Google Switches On Browser Spy Cam in Chrome
Google’s frequent Chrome browser updates are rarely exciting, but one new feature built into the latest version ought to wake you up.
Chrome 21, released yesterday (July 31), fully implements WebRTC (for “real-time communication”), a new standard that lets websites and Web applications use your computer’s camera and microphone — all the better to see and hear you with, of course.
Previously, websites and apps had to use browser plug-ins such as Adobe Flash Player or Microsoft Silverlight for audio and video interaction with the user.
WebRTC leverages the powers of HTML5, the next generation of code underlying the Web, to build multimedia features directly into the browser. Google’s Chrome blog already points to a couple of fun sites that let you take your picture with the browser or play a virtual xylophone.
That all sounds great, but there doesn’t seem to be any way to disable WebRTC in Chrome 21.
An email seeking clarification from Google was not immediately returned.
Chrome requires websites and apps to ask the user’s permission to access the camera and microphone. Yet any good hacker will tell you it’s just a matter of time before someone finds a way around that and uses WebRTC to have an unauthorized look at what people are doing in front of their computers.
To be fair, WebRTC may not be any less secure than what it’s replacing.
“The risk isn’t really larger than having Flash installed (of course, more and more people disable or do not install Flash),” Ullrich told SecurityNewsDaily via email. “Flash already had the ability to access the camera and microphone, and had some vulnerabilities that allowed websites to trick the user into enabling the camera/microphone via clickjacking.”
Besides Chrome, only the forward-looking Opera browser has implemented WebRTC. Mozilla Firefox and Microsoft Internet Explorer are working on including it in future versions.
Chrome users concerned about their privacy can’t simply refuse to update to Chrome 21, because Chrome automatically updates itself. (For the technically skilled, there are ways to turn automatic updating off.)