If you’re the kind of PC user who covers your machine’s camera for fear of someone hacking into your computer and spying on you, you might want to stick something in the tiny mic hole as well – especially if Chrome is your browser of choice.
A NY Times report Wednesday revealed that a web developer has found a way to listen through a computer’s mic – even when the user thinks it’s off – by exploiting a vulnerability in Google’s browser.
The security flaw was uncovered by Tel Aviv-based developer Tal Ater while working on a tool that adds voice recognition functionality to websites.
In a blog post titled ‘Chrome bug allows sites to listen to your private conversations’, Aviv explains how malicious websites can gain access to your mic and listen in on private conversations within earshot of your machine, “even after you’ve left those sites….as long as Chrome is still running.”
In normal circumstances when using Chrome, a red marker appears on a tab when you give a website access to your mic. However, Ater’s discovery shows that even when you think you’ve turned the mic off and the red indicator disappears, or you close the tab, a pop-under window that appeared when you granted the site access ensures that the mic remains active, capturing nearby audio for as long as the browser stays open.
According to a video (below) on Ater’s site, the mic can also be “programmed to stay dormant and only start recording once you’ve said certain interesting keywords” – functionality that may well have NSA agents choking on their coffee in excitement when they find out.
The Web developer explained on his site that he reported the bug to Google’s security team in September, after which they quickly acknowledged the issue. However, four months on, a fix still hasn’t been released.
An unnamed source told the NY Times the Web giant decided not to issue a fix because “the voice recognition tool complies with Web standards,” and instead the company is “working on better visual clues to show that access to the microphone has been given.”
Although Ater says he has no knowledge of any hackers having taken advantage of the flaw, the general message here is for Web users to be sure that any site asking to access a machine’s mic is legitimate.
With voice recognition software expected to gain much wider use in the coming years, Internet giants like Google and Apple will be keen to eliminate these kinds of issues in an effort to allay privacy concerns over such matters.
If you’re a Chrome user and you’d like to check which sites currently have access to your machine’s mic, take the following steps:
– Click on the Chrome menu at the top right of your browser
– Click on Settings
– Click on Show advanced settings at the bottom
– Click on Content settings under Privacy
– Click on Manage exceptions under Media (you’ll need to scroll down a little way for this)
– If you’ve granted access to any sites in the past, they’ll show up here.
[Image: dencg / Shutterstock]
