318
Cox deletes ‘Active Listening’ ad pitch after boasting that it eavesdrops though our phones
(www.fastcompany.com)
this post was submitted on 27 Dec 2023
318 points (99.1% liked)
Technology
59605 readers
3501 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
And with DNS requests and timing you should be able to figure whats in those packets.
Sorry if this is a noob question, but...how?
DNS will tell you the server name and address, which would just be some server owned by the company. Nothing weird there unless they have the chutzpah to name it something telling. They could even bypass DNS entirely with hardcoded IP addresses.
Timing wouldn't be a great indicator either if they aggregate requests.
They could slide anything nefarious in with daily software update checks or whatever other phone-homing they normally do, and without deep packet inspection or reverse engineering the software, it would be very difficult to tell.
I don't think Wireshark can do deep packet inspection, can it? Assuming the client is using SSL and verifying certs, maybe even using cert pinning?
Size would be a big indicator if they're sending full voice recordings, but not if they're doing voice recognition locally and only sending transcripts, metadata, or keywords.
I've never actually done this kind of work in earnest, and my experience with Wireshark is at least a decade out of date. I'm just approaching this from the perspective of "if I were a corporate shitbag, how would I implement my shitbaggery?"
The answer is: it wouldn’t. You’re right on the money, you couldn’t do anything other than speculation.
Just spitballing here but you might be able to try and correlate the amount of data sent with how much real life activity there was. Say, have silence for a week around the TV then play recorded speech near it for a week and see if that changes the frequency or size of the data being sent back home. Then do this for random 1/2/3 day periods. If offline text to speech is as crap as I've heard then the increased data transfer should stick out pretty clearly.
That’s a completely unhinged level effort for what would still ultimately boil down to speculation lmao. Smart TVs phone home frequently, semi randomly, with varying data amounts, both when used regularly and when off for months at a time, both when you’re walking and talking around it, and if you’re on vacation for two weeks. If despite all that you tried to control the environment around it you’d somehow need to… ensure absolute silence in the room that it’s in for DAYS at a time? Unless you live in the middle of the woods that’s not very likely, and even then, all it would be is guessing lmao
Oh entirely, but it's the best I could come up without disassembly. (And I'm fairly sure I've done worse debugging a prod environment)