Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

21–30 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#21

Post by kzrdude »

marcellus23 wrote: post #11
jessaustin wrote: post #2

We have a chance to notice this when it's mediated by a browser. Native apps don't barf all over the console and thus escape such scrutiny. I first considered this when a friend told me about a brand of lawnmower of which I had never heard let alone searched (mowing lawns is the least interesting activity I can imagine), and one minute later a podcast app had a big banner at the top by which I could purchase a lawnmo…

But mobile apps are required to ask for mic/camera permissions.

There are exploits that circumvent this, of course.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#22

Post by oblak »

foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

You're right. Google would never compromise anyone to make some money. Never

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#23

Post by masswerk »

htunnicliff wrote: post #12

This sounds like one small piece of common fingerprinting techniques. It would have been nice to see the author address that possibility, but it seems fingerprinting is not mentioned.

IMHO, fingerprinting would explain the enumeration attempt, but not the attempt to access these devices.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#24

Post by guptaneil »

jessaustin wrote: post #2

We have a chance to notice this when it's mediated by a browser. Native apps don't barf all over the console and thus escape such scrutiny. I first considered this when a friend told me about a brand of lawnmower of which I had never heard let alone searched (mowing lawns is the least interesting activity I can imagine), and one minute later a podcast app had a big banner at the top by which I could purchase a lawnmo…

This is a common belief that phones must be listening to us because ads are so targeted, but the scary truth is they aren’t[0] because they don’t need to. They have far more effective ways of targeting ads. For example, the reason you probably saw the lawnmower ad is because your friend searched for lawnmowers, and google knows they are friends with you, so they showed you targeted ads too because you might recommend that brand if you talk or you might subconsciously register that brand and reaffirm their decision to buy with something like “oh yeah I’ve heard of X, they’re supposed to be the best” without remembering where you saw that. It’s even possible you got the ad before your chat but didn’t notice because you had no reason to pay attention to a lawnmower ad.

This is why data privacy is so important even if you feel like you have nothing to hide.

0: as you note, they technically have the ability to do so and random apps could be but the amount of effort it would take to record, transcribe, and evaluate that much data just isn’t worth it when most users voluntarily give their info anyway. This is why I don’t use a phone, browser, or email service created by an ad tech company though and it boggles my mind how many people are ok with that.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#25

Post by kadoban »

foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

Why the _hell_ should a Google ads customer be able to "slip" in a request for camera and mic? That that is even possible is a large problem.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#26

Post by newbamboo »

tmsbrg wrote: post #13
underscore_ku wrote: post #10

Earlier quoted context omitted.

also tape your laptop's camera

That doesn't protect your microphone from being exposed though.

Don’t talk to your computer. When you do talk, talk about stuff that you want them to look into.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#28

Post by hyperman1 »

foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

Isn't Google supposed to vet whatever ads they send into the world?

I don't know if this looks any better if Google is negligent/incompetent instead of malicious.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#29

Post by vklmn »

I don't think that it's google's fault. Google sometimes trade ads on auctions, meaning they issue and HTTP request to partners asking "Hey, you want to show an ad here", and partner respond with price and HTML code, the highest bidder wins and HTTP code is inserted.

HTTP contains JavaScript, and theoretically anything can be executed within the browser (I've seen people mining bitcoins!).

Google can't monitor an execute every HTML snippet, but they doing pretty great job sampling responses and evaluating some of them. Fraudsters are smart, and trying to understand if the code is executed on Google's servers, but overall they are loosing.

It seems like a case where google's system didn't work.

By they way, all google partners are listed here: https://developers.google.com/third-party-ads/adx-vendors. Usually, it's possible to track down who's exactly responsible by looking at dev console

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#30

Post by kadoban »

streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

> "with very limited oversight"

I think I found the problem.

Post reply on HN