anshumanf »

gtufano wrote: post #21
renaudg wrote: post #16

>If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back... Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse. Even then, does e.g. iOS allow backgrounded apps to listen in on the microphone ? Pretty sure only Siri has that level of privilege. Has this whole ultrasound beacon thi…

Yes it's possible, but it leaves a red band on top (like the blue band of hotspot active. You can see it with Shazam (or equivalent) after you quit it for a few moment (just before the system kills it).

Does Android have a similar indicator for background apps recording audio?

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#24

Post by niftich »

This is mostly an awareness article that summarizes previously deployed techniques, and illustrates a situation where those techniques can cause maximum harm.

For background, a HN submission a year ago about these kinds of ads linking to phones, from Ars Technica [1], which some choice comments being one naming such an ad company [2] while a different subthread explores another [3][4].

Prior art in this space includes the work of Boris Smus [5], who then went on to develop the guest pairing mode for Chromecast using this technique. There have been other efforts over the years, some before, but certainly after, and of course the use of sound to transmit digital information is an old trick that makes modems possible, but in those days the lines didn't have the bandwidth to carry ultrasound.

[1] https://news.ycombinator.com/item?id=10562207 [2] https://news.ycombinator.com/item?id=10563384 [3] https://news.ycombinator.com/item?id=10563369 [4] https://news.ycombinator.com/item?id=10563031 [5] https://news.ycombinator.com/item?id=10562787

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#27

Post by anshumanf »

gmarx wrote: post #22

What frequency are these apps using? I haven't looked it up but I doubt most computer speakers go above 15Khz (why would they?) A young person should be able to hear really high but audible tones and an adult would rapidly lose the ability. If this is not the case it would make sense to set a limit on the tones such a device can send and receive. On the other hand there might be legitimate uses for such tech so maybe…

From some quick digging I did in a Github repo attempting to reverse-engineer the 'audio beacons', the frequencies used by at least one startup using the technique are in the 18kHz range[1].

https://github.com/MAVProxyUser/SilverPushUnmasked/commit/bc...

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#28

Post by kneel »

renaudg wrote: post #16

>If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back... Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse. Even then, does e.g. iOS allow backgrounded apps to listen in on the microphone ? Pretty sure only Siri has that level of privilege. Has this whole ultrasound beacon thi…

Amazon echo just earned it's name.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#29

Post by nkrisc »

0xdeadbeefbabe wrote: post #26

Is there an ultrasound scanner out there?

Do you mean something that simply listens for sound in those frequencies or decodes known signals as well? The latter would be pretty interesting to walk around dense urban and shopping centers with.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#30

Post by GrinningFool »

renaudg wrote: post #16

>If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back... Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse. Even then, does e.g. iOS allow backgrounded apps to listen in on the microphone ? Pretty sure only Siri has that level of privilege. Has this whole ultrasound beacon thi…

> Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse.

Does it? Aren't people generally in the habit of signing off on any access if they want what an app offers?

Post reply on HN