Video calling applications continue to record audio when you press the microphone off button

More specifically, the apps studied just prevented your audio from being transmitted to other people participating in the video call. But those sounds will still be transmitted to the application's server continuously or periodically.

Since this activity is not documented in the relevant privacy policies, the user will not be able to understand how the mute system works. Many users think that the microphone on their device is completely turned off when they press the mute button.

Of course, users cannot accept that applications continue to access the microphone to collect data when mute mode is enabled.

When mute is not actually mute

The study was carried out by a team of experts from the University of Wisconsin-Madison and Loyola University in Chicago. They focus on determining what type of data each app collects and whether that data constitutes a privacy risk.

Tested apps include Zoom, Slack, MS Teams/Skype, Google Meet, Cisco Webex, BlueJeans, WhereBy, GoToMeeting, Jitsi Meet, and Discord.

The team monitored the raw audio that was transmitted from the applications to the operating system's audio driver and, ultimately, to the network. This way, they can determine what changes actually occur when the user presses the mute button.

Video calling applications continue to record audio when you press the microphone off button Picture 1 Flow of audio data on Windows 10

They found that even in muted states, all of the above applications sometimes collect audio data. Only web-based applications that use the browser's software mute feature do not collect muted audio data.

In all other cases, applications sample audio for functionality or for reasons that are not clear.

Zoom, the world's most popular video calling app, was found to actively monitor whether a user is talking whether they turn mute on or off.

According to research, Cisco Webex is the most reprehensible case. The application continues to capture raw audio data from the user's microphone and transmits it to its server the same way it would without mute.

"We discovered that Webex monitors, collects, processes, and shares with their servers audio data obtained from users while the user is muted. This is contrary to what Webex claims in its own statement. privacy book," the researchers shared.

The team decided to report the issue to Cisco responsibly. In response, the Webex team and the Cisco Privacy team have said they are actively working to resolve the issue.

Potential security risks

Besides the fact that user privacy is not respected, this also creates a serious security risk.

Even with apps that only collect a limited amount of audio data when muted, the researchers say they can still rely on that data to determine what a user is doing in 82% of cases. . They do this with a simple algorithm that classifies the sounds emitted by activities such as typing, cooking, eating, listening to music, vacuuming, etc.

Video calling applications continue to record audio when you press the microphone off button Picture 2 Action-based sound classification algorithm

Even if application vendors secure their servers, encrypt their data traffic, and adhere to anti-abuse policies, there is still the risk of a man-in-attack. the-middle causes unwanted damage to the user.

Besides ordinary consumers, VCA is also used by executives of large businesses, national security officers, politicians. Therefore, leaking data while mute mode is on will cause a lot of danger.

What can you do?

First, read the privacy policy carefully to better understand how your data is managed and what risks are associated with the use of a particular software product.

Second, if your microphone is connected to your computer via a USB cable or 3.5mm jack, you should unplug it when you press mute or when not in use.

Third, you can use the operating system's audio control settings to mute the microphone input channel so that any application doesn't receive any data when you press mute.

For most users, the above may seem a bit cumbersome, but in important cases they are worth doing to ensure your privacy.

Kareem Winters

Update 19 April 2022