Muting video conferencing apps may not stop them from listening

Video conferencing solutions have seen a huge boost since 2020. Workers and students started working or learning from home and communicating with others using video conferencing services.

Video conferencing relies on camera and microphone access, and it seems that the built-in controls for muting the microphone don’t always prevent apps from listening and sending data.

Sometimes users participating in a video conference may want to mute their audio output. Examples might include going to the bathroom, talking to someone nearby, or opening the door. Most users would expect that pressing the mute button will mute all audio and prevent sending, but research suggests this may not be the case.

The research paper “Are You Really Muted?: A Privacy Analysis of Mute Buttons in Video Conferencing Applications,” published by Kassem Fawaz Assistant Professor of Electrical and Computer Engineering at the University of Wisconsin-Madison, suggests that Video conferencing applications can still record and send data while mute is on.

Video conferencing applications require access to a device’s camera and microphone, which users control through operating system functionality and sometimes, in the case of the camera, through hardware options. Permissions can be revoked and managed, but once granted, apps and services have access to hardware devices until the permissions are revoked.

Most apps and services include built-in options to turn off the camera or microphone. Blocking camera access prevents apps from accessing the camera because it “triggers an operating system-level control,” according to the researchers. Mute control in apps, on the other hand, uses a different system depending on the app, which can lead to audio data being recorded and sent while mute is active. The researchers note that none of the operating systems they analyzed supported “OS-mediated software silence” functionality.

Video conferencing services can be divided into two broad categories: native applications and web applications. The main difference between the two categories when it comes to muting is that native apps “collect microphone data with few restrictions,” while web apps need to “request microphone access through a web server,” which “generally has more restrictive policies. for data collection and more tools that allow the user to control the access of the application to the hardware”.

The team analyzed the muting behavior of ten different video conferencing and audio chat apps, including Microsoft Teams, Skype, Zoom, Google Meet, Discord, and Jitsi Meet. The services were then categorized into three “broad policies” based on the analysis:

Continuous sampling of audio from the microphone: Applications transmit data from the microphone in the same way that they would if they were not muted. Webex is the only VCA that continuously samples the microphone while the user is muted. In this mode, the microphone status indicator of an operating system remains lit continuously.

Audio data stream is accessible but not accessed: Applications have permissions to test microphone and read data; but instead of reading raw bytes, they only check the microphone status flags: mute, data discontinuity, and timestamp error. We assume that VCAs, like Zoom, are primarily interested in the silent indicator to tell if a user is talking while the muted software is active. In this mode, applications do not read a continuous stream of real-time data in the same way that they would if they were not muted. Most native Windows and macOS apps can check to see if a user is speaking even when muted, but they don’t continuously sample audio the same way they would if they’re not muted. In this mode, the microphone status indicator in Windows and macOS stays continuously lit, indicating that the application has access to the microphone. We found that apps in this state show no evidence of accessing raw audio data through the API.

Software mute: Applications tell the microphone driver to completely cut off data from the microphone. All of the web-based applications we studied used the browser software’s muting feature. In this mode, the microphone status indicator in the browser disappears when the app is muted, indicating that the app is not accessing the microphone.

Cisco Webex was found to access the microphone continuously while muted. The researchers were unable to determine how Microsoft “Teams and Skype use microphone data when muted” as they make direct calls to the operating system. The research team concluded that the behavior of apps that fall into categories one and two violate user expectations.

conclusion

Computer users have better control over muting behavior when using web services, since web services need to go through the browser for their activity. When it comes to muting and video conferencing applications, it is recommended to use the operating system’s muting functionality as it ensures that access to the microphone is blocked for as long as it is muted.

The full research paper is available here as a PDF document.

Now you: Do you use video conferencing tools?

advertising