Earlier quoted context omitted.
But mobile apps are required to ask for mic/camera permissions.
There are exploits that circumvent this, of course.
I don't think you'd waste an exploit like that to server a lawnmower ad.
An iframe from googlesyndication.com tries to access the camera and microphone
51–60 of 280 posts
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#52Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.
Well, it's HN. HN has become a FUD machine.
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#53Earlier quoted context omitted.
Has anyone seen any well done research showing these effects?
I've heard it from more folks than I'd like to. And counting them all as crazy or paranoid is less believable than the alternative.
> And counting them all as crazy or paranoid
Nobody is saying that. It's simply a quirk of human psychology. We are pattern matching machines with a poor intuitive grasp of probability.
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#54Earlier quoted context omitted.
also tape your laptop's camera
That doesn't protect your microphone from being exposed though.
That doesn't protect your microphone from being exposed though.
And ripping out your microphone doesn't stop evildoers from viewing the camera. What's your point?
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#55Re: An iframe from googlesyndication.com tries to access the camera and microphone
#56This sounds like one small piece of common fingerprinting techniques. It would have been nice to see the author address that possibility, but it seems fingerprinting is not mentioned.
IMHO, fingerprinting would explain the enumeration attempt, but not the attempt to access these devices.
Does accessing them give you extra fingerprinting data though? I would imagine that you can then enumerate at least the resolution of the camera.
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#57I don't think that it's google's fault. Google sometimes trade ads on auctions, meaning they issue and HTTP request to partners asking "Hey, you want to show an ad here", and partner respond with price and HTML code, the highest bidder wins and HTTP code is inserted. HTTP contains JavaScript, and theoretically anything can be executed within the browser (I've seen people mining bitcoins!). Google can't monitor an exe…
If Google can't guarantee no malicious javascript then they should strip all javascript.
If I serve any content to my users, then I'm responsible for any malware it contains.
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#58Earlier quoted context omitted.
It is served by Google. Google has an enormous amount of resources to vet the code that Google serves. They are skirting their obligation of due diligence.
It's hard to change the status quo when people's livelihoods are at stake. It's not just about Google, it's about all the sites running Google ads, and all the companies advertising through Google. If Google makes things sufficiently less profitable for all those parties, they'll just move elsewhere. Incremental progress is being made, like SafeFrames, but it's never going to be completely solved all at once.
Oh no, how will the poor advertisers survive if someone tries to stop them from shipping malware?
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#59The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se... ) Instead, I think the most likely…
The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone
You are correct, that is the author's concern.
The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.
Re: An iframe from googlesyndication.com tries to access the camera and microphone
#60Earlier quoted context omitted.
It's hard to change the status quo when people's livelihoods are at stake. It's not just about Google, it's about all the sites running Google ads, and all the companies advertising through Google. If Google makes things sufficiently less profitable for all those parties, they'll just move elsewhere. Incremental progress is being made, like SafeFrames, but it's never going to be completely solved all at once.
Oh no, how will the poor advertisers survive if someone tries to stop them from shipping malware?
The problem isn't that advertisers should be allowed to ship malware, it's that it's hard to distinguish malware from non-malware. Also the adjacent problem of "not quite malware, but shitty code that spams error logs and runs way slower than it should".