Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jitsi privacy flaw enables one-click stealth audio and video capture

zimzi.substack.com

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#21

Post by charcircuit »

morsch wrote: post #15
ginking wrote: post #10

Earlier quoted context omitted.

I would say it's to reduce friction - only grant permission once, rather than every time you join a jitsi meeting.

It's not so much about the permissions (which is a browser issue) but about the config.prejoinConfig.enabled flag: usually when joining a meeting, you get an interstitial page which let's you check your webcam image and sound settings before hitting join to enter the call. This setting (passed as a request param) skips that screen. I'm not a fan, either. I'm used to the interstitial page from other services, and in f…

Even without that enabled. You now have to keep the domain registered forever else an attacker can register the domain start recording people from it since permissions do not reset when site ownership changes.

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#22

Post by dathinab »

unsnap_biceps wrote: post #5

Can someone describe the feature that this is used for? I struggle to think of any valid reason for automatic joining with audio/video like that.

if it's embedded in another service and you already clicked join etc. through that other service to name one UX flow where an additional pre-join dialog would be not supper wanted

I e.g. would not complain if MS Teams (I have to use for work) would not put me into a pre join dialog every time I click join in Outlook but just joins me with mic muted/camera disabled by default. But then it also wouldn't be a security issue in my case as I put MS Teams and co. into it's own browser window/process/profile (not due to concerns but more as a side effect of them refusing to even trying to work on Firefox and not wanting to miss out on the tab sync + tab group + account container and not being allowed to install arbitrary extensions which add similar functionality to chrome).

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#23

Post by dathinab »

charcircuit wrote: post #21
morsch wrote: post #15

Earlier quoted context omitted.

It's not so much about the permissions (which is a browser issue) but about the config.prejoinConfig.enabled flag: usually when joining a meeting, you get an interstitial page which let's you check your webcam image and sound settings before hitting join to enter the call. This setting (passed as a request param) skips that screen. I'm not a fan, either. I'm used to the interstitial page from other services, and in f…

Even without that enabled. You now have to keep the domain registered forever else an attacker can register the domain start recording people from it since permissions do not reset when site ownership changes.

oh yes, that is such a dump design of web permissions

alongside of the abysmal UX for listing/removing them (from a "normal" user POV it's somehwhat usable for someone who understands tech a bit more)

like in general IMHO origin separation over time (e.g. permissions, cache, local storage) should be bound to some public key cryptography schema where the public key is shipped alongside DNS and every time it changes (or disappears) it's treated as a new origin.

So basically HPKP but 1. one key per origin, 2. separate from the TLS key, 3. way less harmful if messed up so actually just fine to use without worry to permanently lock yourself out.

Also maybe 4. crypto likeable to a group of person/company identity public keys detached from TLS and not spoofable by government DNS/TLS takeover attacks. But in a way where this system is added on top instead of being a building block to make it hard for regulators to effectively shut it down. Like I which police all luck to find all the criminals but history non stop shows we can't rely on governments not going crazy and start prosecuting people for just being different without different meaning "actively" hurting other people or entrapping and then persecuting people for having different political (or religious) opinions or other similar nonsense.

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#24

Post by dathinab »

firefax wrote: post #6

Is this understood to be new? I think I got hit with this quite a long time ago. (As in during the pandemic -- long ago in vuln times.) I am willing to discuss it, off the record, if someone provides their signal information.

yes, it's not new

it's probably also not just affecting Jitsi (in a context only looking at "proper" video conference systems)

through its exceedingly simple to archive with Jitsi

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#25

Post by capitainenemo »

3eb7988a1663 wrote: post #4

Not that I use Jitsi, but I suddenly feel more embarrassed about my number of open tabs. Some other exploit could have silently been launched long ago.

At least in Firefox, tabs recording have a pulsing red microphone on the favicon. I feel like you would have noticed, but perhaps you have so many that it is scrolled out of view?

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#26

Post by graemep »

cornholio wrote: post #14

This is clearly a major vulnerability and not a feature, it's a permissions/credentials hijack. The user has given permission for audio and videos recording to the jitsi domain during a previous meeting, and the domain is using those permissions to start an unsolicited meeting initiated by a 3rd party, who is given access to the video and audio of the victim.

Its also much less likely to be an issue if you self host Jitsi. its only really a worry for large public servers.

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#27

Post by kevin_thibedeau »

capitainenemo wrote: post #25
3eb7988a1663 wrote: post #4

Not that I use Jitsi, but I suddenly feel more embarrassed about my number of open tabs. Some other exploit could have silently been launched long ago.

At least in Firefox, tabs recording have a pulsing red microphone on the favicon. I feel like you would have noticed, but perhaps you have so many that it is scrolled out of view?

Old tabs aren't reloaded in Firefox until you click on them. With the pace of updates, tab hoarders are mostly safe.

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#29

Post by qualeed »

saghul wrote: post #28

Jitsi dev here. We are currently revisiting this. It exists because in cases such as when Jitsi Meet is being embdeed there are pre-join pages provided externally by the "host" site. We will be limiting how this can be used going forward.

Is/will there be any discussion on how initial triage of potential security issues will be handled in the future?

It was disappointing to see the responses in the post. A curt "It's a feature" to a valid security concern & disclosure, and not replying to a request to publish.

Jitsi says "We encourage responsible disclosure for the sake of our users, so please reach out before posting in a public space.". But if no one bothers to reply, why bother to reach out to Jitsi in the first place?

https://jitsi.org/ says, literally in the hero image banner, "More secure" as the first thing you see. The handling of this raises some concerns about that. (If you don't want to be scrutinized as much about privacy & security stuff, I would recommend not advertising "more secure" as the first thing people see on the site)

Post reply on HN