- Phishing And Credential Stuffing Attacks Remain Top Threat To Financial Services Organizations And Customers: Study
- IT-Based Attacks Increasingly Impacting OT Systems: Study
- Learning Lessons From Cyber Security Incidents
- Top Cyber Threats Remain Consistent In 2019 But Attack Frequency To Rise: Study
- Majority Of Internet Users Fear Becoming A Victim Of Identity Theft And Account Takeover: Study
Chrome Bug Allows Sites to Record Audio and Video Without a Visual Indicator
By Nisheeth Bhakuni | May 30th, 2017
Ran Bar-Zik, a web developer at AOL, has discovered and reported a bug in
Google Chrome that allows websites to record audio and video without
showing a visual indicator.
The bug is not as bad as it sounds, as the malicious website still needs to get the user’s permission to access audio and video components, but there are various ways in which this issue could be weaponized to record audio or video without the user’s knowledge.
The bug’s central element is a “red circle and dot” icon that Chrome usually shows when recording audio or video streams.
Bar-Zik told Bleeping Computer he discovered the bug at work while dealing with a website that ran WebRTC code.
WebRTC is a protocol for streaming audio and video content over the Internet in real time. In order to stream audio or video content, a user must first grant a website permission to access his audio and video components.
When a website receives this permission, it can run JavaScript code that records audio or video content, before sending it over the Internet to the other participants of an WebRTC stream. This recording process is done via the JavaScript-based MediaRecorder API.
Nisheeth Bhakuni
