33c3: Talking Behind Your Back [video]

I really enjoyed this talk. It relies on your smart phone being able to pick up the ultrasonic beacon and return it to the server to tell them you're there. And it feels a lot like the IMEI sniffing trash bins[1]. I guess there will be a market for a small ultrasonic 'fuzzer' device which degrades the beacons.

[1] http://www.independent.co.uk/life-style/gadgets-and-tech/new...

This is why you want capability-based security. If there's loads of speakers which are freely used by applications (lacking capability-based security), you can just use capability-based security on the microphones. That'd only work if you can control the devices though; so only on your own home.

On Android you can check which applications want access to microphone since 5.0 or 5.1 and the capability-based design during runtime works since 6.0. On macOS, it also works, and there's Micro Snitch which notifies the user when the microphone is active. Its from the same makers as Little Snitch. Its pretty basic; e.g. if you use Siri the log won't really tell much about which applications did use it.

Previous discussion: https://news.ycombinator.com/item?id=13290378

3 comments, 3 days ago, 19 points.