Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

121–130 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#121

Post by jefftk »

reaperducer wrote: post #59
jefftk wrote: post #41

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se... ) Instead, I think the most likely…

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone You are correct, that is the author's concern. The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.

In this case there isn't a prompt: access to the camera and microphone is disallowed by default in cross-origin iframes. The site would have to specifically delegate permission to the ad before it could even trigger a prompt.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#122

Post by hetspookjee »

jefftk wrote: post #119
hetspookjee wrote: post #84

Earlier quoted context omitted.

Haha, easy way to create plausible deniability if you just allow everything to run :D. Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself? In addition, why is it hard to enforce a policy that disallows any ad to reach out to the camera and microphone? I don't understand why that is hard to enforce.

> Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself? Are you talking about crypto mining? That's a good example of something which is against policy but difficult to fully prevent technically. The core problem from someone trying to exploit this, however, is that crypto mining in the browser is minimally profitable, so you need to do a huge amount before seeing noticeable return…

Yes, I am talking indeed about crypto mining. I am also talking mostly about the aspect of wasting compute cycles and thus harming the environment through Google's means. Yes, it is minimally profitable, but that it is possible is weird if you ask me.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#123

Post by dubbelboer »

tehlike wrote: post #94

This is not google, but a third party ad network serving ads through google. Google tries to sandbox the creatives in an attempt to prevent issues exactly like this, and develops browser features to prevent issues exactly like this. This is likely a script that somehow avoided google's malware scanning pipelines. This is definitely not google's malintent. Disclaimer: Ex googler, worked in ads, dealed with problems li…

Not just ads, anyone can execute any code they like on tpc.googlesyndicatio.com. See: https://blog.dubbelboer.com/2016/06/10/embed-into-tpc-google...

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#124

Post by soared »

eganist wrote: post #97
tehlike wrote: post #94

This is not google, but a third party ad network serving ads through google. Google tries to sandbox the creatives in an attempt to prevent issues exactly like this, and develops browser features to prevent issues exactly like this. This is likely a script that somehow avoided google's malware scanning pipelines. This is definitely not google's malintent. Disclaimer: Ex googler, worked in ads, dealed with problems li…

> This is likely a script that somehow avoided google's malware scanning pipelines. I can't think of a good reason for scripts through google ad syndication to be asking for camera and microphone permissions. I'd assume Google runs these scripts in something like a lab environment to see what's ultimately invoked before deploying them to production? If so, would this be indicative of both a deliberate controls bypass…

Yes - banner ads are constantly targeted by malicious actors. My employer pays a vendor something like $200k/mo for creative scanning to avoid issues like this. Google certainly spends tens of millions a year trying to avoid issues like this.

See vendors like “the media trust”

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#125

Post by russh »

kadoban wrote: post #36
tmsbrg wrote: post #13

Earlier quoted context omitted.

That doesn't protect your microphone from being exposed though.

An icepick/paperclip does.

Yes, but travel is expensive and time consuming. Not to mention the effort it would take to track down the responsible party.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#126

Post by dubbelboer »

hyperman1 wrote: post #28
foota wrote: post #14

Is this just click bait? I don't know the intricacies of Google's ad serving, but is this not just someone (e.g., an ads customer) slipping a request for camera and mic access into an ad script? But the title seems to suggest Google is doing something malicious here.

Isn't Google supposed to vet whatever ads they send into the world? I don't know if this looks any better if Google is negligent/incompetent instead of malicious.

They don't vet anything, anyone can execute any code on tpc.googlesyndicatio.com. See: https://blog.dubbelboer.com/2016/06/10/embed-into-tpc-google...

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#127

Post by hutzlibu »

kadoban wrote: post #55
criddell wrote: post #50

Earlier quoted context omitted.

You should also destroy any speakers. https://arxiv.org/ftp/arxiv/papers/1611/1611.07350.pdf

Oof, that's unfortunate. Thanks for the tip.

But that hack requires deep OS access and is not trivial, but for those with a nation state agency behind them, good to keep in mind

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#128

Post by luckylion »

jefftk wrote: post #112
barneygale wrote: post #103

Earlier quoted context omitted.

I do wish google engineers would do something positive for society and switch to a career in subsistence farming. No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads.

But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.

"Made for Adsense" sites have no value, if they get shut down, nothing is lost. Normal sites that switched to Adsense have become worse, because now they need clicks and engagement above all else, incentivizing click-bait and low-effort content. Nothing would be lost if they switched to subscription models and provided valuable content. There's little in between in my opinion, it's either "site doesn't use Adsense, it's a company site / personal blog / some institution", "site was made only to make money by adsense with the lowest price content possible, had a bunch of links bought and now provides a passive income to some SEO" and "site used to provide quality content, loses readership to spam-sites because Google has fucked up their sorting algos and now switches to low-value content as well, because anything else can't be financed".

Twitch shows that people are very willing to pay for content. I'd very much be happy to if that removed all of the spam.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#129

Post by Ansil849 »

jefftk wrote: post #112
barneygale wrote: post #103

Earlier quoted context omitted.

I do wish google engineers would do something positive for society and switch to a career in subsistence farming. No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads.

But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.

If a website cannot survive without ads, maybe it doesn't need to actually exist in the first place. The world will go on.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#130

Post by jefftk »

hetspookjee wrote: post #122
jefftk wrote: post #119

Earlier quoted context omitted.

> Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself? Are you talking about crypto mining? That's a good example of something which is against policy but difficult to fully prevent technically. The core problem from someone trying to exploit this, however, is that crypto mining in the browser is minimally profitable, so you need to do a huge amount before seeing noticeable return…

Yes, I am talking indeed about crypto mining. I am also talking mostly about the aspect of wasting compute cycles and thus harming the environment through Google's means. Yes, it is minimally profitable, but that it is possible is weird if you ask me.

Sorry, what I meant was that it is minimally profitable at the best of times. Which means it doesn't take very much enforcement to shift it over to being negatively profitable, because it costs you more in time, engineering, etc. than you would make. And once it is a money losing proposition, the people trying to exploit users are no longer interested.
Post reply on HN