Jitsi privacy flaw enables one-click stealth audio and video capture
zimzi.substack.com
Jitsi privacy flaw enables one-click stealth audio and video capture
1–10 of 37 posts
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#2Does this apply even for iframes, or not?
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#3Does this apply even for iframes, or not?
Generally no - cross origin iframes don't allow camera/audio by default. Even if the toplevel site allows it (via https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameE...), user still needs to grant permissions to toplevel site. Of course you can still use window.open and top.location.href in the iframe and use the same trick as in the article.
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#4Not that I use Jitsi, but I suddenly feel more embarrassed about my number of open tabs. Some other exploit could have silently been launched long ago.
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#5Can someone describe the feature that this is used for? I struggle to think of any valid reason for automatic joining with audio/video like that.
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#6Is this understood to be new? I think I got hit with this quite a long time ago.
(As in during the pandemic -- long ago in vuln times.)
I am willing to discuss it, off the record, if someone provides their signal information.
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#7Is this understood to be new? I think I got hit with this quite a long time ago. (As in during the pandemic -- long ago in vuln times.) I am willing to discuss it, off the record, if someone provides their signal information.
Just throw it in an anonymous pastebin and give us a link
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#8Maybe my Mac is set to be paranoid, but can you share video without being asked to give the mic and camera permission to operate? I chat with jitsi all the time and have to give jitsi explicit permission to use the mic/camera each time.
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#9Where do I pay to read security research writeups with only cats used in explainer images and examples? This exploit is cute.
Re: Jitsi privacy flaw enables one-click stealth audio and video capture
#10Can someone describe the feature that this is used for? I struggle to think of any valid reason for automatic joining with audio/video like that.
I would say it's to reduce friction - only grant permission once, rather than every time you join a jitsi meeting.