Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ultrasound Tracking Could Be Used to Deanonymize Tor Users

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#31

Post by kefka »

ergot wrote: post #15
deletia wrote: post #11

Earlier quoted context omitted.

This hosts file is updated regularly to help prevent accidentally stumbling upon (shock|malicious|etc) style sites: http://someonewhocares.org/hosts/hosts Been using it for a few months now and have found it invaluable.

Oh thanks for that! Does TOR honor the hosts file, specifically Tor Browser Bundle? I haven't tried.

https://hackaday.io/project/12985-multisite-homeofficehacker...

I don't believe so but my change in the Linux resolver daemon does honor the hosts file for all .onion entries.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#32

Post by 0xdeadbeefbabe »

nkrisc wrote: post #29
0xdeadbeefbabe wrote: post #26

Is there an ultrasound scanner out there?

Do you mean something that simply listens for sound in those frequencies or decodes known signals as well? The latter would be pretty interesting to walk around dense urban and shopping centers with.

Yes, the latter. If this attack is possible ultrasound driving ought to be possible too.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#33

Post by WiseWeasel »

Another reason to browse with the Mute Tab add-on enabled:

https://addons.mozilla.org/en-us/firefox/addon/mute-tab/

All tabs default to muted, and you can selectively un-mute tabs or whitelist sites as needed.

I've certainly appreciated the default state of pages being muted.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#34

Post by noonespecial »

renaudg wrote: post #25
noonespecial wrote: post #12

Time to start selling speakers with bandpass filters built in. It's the new tape over the camera.

Technically lowpass :)

Ahh but what about subsonic messages? Slow datarate to be sure but definitely possible.

If there's any monkey business going on with my audio, I want it in the range where I can hear it!

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#35

Post by shostack »

kneel wrote: post #28
renaudg wrote: post #16

>If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back... Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse. Even then, does e.g. iOS allow backgrounded apps to listen in on the microphone ? Pretty sure only Siri has that level of privilege. Has this whole ultrasound beacon thi…

Amazon echo just earned it's name.

And I'm not sure there is anything stopping a Tap from listening without you knowing.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#36

Post by noir_lord »

WiseWeasel wrote: post #33

Another reason to browse with the Mute Tab add-on enabled: https://addons.mozilla.org/en-us/firefox/addon/mute-tab/ All tabs default to muted, and you can selectively un-mute tabs or whitelist sites as needed. I've certainly appreciated the default state of pages being muted.

Thanks for that link, added to my list of "Plugins I didn't know I wanted until I saw them" :).

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#37

Post by EGreg »

nthcolumn wrote: post #13
jbob2000 wrote: post #3

Wait what? How can a webpage play a sound if my speakers are muted? How do they bypass the little sound notification on my tabs? >If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back one or more advertisers with details about his device, so the advertiser can build an advertising profile on the user, linking his computer with his phone. Th…

Adblock that! This is pretty alarming actually - that advertisers are willing to go to such lengths, perhaps excuse my naïveté. The receiver could be someone else's device eg next door. Sure it has implications for an activist in London using tor but what about the rest of us? How can I easily tell whether a page is listening? Feedback maybe?

This is great! It's like bugtesting the anonymity cloak. Keep the bug reports coming and we will keep patching it :)

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#38

Post by EGreg »

shostack wrote: post #35
kneel wrote: post #28

Earlier quoted context omitted.

Amazon echo just earned it's name.

And I'm not sure there is anything stopping a Tap from listening without you knowing.

Any device that is listening all the time can be storing and sending anything you said. How would you know if it's encrypted?

There has GOT TO BE a better way. Such as a filter made by independent manufacturers that opens the sound channel only when you say a specific phrase such as "OK Google" and closes it when you press a button or stop speaking. And an indicator would be visible when it's actually listening.

The question is, how to prevent collusion with the independent filter companies? There has to be SOME WAY to open source hardware and prevent companies from essentially performing their own interdiction on it:

https://www.google.com/amp/www.theverge.com/platform/amp/201...

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#39

Post by ChartsNGraffs »

gmarx wrote: post #22

What frequency are these apps using? I haven't looked it up but I doubt most computer speakers go above 15Khz (why would they?) A young person should be able to hear really high but audible tones and an adult would rapidly lose the ability. If this is not the case it would make sense to set a limit on the tones such a device can send and receive. On the other hand there might be legitimate uses for such tech so maybe…

Things like Apple TV/Chromecast are serving ads and are hooked up to audio systems that are usually quite capable. And this could easily just shift to being done within the range of computer speaker production/human hearing and it would sound like a glitch at best (if audible at all).

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#40

Post by jcl »

joncrocks wrote: post #9
jbob2000 wrote: post #3

Wait what? How can a webpage play a sound if my speakers are muted? How do they bypass the little sound notification on my tabs? >If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back one or more advertisers with details about his device, so the advertiser can build an advertising profile on the user, linking his computer with his phone. Th…

> How can a webpage play a sound if my speakers are muted? Well it can't obviously, but lots of people (although maybe not the types of people who use tor) browse the internet with their speakers on and active. Most people don't unmute their speakers just before they're about to listen to something. > How do they bypass the little sound notification on my tabs? Admittedly they probably can't, but are you sure you're…

FWIW, there was a BBC article about always-on audio detector apps. Describing an Android proof-of-concept app: "The battery drain during our experiments was minimal and, using wi-fi, there was no data plan spike."

http://www.bbc.com/news/technology-35639549

Post reply on HN