1276177 - Security Disclosure: Malicious use of the phone's Gyroscope

Status: NEW

(Core :: DOM: Device Interfaces, defect, P4)

Description

[Yossi Oren]

Attachment: phonehome-disclosure.pdf

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36

Steps to reproduce:

​Dear Security@Mozilla,

We would like to let you know about an attack we discovered which takes advantage of a mobile device's gyroscope (either directly or through the Javascript DeviceOrientation API) to exfiltrate data. The attack requires that the adversary place a simple hardware device (basically a high-frequency speaker) next to the device under attack.

We reproduced this attack both on Windows and on Android versions of Firefox.

In contrast to the "Gyrophone" attack from 2014 [1], reducing the sampling rate of the gyroscope does not prevent our attack.
To mitigate this attack, we think it's a good idea to limit access to the orientation API. One way to achieve this is to ask the user's permission before enabling this API. Another way is to limit access to web pages delivered from insecure origins, as Chrome does for the Location API [2].
Together with my co-authors, I look forward to hearing your thoughts on this security issue. A draft of our technical report is attached.
Sincerely,
Yossi Oren.

[1] Yan Michalevsky, Dan Boneh and Gabi Nakibly
Gyrophone: Recognizing Speech from Gyroscope Signals
https://crypto.stanford.edu/gyrophone/
[2] Chromium Security Team, "Deprecating Powerful Features on Insecure Origins",
https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins

Comment 1

[Daniel Veditz [:dveditz]]

Limiting this API to secure origins doesn't ameliorate the security problem all that much if that's all we do.

Comment 2

[Dave Hylands [:dhylands]]

It seems to me that if you had a mode which only reported gross orientation (useful enough to determine landscape versus portrait) that you would still have useful functionality that you wouldn't be able to recover speech from.

How much would you need to degrade the output so that speech can't be recovered but the orientation API might still be useful to play games?

Comment 3

[Neha Kochar [:neha]]

Dan, should this be unhidden and/or lower the rating on this?

Comment 4

[Daniel Veditz [:dveditz]]

I can certainly be unhidden given the paper has been presented already and is public: https://www.usenix.org/system/files/conference/woot16/woot16-paper-farshteindiker.pdf

It's still a valid security issue so I don't want to remove the keyword, though it better fits our sec-low rating