Security News > 2022 > April > Video Conferencing Apps Sometimes Ignore the Mute Button
Abstract: In the post-pandemic era, video conferencing apps have converted previously private spaces - bedrooms, living rooms, and kitchens - into semi-public extensions of the office.
For the most part, users have accepted these apps in their personal space, without much thought about the permission models that govern the use of their personal data during meetings.
In this work, we ask the question: what happens to the microphone data when a user clicks the mute button in a VCA? We first conduct a user study to analyze users' understanding of the permission model of the mute button.
We find fragmented policies for dealing with microphone data among VCAs - some continuously monitor the microphone input during mute, and others do so periodically.
One app transmits statistics of the audio to its telemetry servers while the app is muted.
We achieved 81.9% macro accuracy on identifying six common background activities using intercepted outgoing telemetry packets when a user is muted.