davebaraka
commented
4 years ago In this exploration, we'll see if we can identify if a web app is attempting to access certain permissions from these web resources
The challenge here is if we can identify these permssion apis from obfuscated code.
I was able to identify permission APIs from obfuscated code. I did this by manually looking through the downloaded web resources of a website from the chrome dev tools. I chose sites based on whether chrome indicated they were asking for a certain permission, so I knew that these sites were requesting these permissions.
Below are snippets of code from downloaded javascript files.
Accessing location from Google Maps
API: navigator.geolocation.getCurrentPosition(success[, error[, [options]])
Code snippets:
_.F.Bf = function(a) {
var b;
this.Ca || (b = a.callback(function() {}, "mylocation.redrawImpl", void 0, "mls"));
var c = this.$.get();
c ? (this.V = !0,
this.ka.add(c, a)) : this.V && (this.ka.remove(a),
this.V = !1);
this.ha.get() && (this.H.W[2] = this.Da,
this.H.W[4] = !!_.Cp.navigator.geolocation);
this.Ca = !0;
this.Aa.render(b)
} a.V.getCurrentPosition(function(h) {
var l = {
Lo: f,
callback: g
}
, m = void 0 === l ? {} : l;
l = void 0 === m.Lo ? !1 : m.Lo;
m = void 0 === m.callback ? void 0 : m.callback;
if (a.H) {
var q = a.H;
a.H = null;
a.Aa.stop();
a.kc = WY;
_.sz(a, a.kc, q);
h.coords.accuracy && a.Ca && a.Ca.write(h);
h.coords && (_.Cz(a.T) && c ? jrf(a, h.coords, !1, q, {
Lo: l,
callback: m
}) : c || mrf(a, h.coords, Kpf, q));
q.done(Ppf)
}
}, function(h) {
if (a.H) {
var l = a.H;
a.H = null;
a.Aa.stop();
var m = a.kc;
h.code == h.PERMISSION_DENIED ? a.kc = Lpf : h.code == h.POSITION_UNAVAILABLE ? a.kc = Opf : h.code == h.TIMEOUT && (a.kc = Npf);
a.ka.set(null, l);
a.kc != m && _.sz(a, a.kc, l);
g && g(!1, l);
l.done(Ppf)
}
}, {
enableHighAccuracy: !0,
timeout: 1E4,
maximumAge: 3E5
}),
a.Aa.start(b))
};
Accessing Notifications from Google Meet
API: Notification.requestPermission();
Code snippet:
_.ted = function(a) {
if (a.Aa || !window.Notification || "function" !== typeof Notification.requestPermission)
return _.db("denied");
if (!Notification.permission || "default" == Notification.permission) {
var b = _.db(Notification.requestPermission());
b.then(function(c) {
"granted" == c ? a.tb.logImpression(3549) : "denied" == c ? a.tb.logImpression(3550) : a.tb.logImpression(3624)
});
return b
}
return _.db(Notification.permission)
}
;Accessing Camera and Microphone from Google Meet
API: navigator.mediaDevices.getUserMedia({ audio: true, video: true });
Code snippets:
_.wAc = function(a) {
var b = _.lf();
return b && b.mediaDevices && b.mediaDevices.getUserMedia ? _.db(b.mediaDevices.getUserMedia(a)) : _.Tf("Missing getUserMedia API.")
} var a = {
audio: !1,
video: !1
}Accessing Sensors for Adidas (Sensors is an umbrella term for 'gyroscope’, ‘magnetometer’, ‘ambient-light-sensor’ and more. Here, I'm a little less sure about what sensor Adidas was specifically requesting...)
API: window.addEventListener("deviceorientation", handleOrientation, true);
Code snippet:
DeviceMotionEvent: qt,
DeviceOrientationEvent: qt,We also know which domain these files are coming from. All in all, this could be one thing we could use as an indicator that a web app is accessing a certain permission.
rgoldstein01
SebastianZimmeck
Web apps' resources (html, css, js, etc) are downloaded when accessed through a browser. Generally, as a user navigates through a website, more resources are locally downloaded and content is dynamically loaded.
The question is whether we can identify privacy practices from these resources. In this exploration, we'll see if we can identify if a web app is attempting to access certain permissions from these web resources. Web permissions as defined by W3C include
The challenge here is if we can identify these permssion apis from obfuscated code. If we have access to the development environment, this may be less of an issue.
Another potential challenge to explore is how can we programmatically intercept/retrieve these resources. Currently, I can see two possible ways. First is through a headless browser, such as puppeteer, and second is through the
webRequestapi of a browser extension. This can be done manually using a browser's dev tools.Another option to identify a web app's permission usage is through a headless browser. We can crawl the website and capture the side-effects of certain permissions. For instance, if a web app requests camera access, we can watch for an error (as a headless browser does not have a camera).