11 ms·
Infosec dramas are getting more and more tiresome. Between this and the Singapore Airlines story, it just seems like people need to ratchet everything up to 11.
by strictnein 8y ago
Infosec dramas are getting more and more tiresome. Between this and the Singapore Airlines story, it just seems like people need to ratchet everything up to 11.
You have two options, choose one:
- 1. Google wants to spy on you with a hidden mic
- 2. They had future plans for the mic, but it was disabled, so it wasn't mentioned by the marketing department
For the Singapore Airlines story, you have two options, choose one:
- 1. Singapore Airlines wants to record you
- 2. The infotainment devices in the seats are just off the shelf Android devices
One option gets you lots of clicks and let's the infosec drama crowd tweet obnoxious things and sound insightful. The other is the pretty obvious explanation.
- TeMPOraL 8y agoA fair point, but then again, if people don't react to #2 now, how long until it turns into #1? Things would be much simpler if companies were up front about what they're selling, instead of giving you incomplete information optimized to placate the unsophisticated buyers.
- btown 8y agoDisclosure of things like microphones on internet-connected devices is the type of no-brainer regulation that our regulatory bodies should be promoting. No need for real behavior changes, no need for giant Surgeon General's warnings, just a mention in printed user documentation, the same way products attest that they aren't in violation of FCC regulations on airwaves. There can be a healthy debate about whether this needs to go even further, e.g. legally requiring what Apple does for its laptop cameras in that a hardware light is lit whenever the recording system is powered up. But at least documentation-level transparency seems like a no-brainer. Unfortunately our regulatory bodies seem incapable of common sense these days, but that's a topic for another day.
- flukus 8y agoMaybe if companies like google weren't so creepy and privacy invading they'd get the benefit of the doubt. But in the world of constantly expanding corporate surveillance I default to believing the worst. Only occasionally am I pleasantly surprised to be wrong.
- zuppy 8y agoI don't get why you've got downvoted, I have the same opinion. There were a lot of scandals related to privacy lately (and I'm not talking only about Google), it's easy to understand why people stop trusting large corporations. It's sad that we use the downvote button to suppress opinions that are different, instead of using it for marking low quality content.
- mnm1 8y agoCameras in a public space? Oh no! Call the police right now! On the other hand, Google conveniently forgetting about the mics they installed in people's private residences is actually a big deal. This is exactly the reason I would never buy garbage devices like this. Google couldn't make a better case against such devices if they tried. There's no hint that the disabling of the mic wasn't or couldn't be reversed by Google or other parties. But even if it was secure and didn't record anything, Google broke customers' trust by including a hidden mic. Whether they had future plans or not, they lied to all their customers. If they came out and offered free replacements of any systems, I'd maybe buy their apology. As it stands, it's clearly PR bullshit that this was a mistake. One would have to be extremely stupid, gullible, or both to buy that especially given Google's history. That mic was put there on purpose. I also don't buy it that they never recorded anything with it. Of course, we won't be able to prove it and Google won't tell. But once again, their history tells all.
- dnbgfher 8y agoFor Google, I'm not sure how option 2 is supposed to be acceptable either. It is perfectly reasonable to be concerned about introducing an internet-connected microphone into your house. It doesn't even require assuming a malicious Google to see potential problems with this. You're one decent security flaw (in an IoT device no less) from anybody having a microphone in your house.
- est31 8y ago> You're one decent security flaw (in an IoT device no less) from anybody having a microphone in your house. Many people already have Android smartphones, so there is already a Google microphone in your house. The big difference is that you know that it has a microphone.
- skookumchuck 8y agoThe smartphone requires a battery, which drains away noticeably if it is sending all your conversations. The Nest is connected to the house power, so it can stream audio non-stop.
- bpye 8y agoAdditionally a user is likely to pay a lot more attention to their phone than to their Nest devices. A compromised Nest device will likely stay compromised until Google find the exploit...
- jannes 8y agoAre you sure about that battery drain? A malicious actor could easily conceal their activity by making 24-hour-long recordings and sending them in the night (or whenever connected to WiFi and plugged into power).
- cesarb 8y agoThe main trick smartphones use to have their battery last long enough, is to power off every piece of hardware that's not in use, for as long as possible. Doing a 24-hour-long recording would require the main CPU to be awake far more often than usual (and in fact, I would suspect it would have to be pretty much constantly awake, unless the phone had a large dedicated hardware buffer for the recorded audio samples).
- Gibbon1 8y agoIf the mic is on the BOM it's not disabled. It's just not being currently used. Maybe.
- bpye 8y agoRight. If it's ended up on a production board that means one of two things. 1. They intend to use the microphone in the future 2. They disabled the microphone after having the boards manafactured right before shipping - what changed? If they knew they weren't going to use it, why didn't they leave the microphone unpopulated? It would save on their BOM cost too, there had to be a reason.
- michaelt 8y agoIn this instance, the microphone was discovered when Google added built-in 'Google Assistant' support to the 'Nest Guard'. So yes they planned to use the microphone in the future, to do precisely what they have done here.
- mnm1 8y agoThis is the most accurate explanation. In other words, it's a mic like any other. The 'disabled' in this context means nothing. Just wait till Google gets served with a warrant. Suddenly, those mics won't be disabled anymore.
- taneq 8y ago> 2. They had future plans for the mic, but it was disabled, so it wasn't mentioned by the marketing department If you design in something which is later not used, you don't populate that part of the circuit board. Not unless you're intending to use it later, anyway. Components cost money. A software equivalent would be "we had plans to offer an integrated backup system but that didn't happen, although we still upload your contacts list and the contents of your SMSes to our servers."
- michaelt 8y agoIf you design in something which is later not used, you don't populate that part of the circuit board. In this case the microphone was discovered when Google added built-in 'Google Assistant' support to the 'Nest Guard'. I think there is no doubt they intended to start using it later, because they did.
- kalleboo 8y agoYou can add hardware features in order to support features you want to support in the future, but not advertise them in case those features for some reason don't come to fruition. If they had advertised "contains a microphone" there could be users who claim false advertising if they can't use the microphone. It's stupid but I can see a lawyer making the argument. As long as the microphone never recorded anything, they're no legal downside to including it and not documenting it. There could be a slim but potential issue with advertising a microphone that the customer can never use. The response to this incident is showing that that view is changing though.
- taneq 8y agoAn extra co-processor or something, sure. A device which the capacity to invade the user's privacy and/or compromise their security? Not so much. It'd be like having a 3G connection hidden in a security camera and not telling anyone.
- fixermark 8y agoTesla has a suite of sensors installed that are not currently used because they intend to solve the self-driving car problem with them in the not-too-distant future. Nintendo released multiple generations of consoles in the US with expansion ports for peripherals that ended up not making market sense to bring to the US.
- coldtea 8y ago>- 1. Google wants to spy on you with a hidden mic - 2. They had future plans for the mic, but it was disabled, so it wasn't mentioned by the marketing department How about both 1. and 2.? Google wants to spy (for ad context etc) with a mic that will be enabled in due time? And why move the Overton window to "it's ok to have hidden mics in a bloody thermostat, as long as they're not enabled"?
- benbristow 8y agoThat's getting close to conspiracy territory
- arkades 8y agoYes. It’s crazy to think an IoT device would be constructed to aggressively spy on its owners for advertising purposes (https://nakedsecurity.sophos.com/2018/07/09/smart-tvs-are-spying-on-you-through-your-phone/ https://nakedsecurity.sophos.com/2018/07/09/smart-tvs-are-sp...).
- vermilingua 8y agoI think Google is well past conspiracy territory. They are a company whose bottom line depends on collecting as much user data as possible; in an economy that compels them to improve their bottom line by any means available. Is there really any doubt that google can and will spy on you if given the slightest opportunity?
- kmlx 8y agoYes, I have 100% doubt anyone is spying on anyone. I think most of it is paranoia. I also think this kind of paranoia is detrimental to our evolution as a species. We should be sharing more, not hiding in our caves.
- jjulius 8y ago>We should be sharing more... Why? And what else should we be sharing?
- itronitron 8y agooption 3 >> Tech companies get special treatment from governments when they include potential surveillance capabilities that are 'disabled for general use'.
- deleted 8y ago[deleted]
- Yizahi 8y agoMetadata equals spying (= "future plans for the mic") https://www.schneier.com/blog/archives/2013/09/metadata_equals.html https://www.schneier.com/blog/archives/2013/09/metadata_equa...
- xg15 8y ago> - 1. Google wants to spy on you with a hidden mic You mean "gaining consumer insights to continually develop and improve our products". Given the existence of a whole industry sector that is all about covertly gathering information about users and selling them off, I don't see what would be that particular far-fetched about this scenario.
- xg15 8y agoThis is not really about infosec, this is about privacy and data protection. And you can try to play this down as much as you want, but I think this is another symptom how much the current discussion about how much data gathering is OK is needed.
- thrwaway190220 8y ago>You have two options, choose one: Your analysis is sensible. Where we should choose the most likely explanation, it might become sharper: - In case you're not familiar with it, one helpful tool is prior probability (Bayesian thinking). This video is short and accessible: https://www.youtube.com/watch?v=BrK7X_XlGB8 https://www.youtube.com/watch?v=BrK7X_XlGB8 - There is a public intelligence budget in 2018 of $54.9 billion in the United States[1], as compared with the combined annual R&D expenditure of Apple, Google, Intel, and Microsoft at $53.2 billion[2]. This employs over 100,000 people[3]. - According to Snowden, they covertly use microphones.[4] He had reporters put their mobile phones in a fridge/microwave, since they could be turned on remotely. A sensible assumption is that you are unlikely to chance upon a covert surveillance mechanisms if one is installed. (For example, speakers could also be used as microphones.) Where a bug is present, I think assigning 1% to the probability of finding it is reasonable. In view of the above, after you find an undisclosed and apparently (but not physically) disabled microphone in a product, which is more likely? 1. One of the 100,000 people mentioned, using some of the $59,900,000,000 annual budget mentioned, put it there. They do this thousands of times per year, and you've just found one of them. However, the chances of your finding it are low. (1%). 2. It was put in there as part of normal product design but left unused. Perhaps it will be legitimately enabled in a future version. Perhaps Google will use it for OK Google, its voice assistant. It has no covert intention. Google spends a lot of effort on ensuring privacy. The chances of your finding it are very high (90%) - it's not meant to be hidden and is no secret. If the chances of your finding a covert device is 1% in case there is one, and the chances of your finding an unused but not physically disconnected microphone is 90% if there is one, then to complete your analysis of which is more likely, you should know how many times the scenarios in 1 and 2 occur. I hope these additional tools - Bayesian probability and some figures about the base rate, could make your analysis sharper. Personally, I feel it's likely that a 1% chance of discovering a covert bug, multiplied by the thousands of such bugs (devices) out there, makes it more likely than the 90% chance of finding a totally unused and unadvertised microphone in a product, since there would be few such cases. -- [1] https://en.wikipedia.org/wiki/United_States_intelligence_budget https://en.wikipedia.org/wiki/United_States_intelligence_bud... [2] https://www.statista.com/statistics/265645/ranking-of-the-20-companies-with-the-highest-spending-on-research-and-development/ https://www.statista.com/statistics/265645/ranking-of-the-20... [3] https://en.wikipedia.org/wiki/United_States_Intelligence_Community https://en.wikipedia.org/wiki/United_States_Intelligence_Com... [4] Pick your reference: https://www.google.com/search?q=snowden+microphones https://www.google.com/search?q=snowden+microphones
- Aeolun 8y agoThe same logic could be applied to the Trojan horse. “Don’t worry, those soldiers won’t come out. It’s just in case we want to use them in the future.”
- deleted 8y ago[deleted]
- porpoisely 8y agoInfosec dramas are getting more tiresome? Are you really saying this on hacker news in an environment where we know governments, corporations, etc are actively trying to spy more and more on everyone? It's strange how you think the latter options are the pretty obvious explanations. "Google wants to spy on you with hidden mic" seems to be the fairly obvious one to me. What's strange is the amount of pro-government and pro-google comments on hacker news the past few years. I wonder what the two options for why that is? Also, you are offering a false dichotomy. This isn't an either-or situation. There could be other reasons. Could be that "google wants to spy on you with a hidden mic AND they planned it for the future". Another option is "The mic was put there by mistake". Another is that "the supplier screwed up". Or another is that the "supplier intentionally put it there".
- adossi 8y agoI agree with you that Google, an advertising company, would benefit greatly from secretly including a microphone (a-la Facebook giving you ads for stuff you've only spoken about out loud) however I disagree with your insinuation that the person you're replying to is a pro-government or pro-Google shill. I think Occam's razor in this scenario can lead you to two different conclusions.
- strictnein 8y agoI'm saying this on a site where I assume people are able to think a little beyond the basics, yes. Google spying on its customers would result in an amazing lawsuit. People tear apart and reverse-engineer these things for fun and it would have been discovered in due course. Google knows this. So, no, it's not an "obvious" option at all. You're starting from a position of "of course google is evil". I'm starting from "how much sense does that make?". We've reached different conclusions because of this. Pedantically listing a bunch of other options is missing the point, and they basically all fall under option 2. As for your perceived "pro-government" and "pro-google" views on HN: people have different views on many topics. Maybe this is the only place you encounter views that differ from your own?
- pacala 8y agoFalse choice. Google has future plans for the mic: to spy on you. Singapore Airlines is using off the shelf spyware/Android devices [but I repeat myself] because it wants to record you.
- demygale 8y ago1 is the correct answer for Google.
- pornel 8y agoEvery small creepy thing can be dismissed, but all these missteps shift the overton window. - so what it's recording now, it only checks if you're still watching. - so what they're storing it, the plane is a public place and there are cameras on the airports anyway. - so what it's uploaded to the cloud, everything is cloud-processed these days.