Feeds

Researchers expose privacy flaws in Chatroulette

Block and tackle

Secure remote control for conventional and virtual desktops

Privacy shortcomings in Chatroulette expose users to security risks, according to a study by security researchers.

Boffins at the University of Colorado at Boulder and McGill University were able to show that a pre-recorded low-quality video of an attractive woman could fool the majority of participants into thinking the feed was live. The approach might be used as a prelude to phishing attacks, for example. The researchers also found it was possible to use an IP-mapping services to get a general location on another participant. A variety of man-in-the middle attacks, where hackers intercept and potentially manipulate the data stream between two participants, might also be possible.

The upshot of the research is the users of the video chat site may not be as anonymous as they would like to believe.

Chatroulette.com pairs random strangers for webcam-based conversations and IM chat. Either user can move on to the next randomly chosen participant. Women participants are comparatively rare and users are likely to quickly encounter naked young males knocking one off, a phenomenon lampooned on shows such as South Park.

It's not clear whether or not the serious, academic researchers were exposed to smut during their study. Andrey Ternovskiy, the Russian software developer who created Chatroulette, welcomed the research while downplaying its potential impact.

Ternovskiy told IT World that upcoming changes in the site, such as localised chat, will minimise the potential for phishing attacks, which typically rely on conning people about an attackers' location as well as identity. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.