Changelog:- - Prepare for incremental updates ( Prob the last update that will be non delta ) - Enabled voLTE/voWIFI for all indian carriers - Enabled voLTE for Claro/Mexico - Fixed netflix HD even if L1 was there ( Shoud work don't blame me if it dosen't ) Recovery changes: - Allow flashing unsigned zips - Apply update from sdcard goes to internal now - Some touches here and there of touch support Note: This OTA might fail due to some OTA updater changes in the prev build ( sorry for that like really )

 Download

Ставим ставки господа

Обновится ли через лису

Или опять ошибка 7

ОШИБКИ 7 НЕ БЫЛО

Я В АХУЕ

НАКОНЕЦ-ТО ЧТО-ТО НОРМАЛЬНО РАБОТАЕТ

Browser activating the front-facing camera: Big Brother or just a bug?

This post is about a disturbing (in terms of privacy) situation that we have recently encountered.

Here’s what happened: we were approached by one of our readers, who claimed that when he was reading our website (which, ironically, has the BanCam anti-facial recognition campaign banner on a main page), the front-facing camera was activated.

📺 https://youtu.be/JVrfUhc6l0M

👉🏽 Read more:
https://medium.com/@mva.name/browser-activating-the-front-facing-camera-big-brother-or-just-a-bug-e7a2ff9d6856


#Google #camera #popup #DeleteGoogle #PoC #video
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv

Trannoscription (read: copy paste):

Hi, everyone!

My name is Vadim, I am a tech consultant and a system administrator at RosKomSvoboda.

This post is about a disturbing (in terms of privacy) situation that we have recently encountered.

It could have been in a “A-a-a-a-a-a-a-a-a! Look, Big Brother (Google) is watching us” style, but I will rather try to do some analysis and make some assumptions about why this might have happened.

Here’s what happened: we were approached by one of our readers, who claimed that when he was reading our website (which, ironically, has the BanCam anti-facial recognition campaign banner on a main page), the front-facing camera was activated.

He owns a phone with a sliding front camera. So it slid out right after loading the page as shown on a video.

Big Brother?

As you probably have guessed, at first I thought, that despite all the security measures I have taken for the website, we were hacked and “trojanized”.

However, the investigation has shown, that our site was fine.

After discussing the investigation’s findings with my colleagues from RosKomSvoboda, I remembered that I had came across several forum posts before, which were describing how “Trojan” apk-packages were distributed through the ad networks (when opening the forum from an Android phone) (The idea is that a user would install them, thinking that it is the official forum client).

I suggested checking the list of ad trackers which were allowed on that page (the reader uses Firefox and the uBlock addon with it).

A couple of hours of experiments have shown that the camera stops activating only when the google.com domain access in being blocked in the addon’s settings. Around this time the user told us, that the website “kod.ru” was also activating the camera (before that, we considered the problem to be only on our website).

After digging a little deeper, I found out, that requests to google.com are made not only by Google trackers (aka analytics), but even by the YouTube video iframe module on that page. Same thing occurring at kod.ru also fitted this theory. As it turned out, that page had also had an embedded YouTube video in it.

In order to once again check my theory, I Googled a random blog post with a built-in video in it. The camera opened again.

To sum up, what we have discovered: the presence of built-in YouTube video on a page triggers the loading of some noscripts from google.com, and those, in turn, trigger the camera.

Okay, let’s keep digging.

Having gone through all the browser debugging tools, I found out, that a highly obfuscated noscript, which even has an obfuscated name, is loaded via www.google.com domain whenever a user accesses the page. None of the de-obfuscation tools I tried could deal with it.

Considering that it is Google, I can assume that soon this noscript will disappear, and will be replaced with a different (but equally unreadable) one. So, here’s it’s code, just in case.

A brief overview of the noscript didn’t show any camera mentions, but you can try to do it yourself.

Let’s now look at it this way:

My own phone has no sliding camera, so I could not see a camera sliding out, but I can connect it via USB and use “adb logcat | grep -i -C5 camer” (I’ve used grep because otherwise there is too much irrelevant info) command. So I did it…

First try: Loading the test sites and… nothing!

Starting to think that this issue is on a client’s side.

In the same time we are discussing the situation in the aforementioned RosKomSvoboda technical chat room. After a while, one of the participants said, that mobile browsers can sometimes be tricky: they don’t always ask for a global camera access permissions, because if they know there is none they may not ask for them!

I check the application’s settings and see, that Firefox has no camera permission. I turn it on, check once again, and see a bunch of camera related info popping up in the console like that:

adb logcat | grep -i -C5 camer