Malicious Use of the HTML5 Vibrate API
shkspr.mobi
Malicious Use of the HTML5 Vibrate API
1–10 of 67 posts
Re: Malicious Use of the HTML5 Vibrate API
#2It doesn't even have to be a website. Phone scammers have been doing stuff like this for ages with pretty low tech. A general rule of dealing with spam like this is "if the source is unknown and it's from a pretty woman or an investment firm, it's a scam". My phone's black list is quite long.
Of course, HTML-based ones can reach a larger number of users with little investment, so it's reasonable to expect this will occur more frequently in the future.
Re: Malicious Use of the HTML5 Vibrate API
#3this is already very possible if you create a phone app - its even more dangerous perhaps due to the lack of expectation of spam or traps from an app (although this is a perception which is changing I'm sure), but its already there as a risk.
Re: Malicious Use of the HTML5 Vibrate API
#4It is not impossible to conceive of malicious code being able to exploit an unpatched browser flaw and overdrive the motor to destruction.
Uhm, if your argument against a HTML5 API is "it's possible that the browser is hackable" then I don't see the discussion going very far. Like, you can use the same argument against HTTP support.
Combine it with a WebRTC call and you're looking at a very convincing scam.
WebRTC does require explicit user permissions.
I honestly don't see how the buzzing is in anyway crucial in in the explained examples. You can mimic real UI and trick users. This has been around on desktop for ages with fake Windows dialogs. Take away the buzz in the example on the webpage and the majority of people will still "pick up the phone".
Re: Malicious Use of the HTML5 Vibrate API
#5I'm surprised to learn that a web site doesn't need to ask for your permission to access the Vibrate API. I think there must be a warning screen with the list of permissions the web site wants, like the ones we're getting when installing apps from app stores but with a twist so you can disable individual permissions for a web site.
Re: Malicious Use of the HTML5 Vibrate API
#6Since HTML pages cannot open up by themselves, and user can navigate away, the risk is lower compared to a native app which can do far more damage. Never the less, permission mechanism should have been enabled.
Re: Malicious Use of the HTML5 Vibrate API
#7I'm surprised to learn that a web site doesn't need to ask for your permission to access the Vibrate API. I think there must be a warning screen with the list of permissions the web site wants, like the ones we're getting when installing apps from app stores but with a twist so you can disable individual permissions for a web site.
In Firefox right-click a page -> Page Info -> Permissions.
Some APIs are allowed by default and some aren't. For the discussion about Vibration, see: https://wiki.mozilla.org/WebAPI/Security/Vibration
Re: Malicious Use of the HTML5 Vibrate API
#8It is not impossible to conceive of malicious code being able to exploit an unpatched browser flaw and overdrive the motor to destruction. Uhm, if your argument against a HTML5 API is "it's possible that the browser is hackable" then I don't see the discussion going very far. Like, you can use the same argument against HTTP support. Combine it with a WebRTC call and you're looking at a very convincing scam. WebRTC do…
(OP here)
It's certainly not "crucial" - but it's a lot easier to trick someone by exploiting their brain's heuristics.
Phone vibrating means alert. I think that could be enough to trick people into overlooking elements like the title bar being visible, etc.
For example, I've noticed that some dodgy web adverts play the default Windows Error.wav when displaying a fake "Your codecs need updating" error dialogue. Not crucial, but adds credence.
I agree that the browser hacking is unlikely and probably shouldn't be mentioned.
Re: Malicious Use of the HTML5 Vibrate API
#9Since HTML pages cannot open up by themselves, and user can navigate away, the risk is lower compared to a native app which can do far more damage. Never the less, permission mechanism should have been enabled.
What about ads? The ones that now e.g. pretend to be Skype pop-ups.
Re: Malicious Use of the HTML5 Vibrate API
#10Are any of those examples really only convincing if they can vibrate the phone? Surely a scam that just involved that fake call screen while playing a fake ringtone would be more or less just as effective? I can't imagine it's a lot of people who wouldn't be fooled because they think "oh, it's fake, it's not vibrating" who would suddenly be fooled by this.