Audio Spying using Google Chrome HOT !

[Bob]

Please see this post in the Forum Current Events news -
http://projectavalon.net/forum4/showthread.php?67736-GMAIL-BLOGGER-crashed&p=788641&viewfull=1#post788641

This post details a current spying technique which some seem to think is a "feature", and not a bug in the Chrome Browser of Google..

https://code.google.com/p/chromium/issues/detail?id=268386&q=speech&sort=-modified&colspec=ID%20Pri%20M%20Iteration%20ReleaseBlock%20Cr%20Status%20Owner%20Summary%20OS%20Modified - explains what happens.

A user can go to a website, and if there is a particular JAVA SCRIPT running that can turn on the mike, if it does, the mike is turned on and one does NOT get any indication that it is turned on.

HOW DO YOU PROVE a website is not using JAVA SCRIPT to do such?

HOW CAN YOU GET AN ASSURANCE from the website writer, operator, admin that they are NOT using JAVASCRIPT to turn on the mike?

Good questions - I have no way of answering those.

Issue 268386: Voice search: microphone works even though it is disabled


http://trtpost.wpengine.netdna-cdn.com/files/2014/01/shutterstock_169580561-680x400.jpg


There have been extensive threads on the FORUM about putting tape over the CAMERA.. BUT as far as I can tell, nobody has discussed or addressed the MICROPHONE eavesdropping issue.

http://threatpost.com/chrome-eavesdropping-exploit-published/103798 - this is HOT and traveling across the internet as we write.

[Bob]

On this website, author, annyang has posted

"annyang is a tiny javascript library that lets your visitors control your site with voice commands.
annyang supports multiple languages, has no dependencies, weighs just 2kb and is free to use."

https://www.talater.com/annyang/

that means the code is virtually invisible in the javascript code for websites.

"Ready to get started?

Grab the latest version of annyang.min.js, drop it in your html, and start adding commands.

…or just say "let's get started!" to visit annyang on GitHub."

Some people though are not "amused" at the simplicity for eavesdropping spyware being claimed as a useful "feature"

"Chris Morris · Fort Worth, Texas
Is there a way to disable the speech recognition in Chrome altogether? Registry edit or Group Policy perhaps? Have several clients that are financial institutions and law firms that use Chrome, but do not want this option to be available at all.
Thanks in advance.."

[Lifebringer]

It's why I still have Yahoo classic page and don't do chrome. I read all that bliddybladdy privacy crap and when I did and they said they aren't responsible for 3rd party spying ie Google/Goggles, I refused it, unchecked it and didn't allow it on AVG. Don't do Google anything, they are NSA on steroids. I barely go to YT to watch a movie now and when I watch a video I always scan computer when it's over and pick up their cookies and spy apparatus, that AVG just loves to snatch and quarantine.

[Tesla_WTC_Solution]

Bobd, can yahooapis do this and is that a Java script?
I heard it links to a developer site and it is constantly running on my machine, not sure why yahoo is activated when i am not using their services at the moment i see the program running.

Thanks for your interest and help in this matter.
I appreciate how much you are able to understand and share.

actually you are one of the only people who understands some of the crap in my posts --

Thank you!!


http://developer.yahoo.com/

http://developer.yahoo.com/everything.html

http://pipes.yahoo.com/pipes/

http://www.styleforum.net/t/257104/yahooapis-com-scripts-being-run

I use noscript to catch these jerks.


http://stackoverflow.com/questions/9644864/grabbing-data-from-yahoos-api-using-json

Grabbing data from Yahoo's API using JSON

https://www.dartlang.org/docs/tutorials/fetchdata/

Web applications often use JSON (JavaScript Object Notation) to pass data between clients and servers. Data can be serialized into a JSON string, which is then passed between a client and server, and revived as an object at its destination. This tutorial shows you how to use functions in the dart:convert library to produce and consume JSON data. Because JSON data is typically loaded dynamically, this tutorial also shows how a web app can use an HTTP request to get data from an HTTP server. For web apps, HTTP requests are served by the browser in which the app is running, and thus are subject to the browser’s security restrictions.

[chocolate]

I just unplugged the mic I use to talk to my sis on skype. I use a seemingly old type computer [which is actually a monster inside, but just well covered], and I don't care all that much about the spying, as long as they cannot log into my mind [although with that kind of spying they can guess-timate what is going on in my mind], but every now and again it just irritates me.

If someone thinks yahoo is safer, think twice! they are all linked.

At one point I started to figure out how to use tor browser, https://www.torproject.org/projects/torbrowser.html.en but have suspended that in the air until I find myself with some more time on my hands.

Recently I read that the crash/error reports that you might decide to send back to Microsoft (if anyone), can and are used to piggyback and install little spies into your system to track you down ...

[Tesla_WTC_Solution]

I just unplugged the mic I use to talk to my sis on skype. I don't care all that much about the spying, as long as they cannot log into my mind [although with that kind of spying they can guess-timate what is going on in my mind], but every now and again it just irritates me.
If someone thinks yahoo is safer, think twice! they are all linked.
At one point I started to figure out how to use tor browser, https://www.torproject.org/projects/torbrowser.html.en but have suspended that in the air until I find myself with some more time on my hands.

I hate computers so much (although hooked) nowadays that "mentally vocalizing" my password while typing it creeps me out.
lol

[Sidney]

I just unplugged the mic I use to talk to my sis on skype. I don't care all that much about the spying, as long as they cannot log into my mind [although with that kind of spying they can guess-timate what is going on in my mind], but every now and again it just irritates me.
If someone thinks yahoo is safer, think twice! they are all linked.
At one point I started to figure out how to use tor browser, https://www.torproject.org/projects/torbrowser.html.en but have suspended that in the air until I find myself with some more time on my hands.


I have a hunch they have the mind scan/hack down to a fine art by now.

[778 neighbour of some guy]

I snapped of a toothpick in my mike to plug it a long time ago, but my laptop still has speakers, so there you go, no clue if they can be used as a mike, I know for sure a pair of earbud headphones can work as a speaker as well as a mike, so why not the speakers on your computer too eh?

:(rats:(

[chocolate]

I just saw that toothpick. :) [sometimes i do stuff like that too]
Yep, there was a news for that also. Some kind of virus was able to hack into your computer through your speakers.

:(rats:( :)

[778 neighbour of some guy]

I just saw that toothpick. :) [sometimes i do stuff like that too]
Yep, there was a news for that also. Some kind of virus was able to hack into your computer through your speakers.

:(rats:( :)

Don't know about viruses hacking in through the speakers, seems unlikely but its not hard to imagine a speaker as a send as well receive device imo.

[Tesla_WTC_Solution]

*visualizes huge class action lawsuit against NSA industrial espionage*

Imagine how many sensitive conversations were stupidly conducted near such tech.

:( MIND-BOGGLE

[Shezbeth]

I could describe it as sad - and overwhelmingly it is IMO - but at this stage in the game one has to treat just about any technology as being the 'screen' from 1984.

I can't verify from personal experience, but I have read/heard that the following devices could theoretically contain deliberately subversive hardware, or be used subversively by individuals who are want. I mean, all it would take is an extra chip or two on a circuit board,... (but they'd NEVER do that x_x)

Computers (and all peripheral devices)
TV's
Cable boxes n DVD players
Video game consoles
and of course Cell AND land phones.

Further, I have read reports about newer devices being able to communicate directly with those confounded smart meters, the degree of which I can only imagine.

[DeDukshyn]

Anyone have Flash installed on their PC? Flash player can also in theory access any mic and camera on your PC. (and I imagine Silverlight can as well)

Right click on a flash video and go through all the settings and make sure that access is turned off (but I still don't think that would be a 100% solution)

[Bob]

Anyone have Flash installed on their PC? Flash player can also in theory access any mic and camera on your PC. (and I imagine Silverlight can as well)

Right click on a flash video and go through all the settings and make sure that access is turned off (but I still don't think that would be a 100% solution)

The exploit that the fellow (maybe a developer) on the Chrome developer/tester site https://code.google.com/p/chromium/i...0OS%20Modified - had been discussing the FLASH application, and there was a discussion about turning off in the FLASH control console as DeDukshyn reminds us to do.

However seeing what the tester reported, and NO response from the developer team kinda gets me annoyed.. I went to the "spyware" website and I got a warning in Chrome that the FLASH player was turned off, so the extra "features" (spyware) described as "Voice Recognition Control" of the webpage will not work. But I have no idea if the mike though was still turned on.

I think we need an app or program that monitors packets being sent out to a location. And alerts us if something isn't what we expect or wanted.

How many times has JAVA been implicated in downloading spyware, trojans. Is your JAVA engine up to date? Patched, fixed? Even know what a java-engine is? Those are some of the things that go on with folks who are just hoping to read Forums, send mail and play some games. Not fun obviously to find out that such a push to "Go CHROME" really may have been a push for some other reason.. I just don't like what this trend is lately.

I assume these things will tell the firewalls that they are perfectly AOK to punch holes through.. I use packet sniffers now and then when I suspect some nasty things are going on.. There are some freeware sniffers out there, but unless one is savvy in the lingo of data packet sniffing and what comes back, it may not be the easiest to know when one has been "audio eavesdropped on".

"FEATURES" my a....

[gnostic9]

Anyone have Flash installed on their PC? Flash player can also in theory access any mic and camera on your PC. (and I imagine Silverlight can as well)

Right click on a flash video and go through all the settings and make sure that access is turned off (but I still don't think that would be a 100% solution)

The exploit that the fellow (maybe a developer) on the Chrome developer/tester site https://code.google.com/p/chromium/i...0OS%20Modified - had been discussing the FLASH application, and there was a discussion about turning off in the FLASH control console as DeDukshyn reminds us to do.

However seeing what the tester reported, and NO response from the developer team kinda gets me annoyed.. I went to the "spyware" website and I got a warning in Chrome that the FLASH player was turned off, so the extra "features" (spyware) described as "Voice Recognition Control" of the webpage will not work. But I have no idea if the mike though was still turned on.

I think we need an app or program that monitors packets being sent out to a location. And alerts us if something isn't what we expect or wanted.

How many times has JAVA been implicated in downloading spyware, trojans. Is your JAVA engine up to date? Patched, fixed? Even know what a java-engine is? Those are some of the things that go on with folks who are just hoping to read Forums, send mail and play some games. Not fun obviously to find out that such a push to "Go CHROME" really may have been a push for some other reason.. I just don't like what this trend is lately.

I assume these things will tell the firewalls that they are perfectly AOK to punch holes through.. I use packet sniffers now and then when I suspect some nasty things are going on.. There are some freeware sniffers out there, but unless one is savvy in the lingo of data packet sniffing and what comes back, it may not be the easiest to know when one has been "audio eavesdropped on".

"FEATURES" my a.... i think Bobd, that we need to communicate as sentient "Human beings" again, and not end up being controlled by an enforced technology conscience. Love peace and joy to all!

[Carmody]

In all this time (since about 1985 or so, in the world of self built IBM clones and then up through the years, +29 years) I have never allowed a camera or microphone to ever be hooked up to a computer of mine.

I avoid the potential issue.... by making it an impossibility.

[Nanoo Nanoo]

this is why i have a pc with no camera or mic installed from factory .. : 0 )

plugging the hole ma not nessesarily work. Audio works on vibration and the pc housing can work as a sound amplifier .. plugging the hole will reduce top end response but not all of it .. your fundamental vocal frequency is about 1khz and thats a hard one to block .. in order to stop its use you will have to physically cut the wires off its back end , thats not easy.

Chewing gum or wax would be a better plug than wooden tooth pick as wood is a great conductor of vibration ..

Best

N

[jackovesk]

The very 1st thing I always do with a new computer is to...




1. Register with a False Name
2. Turn 'OFF' the Microphone &
3. Turn 'OFF' the Camera & Place some Tape over it


You'd be 'Wise' to do the same...:yes4:

[McMaster]

How about turning off javascript and flash on your browser instead of toothpicks or chewing gum?

[yuhui]

Chrome Bug Lets Sites Listen to Your Conversations

s5D578JmHdU

[Soulboy]

The very 1st thing I always do with a new computer is to...




1. Register with a False Name
2. Turn 'OFF' the Microphone &
3. Turn 'OFF' the Camera & Place some Tape over it


You'd be 'Wise' to do the same...:yes4:

I also do those things, but as soon as you have your mail client set up, your computer links to an email account that is linked to your name anyway, which makes point 1. rather pointless, doesn't it?