5 ms·

I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I kno

I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.

cstejerean 4y ago
Even worse, it looks like on MacOS you can just straight up start recording on-demand, no need for dictation or siri. > Even worse, this particular exploit would also allow the app to request DoAP audio on-demand, bypassing the need to wait for the user to talk to Siri or use dictation.
- SamuelAdams 4y ago
  And this is why I have the internal microphone disconnected on my macbook pro. The only time a mike is attached is when I'm actively using it, and even then they have hardware kill switches. Simple kill switches would be nice to see but I doubt Apple would ever implement something like that.
  - metafunctor 4y ago
    - spaghettiToy 4y ago
    - xbar 4y ago
      Credit card numbers, social security numbers, passwords. People say all of these things around loved ones all the time without worrying about hardware being "around." Hardware, shockingly, is always around. And despite the author's dismissal of the Facebook listening "myth," everyone I know has an uncomfortable advertising eavesdropping anecdote. Maybe we can agree it's more correctly an unsubstantiated claim.
    - pixl97 4y ago
      I mean, you might be surprised but I'm sure there are more than a few users on HN that discus digital security configurations of large companies in their day jobs. I've been party to more than one conversation where some company unintentionally opened a security flaw for a short period of time that we discussed over a meeting, that if some evil 3rd party listened to may have gave them a window to exploit services.
      - kspacewalk2 4y ago
        The probability of someone just happening on that conversation while listening in, at just the right time, to just the right security engineer of the many security engineers in the company, approaches the probability of someone accidentally discovering the security flaw on their own. I think. It's hard to know with probabilities that are vanishingly small.
        grapescheesee 4y ago
        Winning lotteries is very small, as in better chance you are struck by lightning multiple times in you life, but it happens.
        squeaky-clean 4y ago
        > just happening on that conversation while listening in, at just the right time, Not that I'm a nefarious hacker or anything, but if I were to have made an app that snooped this audio stream, I wouldn't stop there. The audio would be uploaded to some virtual server and I'd run some AI transcription against it, then run some combination of NLP search and good ol' regex to forward me any audio file and its transcription that contained words like password, security, vulnerability, login, pin number. Any series of numbers around 16 digits long, a list of all current members of congress and major foreign politicians and diplomats, fortune 500 ceo names... For like $10/mo, (or even more likely, the cost of hijacking someone else's unsecured wordpress server) there can always be something listening.
    - coldtea 4y ago
      >I'm talking about national security level sensitive things, not your little brothers surprise birthday plans... You added "national security level sensitive things", not the parent. There are thousands of subjects one might not want to be eavesdropped on that are not "national security level sensitive things". Not to mention "national security level sensitive things" are not that far-fetched either. Not everybody lives a life as uniteresting as you imagine. What about a activist or a mere vocal critic living in an opressive regime? Or a politician with enemies in the other party (happens all the time, and judging from Watergate and Hoover, also happens in the US)? Or an investigative journalist talking with his sources for that matter? Or how about a businessman discussing some multi-million dollar deal, or an investor? Heck, how about a developer with several NDAs, in some major role in a big company, perhaps a FAANG one - like hundreds of people on HN?
    - empyrrhicist 4y ago
      > hardware you cannot trust? So... hardware?
    - ok_dad 4y ago
      I talk about my personal life (including such topics as my marriage and other things) quite often, and I don't want others to be able to record those conversations.
    - bdamm 4y ago
      There are all kinds of things I don't want Apple employees to hear, or developers of some random app that runs on iOS or Mac OS. Little brother can in many ways be far more threatening than big brother.
    - nonrandomstring 4y ago
      National security is nothing more than the sum total of the individual securities of each citizen. If your granny cannot trust technology not to have her bank account emptied by criminals, and Bob the local businessman cannot have a conversation free from casual industrial espionage of competitors, then that's national security. We live within nations that prosper as a result of our individual prosperity, and which perform a duty of care to protect those citizens. The phrase took on grandiose and "special interest" tones during the Cold War and Vietnam era, particularly under Nixon. But this is 2022, and I urge you to carefully rethink what that phrase means in a connected and increasingly hostile world. Everyone's privacy is a small part of National Security.
  - lilyball 4y ago
    The internal microphone is entirely unrelated to this bug.
    - coldtea 4y ago
      It's not this bug that's the reason he has the internal microphone disconnected. It's the presense of such bugs...
- Bud 4y ago
- deleted 4y ago
  [deleted]
dontbenebby 4y ago
>I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email. I agree with your take!! If you scroll to the "Full TCC Bypass on macOS" portion, you can see that this bug allows folks to turn on an Airpod and direct that audio to a macOS device. This could enable what is known as a Tempest Attack[0,1] >BTLEServerAgent did not have any entitlement checks or TCC prompts in place for its com.apple.BTLEAudioController.xpc service, so any process on the system could connect to it, send requests, and receive audio frames from AirPods. This exploit would only work on macOS, because the more restricted sandbox of iOS prevents apps from accessing most global mach services directly. Stuff like that are why I hate Bluetooth in general, and I'm on the fence if either my laptop OR phone will be Apple products when I replace them. (They seem to cater to people who replace their devices every year and camp out outside the Apple store for new Apple stuff like nerds rather than the folks who didn't want to spend every weekend messing with kernel drivers and thus adopted what I will continue to refer to as "shiny BSD" even though they long since changed the name from OSX to macOS.) -- [0] https://en.wikipedia.org/wiki/Tempest_(codename)#Public_research https://en.wikipedia.org/wiki/Tempest_(codename)#Public_rese... [1] http://m6rqq6kocsyugo2laitup5nn32bwm3lh677chuodjfmggczoafzw[0fcad.onion/DEF%20CON%2017/DEF%20CON%2017%20video%20and%20slides/DEF%20CON%2017%20-%20Andrea%20Barisani%20and%20Daniele%20Bianco%20-%20Sniffing%20Keystrockes%20with%20Lasers%20and%20Voltmeters%20-%20Video%20and%20Slides.mp4 http://m6rqq6kocsyugo2laitup5nn32bwm3lh677chuodjfmggczoafzw[...
aquajet 4y ago
How many people use diction? I'm surprised cause I know virtually no one who uses diction, myself included.
- ok_dad 4y ago
  My mother does it because of arthritis. Constantly.
- willis936 4y ago
  I don't for multiple reasons, not the least of which is the possibility of an exploit that leaks it. I don't trust software.
- throwaway290 4y ago
  I use dictation a lot, I hate typing on touchscreens and hate voice messages.
  - JKCalhoun 4y ago
    Ha ha, worse, I use it so often in Messages that when I leave an actual voice mail I say out loud, “Period” to end a sentence.
    - throwaway290 4y ago
      Same happened to me most times I tried to use voicies. Question marks, commas, full stops...
- jdwithit 4y ago
  My father in law (mid 70s) uses it constantly to compose text messages. I'm not sure I've ever seen him type one.
- JustSomeNobody 4y ago
  I use it when I want to send a text message that's longer than a few words. As long as I can do that without being a jerk to those around me.
girvo 4y ago
> I know people that use dictation for the majority of their text messages and email. Yeah, I'm one of them. The iOS keyboard has slowly become so bad that it's easier to dictate instead, and my partner does the same while driving via CarPlay. This is horrible to read about.
- wingerlang 4y ago
  I recently saw a conversation somewhere about this, people said turning off swipe-typing made a significant difference in the keyboard experience. Haven't tested it myself as I use swipe, and have no issues. But might be worth a try.
  - emrah 4y ago
    Huh it appears to be true
  - ollysb 4y ago
    Wow, this makes a huge difference, to the point where I can type without even looking at the keyboard (tried with and without looking).
  - girvo 4y ago
    I saw that too. It definitely helps! But it’s still less accurate somehow even than it used to be afterwards
  - Foobar8568 4y ago
    I moved from a Huawei P10 plus to a fairphone 4, and I'm not sure what happened but the typing and autocomplete experience is awful
    - zote 4y ago
      Maybe it's the keyboard, Huawei phones usually had SwiftKey as the default keyboard

cstejerean 4y ago

Even worse, it looks like on MacOS you can just straight up start recording on-demand, no need for dictation or siri. > Even worse, this particular exploit would also allow the app to request DoAP audio on-demand, bypassing the need to wait for the user to talk to Siri or use dictation.

SamuelAdams 4y ago
And this is why I have the internal microphone disconnected on my macbook pro. The only time a mike is attached is when I'm actively using it, and even then they have hardware kill switches. Simple kill switches would be nice to see but I doubt Apple would ever implement something like that.
- metafunctor 4y ago
  - spaghettiToy 4y ago
  - xbar 4y ago
    Credit card numbers, social security numbers, passwords. People say all of these things around loved ones all the time without worrying about hardware being "around." Hardware, shockingly, is always around. And despite the author's dismissal of the Facebook listening "myth," everyone I know has an uncomfortable advertising eavesdropping anecdote. Maybe we can agree it's more correctly an unsubstantiated claim.
  - pixl97 4y ago
    I mean, you might be surprised but I'm sure there are more than a few users on HN that discus digital security configurations of large companies in their day jobs. I've been party to more than one conversation where some company unintentionally opened a security flaw for a short period of time that we discussed over a meeting, that if some evil 3rd party listened to may have gave them a window to exploit services.
    - kspacewalk2 4y ago
      The probability of someone just happening on that conversation while listening in, at just the right time, to just the right security engineer of the many security engineers in the company, approaches the probability of someone accidentally discovering the security flaw on their own. I think. It's hard to know with probabilities that are vanishingly small.
      - grapescheesee 4y ago
        Winning lotteries is very small, as in better chance you are struck by lightning multiple times in you life, but it happens.
      - squeaky-clean 4y ago
        > just happening on that conversation while listening in, at just the right time, Not that I'm a nefarious hacker or anything, but if I were to have made an app that snooped this audio stream, I wouldn't stop there. The audio would be uploaded to some virtual server and I'd run some AI transcription against it, then run some combination of NLP search and good ol' regex to forward me any audio file and its transcription that contained words like password, security, vulnerability, login, pin number. Any series of numbers around 16 digits long, a list of all current members of congress and major foreign politicians and diplomats, fortune 500 ceo names... For like $10/mo, (or even more likely, the cost of hijacking someone else's unsecured wordpress server) there can always be something listening.
  - coldtea 4y ago
    >I'm talking about national security level sensitive things, not your little brothers surprise birthday plans... You added "national security level sensitive things", not the parent. There are thousands of subjects one might not want to be eavesdropped on that are not "national security level sensitive things". Not to mention "national security level sensitive things" are not that far-fetched either. Not everybody lives a life as uniteresting as you imagine. What about a activist or a mere vocal critic living in an opressive regime? Or a politician with enemies in the other party (happens all the time, and judging from Watergate and Hoover, also happens in the US)? Or an investigative journalist talking with his sources for that matter? Or how about a businessman discussing some multi-million dollar deal, or an investor? Heck, how about a developer with several NDAs, in some major role in a big company, perhaps a FAANG one - like hundreds of people on HN?
  - empyrrhicist 4y ago
    > hardware you cannot trust? So... hardware?
  - ok_dad 4y ago
    I talk about my personal life (including such topics as my marriage and other things) quite often, and I don't want others to be able to record those conversations.
  - bdamm 4y ago
    There are all kinds of things I don't want Apple employees to hear, or developers of some random app that runs on iOS or Mac OS. Little brother can in many ways be far more threatening than big brother.
  - nonrandomstring 4y ago
    National security is nothing more than the sum total of the individual securities of each citizen. If your granny cannot trust technology not to have her bank account emptied by criminals, and Bob the local businessman cannot have a conversation free from casual industrial espionage of competitors, then that's national security. We live within nations that prosper as a result of our individual prosperity, and which perform a duty of care to protect those citizens. The phrase took on grandiose and "special interest" tones during the Cold War and Vietnam era, particularly under Nixon. But this is 2022, and I urge you to carefully rethink what that phrase means in a connected and increasingly hostile world. Everyone's privacy is a small part of National Security.
- lilyball 4y ago
  The internal microphone is entirely unrelated to this bug.
  - coldtea 4y ago
    It's not this bug that's the reason he has the internal microphone disconnected. It's the presense of such bugs...
Bud 4y ago
deleted 4y ago
[deleted]

dontbenebby 4y ago

>I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email. I agree with your take!! If you scroll to the "Full TCC Bypass on macOS" portion, you can see that this bug allows folks to turn on an Airpod and direct that audio to a macOS device. This could enable what is known as a Tempest Attack[0,1] >BTLEServerAgent did not have any entitlement checks or TCC prompts in place for its com.apple.BTLEAudioController.xpc service, so any process on the system could connect to it, send requests, and receive audio frames from AirPods. This exploit would only work on macOS, because the more restricted sandbox of iOS prevents apps from accessing most global mach services directly. Stuff like that are why I hate Bluetooth in general, and I'm on the fence if either my laptop OR phone will be Apple products when I replace them. (They seem to cater to people who replace their devices every year and camp out outside the Apple store for new Apple stuff like nerds rather than the folks who didn't want to spend every weekend messing with kernel drivers and thus adopted what I will continue to refer to as "shiny BSD" even though they long since changed the name from OSX to macOS.) -- [0] https://en.wikipedia.org/wiki/Tempest_(codename)#Public_research https://en.wikipedia.org/wiki/Tempest_(codename)#Public_rese... [1] http://m6rqq6kocsyugo2laitup5nn32bwm3lh677chuodjfmggczoafzw[0fcad.onion/DEF%20CON%2017/DEF%20CON%2017%20video%20and%20slides/DEF%20CON%2017%20-%20Andrea%20Barisani%20and%20Daniele%20Bianco%20-%20Sniffing%20Keystrockes%20with%20Lasers%20and%20Voltmeters%20-%20Video%20and%20Slides.mp4 http://m6rqq6kocsyugo2laitup5nn32bwm3lh677chuodjfmggczoafzw[...

aquajet 4y ago

How many people use diction? I'm surprised cause I know virtually no one who uses diction, myself included.

ok_dad 4y ago
My mother does it because of arthritis. Constantly.
willis936 4y ago
I don't for multiple reasons, not the least of which is the possibility of an exploit that leaks it. I don't trust software.
throwaway290 4y ago
I use dictation a lot, I hate typing on touchscreens and hate voice messages.
- JKCalhoun 4y ago
  Ha ha, worse, I use it so often in Messages that when I leave an actual voice mail I say out loud, “Period” to end a sentence.
  - throwaway290 4y ago
    Same happened to me most times I tried to use voicies. Question marks, commas, full stops...
jdwithit 4y ago
My father in law (mid 70s) uses it constantly to compose text messages. I'm not sure I've ever seen him type one.
JustSomeNobody 4y ago
I use it when I want to send a text message that's longer than a few words. As long as I can do that without being a jerk to those around me.

girvo 4y ago

> I know people that use dictation for the majority of their text messages and email. Yeah, I'm one of them. The iOS keyboard has slowly become so bad that it's easier to dictate instead, and my partner does the same while driving via CarPlay. This is horrible to read about.

wingerlang 4y ago
I recently saw a conversation somewhere about this, people said turning off swipe-typing made a significant difference in the keyboard experience. Haven't tested it myself as I use swipe, and have no issues. But might be worth a try.
- emrah 4y ago
  Huh it appears to be true
- ollysb 4y ago
  Wow, this makes a huge difference, to the point where I can type without even looking at the keyboard (tried with and without looking).
- girvo 4y ago
  I saw that too. It definitely helps! But it’s still less accurate somehow even than it used to be afterwards
- Foobar8568 4y ago
  I moved from a Huawei P10 plus to a fairphone 4, and I'm not sure what happened but the typing and autocomplete experience is awful
  - zote 4y ago
    Maybe it's the keyboard, Huawei phones usually had SwiftKey as the default keyboard