Chrome Bug Allows Sites to Record Audio and Video Without a Visual Indicator

itman · May 30, 2017

Ran Bar-Zik, a web developer at AOL, has discovered and reported a bug in Google Chrome that allows websites to record audio and video without showing a visual indicator.

The bug is not as bad as it sounds, as the malicious website still needs to get the user's permission to access audio and video components, but there are various ways in which this issue could be weaponized to record audio or video without the user's knowledge.

The bug's central element is a "red circle and dot" icon that Chrome usually shows when recording audio or video streams.

In a private conversation, Bar-Zik told Bleeping Computer he discovered the bug at work while dealing with a website that ran WebRTC code.

WebRTC is a protocol for streaming audio and video content over the Internet in real time. In order to stream audio or video content, a user must first grant a website permission to access his audio and video components.

When a website receives this permission, it can run JavaScript code that records audio or video content, before sending it over the Internet to the other participants of an WebRTC stream. This recording process is done via the JavaScript-based MediaRecorder API.

Attack code is launched via a Chrome popup

Bar-Zik discovered that the code that does the recording doesn't necessarily have to run on the original tab where the permission was granted.

Because the permission to access audio and video data was granted for an entire domain, the Israeli developer realized he could start a headless Chrome window (popup) where he could run the code to record audio and video.

Because Chrome shows the red circle and dot icon in a window's tab, the icon doesn't appear for the popup because this headless window doesn't have a tab bar.

Researcher reported issue to Google, but no urgent fix is coming

Bar-Zik told Bleeping Computer that after he had verified this issue with family members and other peers, he submitted a bug report to Google.

The bug report is available here. The report also includes a benign demo that asks the user for permission, launches a popup when a user clicks o button, records 20 seconds of audio, and provides a download link for the recorded file. The proof-of-concept code is also available for download from here.
Click to expand...

https://www.bleepingcomputer.com/ne...d-audio-and-video-without-a-visual-indicator/

Rasheed187 · Jun 17, 2017

Wait a minute, since when do websites have the ability to record audio and video?

Minimalist · Jun 17, 2017

Rasheed187 said: ↑

Wait a minute, since when do websites have the ability to record audio and video?
Click to expand...

Probably since browsers have ability to use mic and camera?

Mr.X · Jun 17, 2017

My cam and mic are disabled via device manager and control panel respectively.

Log in or Sign up

Chrome Bug Allows Sites to Record Audio and Video Without a Visual Indicator

itman Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Mr.X Registered Member

Log in or Sign up

Chrome Bug Allows Sites to Record Audio and Video Without a Visual Indicator

itman Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Mr.X Registered Member

Useful Searches