4 ms·

Wait what? How can a webpage play a sound if my speakers are muted? How do they bypass the little sound notification on my tabs? >If the Tor user has his phone

by jbob2000 10y ago

Wait what? How can a webpage play a sound if my speakers are muted? How do they bypass the little sound notification on my tabs? >If the Tor user has his phone somewhere nearby and if certain types of apps are on his phone, then his mobile device will ping back one or more advertisers with details about his device, so the advertiser can build an advertising profile on the user, linking his computer with his phone. This is pretty contrived...

socialist_coder 10y ago
Are you sure? I would guess that a huge amount of perfectly mainstream and popular apps have a ton of advertising SDKs bundled with them, and you never know what the fuck those SDKs are going to be doing half the time.
- divbit 10y ago
  Not even just mainstream and popular apps, but also pre-installed and unremovable apps.
joncrocks 10y ago
> How can a webpage play a sound if my speakers are muted? Well it can't obviously, but lots of people (although maybe not the types of people who use tor) browse the internet with their speakers on and active. Most people don't unmute their speakers just before they're about to listen to something. > How do they bypass the little sound notification on my tabs? Admittedly they probably can't, but are you sure you're going to notice a flicker as a short sound is played and then stops? I think the most contrived part is your mobile being always-on/always listening, given that you're likely to notice this due to reduced battery life. But given that certain hardware now has support for always-on keyword detection, you can see a future when this could happen.
- jcl 10y ago
  FWIW, there was a BBC article about always-on audio detector apps. Describing an Android proof-of-concept app: "The battery drain during our experiments was minimal and, using wi-fi, there was no data plan spike." http://www.bbc.com/news/technology-35639549 http://www.bbc.com/news/technology-35639549
  - bastawhiz 10y ago
    They don't give much information on what "minimal" battery drain means. I'm skeptical. Keeping an app running in the background and keeping a stream of audio data piped into it to be processed on the CPU is not cheap. Google has a dedicated DSP on phones to do hotword detection (among other things), and IIRC that's not exposed to unprivileged apps. Hell, even iOS needs to be charging to get "hey siri" support (not sure about now; it was like this in previous versions, though). Either way, it doesn't sound like that's what the article describes: they're talking about collecting and sending all audio wholesale. Sending that much audio data over 3g or LTE would be expensive (transcoding it to decrease payload would be expensive, too), and would surely be noticeable looking at data usage charts. > using wi-fi, there was no data plan spike Uh, yeah. Because it's using wifi. Phones are on wifi far less often than you'd imagine. It's certainly possible, but it's just not plausible.
    - cortesoft 10y ago
      This example is about people using TOR on a computer, so your phone is more likely to be connected to wifi than the general case.
    - joncrocks 10y ago
      You're right, the article is talking about seems to be talking about sending the audio wholesale, which would be cheaper from a CPU perspective, but sending the data would probably be noticeable both from a data use and battery perspective. Having said that, quite a few people have their phones connected to wifi at home, which could mitigate these issues due to both less conspicuous data and power usage.
nthcolumn 10y ago
Adblock that! This is pretty alarming actually - that advertisers are willing to go to such lengths, perhaps excuse my naïveté. The receiver could be someone else's device eg next door. Sure it has implications for an activist in London using tor but what about the rest of us? How can I easily tell whether a page is listening? Feedback maybe?
- EGreg 10y ago
  This is great! It's like bugtesting the anonymity cloak. Keep the bug reports coming and we will keep patching it :)
bastawhiz 10y ago
It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. This would be a huge battery drain, so I can't imagine any manufacturer bundling such a thing with a device. Even if it was the case, I can't imagine such apps would give granular enough information to be enormously useful. You'd get one, maybe two people to actually get their computers to play the audio and have it picked up by a device that's actually listening for it. What then? How many advertising companies with legitimate marketing businesses actually sell the user identities? You'd get what, a UUID, maybe some aggregate demographic information, and a rough location. It seems unlikely that such a platform would actually give out specific PII for individuals.
- treebeard901 10y ago
  > It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. It would not need to be constantly listening for it to be useful. If the point is identification, why would you leave it on after you have reasonably identified the person?
  - bastawhiz 10y ago
    I mean, we're under the assumption here that the app that's listening isn't owned by the attacker. If it was, you already know the person's identity (and location, and probably a lot more) because you control the app on their device. It would be a lot of work to target and infect someone's phone with malware just so you could confirm that they did in fact visit a page on Tor. Probably the same amount of work to just infect their computer with malware and take a screenshot. If we assume it's a third-party ad network, which is the only plausible explanation for why there's an app listening for ultrasonic cues on a user's device, it would need to be listening all the time. That is what the article describes.

socialist_coder 10y ago

Are you sure? I would guess that a huge amount of perfectly mainstream and popular apps have a ton of advertising SDKs bundled with them, and you never know what the fuck those SDKs are going to be doing half the time.

divbit 10y ago
Not even just mainstream and popular apps, but also pre-installed and unremovable apps.

joncrocks 10y ago

> How can a webpage play a sound if my speakers are muted? Well it can't obviously, but lots of people (although maybe not the types of people who use tor) browse the internet with their speakers on and active. Most people don't unmute their speakers just before they're about to listen to something. > How do they bypass the little sound notification on my tabs? Admittedly they probably can't, but are you sure you're going to notice a flicker as a short sound is played and then stops? I think the most contrived part is your mobile being always-on/always listening, given that you're likely to notice this due to reduced battery life. But given that certain hardware now has support for always-on keyword detection, you can see a future when this could happen.

jcl 10y ago
FWIW, there was a BBC article about always-on audio detector apps. Describing an Android proof-of-concept app: "The battery drain during our experiments was minimal and, using wi-fi, there was no data plan spike." http://www.bbc.com/news/technology-35639549 http://www.bbc.com/news/technology-35639549
- bastawhiz 10y ago
  They don't give much information on what "minimal" battery drain means. I'm skeptical. Keeping an app running in the background and keeping a stream of audio data piped into it to be processed on the CPU is not cheap. Google has a dedicated DSP on phones to do hotword detection (among other things), and IIRC that's not exposed to unprivileged apps. Hell, even iOS needs to be charging to get "hey siri" support (not sure about now; it was like this in previous versions, though). Either way, it doesn't sound like that's what the article describes: they're talking about collecting and sending all audio wholesale. Sending that much audio data over 3g or LTE would be expensive (transcoding it to decrease payload would be expensive, too), and would surely be noticeable looking at data usage charts. > using wi-fi, there was no data plan spike Uh, yeah. Because it's using wifi. Phones are on wifi far less often than you'd imagine. It's certainly possible, but it's just not plausible.
  - cortesoft 10y ago
    This example is about people using TOR on a computer, so your phone is more likely to be connected to wifi than the general case.
  - joncrocks 10y ago
    You're right, the article is talking about seems to be talking about sending the audio wholesale, which would be cheaper from a CPU perspective, but sending the data would probably be noticeable both from a data use and battery perspective. Having said that, quite a few people have their phones connected to wifi at home, which could mitigate these issues due to both less conspicuous data and power usage.

nthcolumn 10y ago

Adblock that! This is pretty alarming actually - that advertisers are willing to go to such lengths, perhaps excuse my naïveté. The receiver could be someone else's device eg next door. Sure it has implications for an activist in London using tor but what about the rest of us? How can I easily tell whether a page is listening? Feedback maybe?

EGreg 10y ago
This is great! It's like bugtesting the anonymity cloak. Keep the bug reports coming and we will keep patching it :)

bastawhiz 10y ago

It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. This would be a huge battery drain, so I can't imagine any manufacturer bundling such a thing with a device. Even if it was the case, I can't imagine such apps would give granular enough information to be enormously useful. You'd get one, maybe two people to actually get their computers to play the audio and have it picked up by a device that's actually listening for it. What then? How many advertising companies with legitimate marketing businesses actually sell the user identities? You'd get what, a UUID, maybe some aggregate demographic information, and a rough location. It seems unlikely that such a platform would actually give out specific PII for individuals.

treebeard901 10y ago
> It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. It would not need to be constantly listening for it to be useful. If the point is identification, why would you leave it on after you have reasonably identified the person?
- bastawhiz 10y ago
  I mean, we're under the assumption here that the app that's listening isn't owned by the attacker. If it was, you already know the person's identity (and location, and probably a lot more) because you control the app on their device. It would be a lot of work to target and infect someone's phone with malware just so you could confirm that they did in fact visit a page on Tor. Probably the same amount of work to just infect their computer with malware and take a screenshot. If we assume it's a third-party ad network, which is the only plausible explanation for why there's an app listening for ultrasonic cues on a user's device, it would need to be listening all the time. That is what the article describes.