Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

61–70 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#61

Post by streptomycin »

jasonjayr wrote: post #49
streptomycin wrote: post #39

Earlier quoted context omitted.

It's a problem, but it's not "the" problem. The problem is that letting advertisers write their own JS means advertisers are willing to pay more for the ad. If Google banned that practice, or put in a lot of oversight, people would pay less for ads through Google. But some other ad networks would still allow the bad practices, and thus be able to pay higher rates. So sites would just move more ads to those other netw…

Those other networks would start getting blocked hard with adblock/DNS block/public shaming of sites using them.

Ad blockers already block all ad networks. And the status quo is that all ad networks have ads with shitty JS, and public shaming doesn't seem to have done much about it.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#62

Post by not2b »

streptomycin wrote: post #42
Rygian wrote: post #33

Earlier quoted context omitted.

It is served by Google. Google has an enormous amount of resources to vet the code that Google serves. They are skirting their obligation of due diligence.

It's hard to change the status quo when people's livelihoods are at stake. It's not just about Google, it's about all the sites running Google ads, and all the companies advertising through Google. If Google makes things sufficiently less profitable for all those parties, they'll just move elsewhere. Incremental progress is being made, like SafeFrames, but it's never going to be completely solved all at once.

Banning malware won't make things significantly less profitable. Quite the opposite: it will save their business, because if they allow these practices to persist, or even get worse, everyone will be forced to block ads to protect themselves.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#63

Post by veeti »

jefftk wrote: post #41

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se... ) Instead, I think the most likely…

Curiously no explanation why this sort of malicious behavior is accepted by "Google Ad Manager" in the first place.

If you haven't already installed: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#64

Post by streptomycin »

jasonjayr wrote: post #48
streptomycin wrote: post #20

Shitty ad code barfing errors onto the console is typical, unfortunately. The JS is not written by Google, it's written by the individual advertiser, with very limited oversight.

Google (+ apple) Control their mobile platforms and take responsibility for apps served through their respective stores. Why can't they do the same with their ad networks? Transpile any JS code served from their network into a safe execution environment/api that only permits the resources allowed safely?

The SafeFrame stuff is an attempt to move in that direction, but it is far from perfect. Hopefully that will continue to improve.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#65

Post by jdavis703 »

underscore_ku wrote: post #10
akersten wrote: post #6

The Exhibit A why no one will ever convince me to turn off my ad blocker or switch away from Firefox. It's a great feeling to just not have to worry about this entire class of exploits.

also tape your laptop's camera

My laptop is mostly closed and plugged in to an external monitor. The mic is so muffled by then, it would take expert audio recovery to understand what was being said. (In other words, it would be hard to scale it for ad purposes, but obviously a targeted attack could still be devastating).

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#66

Post by myself248 »

michael-ax wrote: post #47
beeboop wrote: post #27

Earlier quoted context omitted.

this is why we need hardware switches for microphones

fwiw, there's a switch in every ext. mic. jack. plug in an un-wired connector, cut of the wiring post, smooth with a nail-file or put on a crowning drop of glue so it won't rip your bag and you're done.

Often these are software, though. Yes there's a switch, but it just tells the audio subsystem to automatically select the plugged-in mic. You can still tell it to select the screen-frame mic instead.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#67

Post by ethbr0 »

reaperducer wrote: post #59
jefftk wrote: post #41

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se... ) Instead, I think the most likely…

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.

This is a catch-22 though.

If something dangerous to privacy is being widely used in the world, then putting it behind a prompt creates an avalanche of prompts, and results in user apathy.

But not prompting requires you to choose a default, which either default to block and breaks things (if it was actually required) or defaults to allow.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#68

Post by streptomycin »

not2b wrote: post #62
streptomycin wrote: post #42

Earlier quoted context omitted.

It's hard to change the status quo when people's livelihoods are at stake. It's not just about Google, it's about all the sites running Google ads, and all the companies advertising through Google. If Google makes things sufficiently less profitable for all those parties, they'll just move elsewhere. Incremental progress is being made, like SafeFrames, but it's never going to be completely solved all at once.

Banning malware won't make things significantly less profitable. Quite the opposite: it will save their business, because if they allow these practices to persist, or even get worse, everyone will be forced to block ads to protect themselves.

Malware is already banned. The problem is detecting it with 100% accuracy, or sandboxing it with no ability to break out. A lot of people are working on it, both at Google and other companies.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#69

Post by ravenstine »

tomudding wrote: post #31

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…

In my experience, with tools like Cover Your Tracks (apparently this is the new name for Panopticlick), the more you try and thwart fingerprinting, the more unique you appear. Although I still do everything I can to block and filter everything conceivable, I've given up on trying to figure out how identifiable I am on the web because it seems useless. If you don't try then you're identifiable, and if you do then you are probably more identifiable. Whatever.
Post reply on HN