Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend bought a "smart" headset (working with voice commands). I had to install a software on Windows to be able to configure this headset.

After downloading the software from the page, this page redirected to an configuration wizard (still on the web page!) and informed me that the software is not yet installed; I should click at Continue when I have installed the tool.

After installation and clicking continue, I had to plug in the headset via USB. As soon as I did that, the web page recognized it and offered various configuation options and it also showed a progress bar for updating the firmware.

enter image description here

How can this web page access (read from and write to) hardware on the USB? Or: How can this software "inject" itself into the web page?

At first I thought it might have installed a plugin resp. add-on in Firefox, but this was not the case. Would this be possible with Flash (I didn’t check if the page used Flash, only know that it didn’t use Java)? With JavaScript this shouldn’t be possible, right? I never saw such an installation/configuration method (though I’m not using Windows, so I don’t know if this might be common). It feels kind of fishy to me. Wouldn’t it have to "manipulate" the browser somehow? Is such a way recommended resp. can it be implemented securely at all?

share|improve this question

closed as off-topic by AJ Henderson, Xander, TildalWave, Adi, NULLZ Aug 6 '13 at 23:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – AJ Henderson, Xander, TildalWave, Adi, NULLZ
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

As @Tom_Leek said: make the tool run a local Web server seem to be the way used:

I take a look at the indicated URL and find on the first line of main.js:

//url for the local server
var BASE_DIR = '/inc/support/myheadset/updater/';

The downloaded program run a local web server to interact with browsers.

share|improve this answer

When you install the local tool, anything goes (and it even requires local administrator rights !). The tool can inspect the USB hardware, and just needs a way to "talk" to the Web page. A relatively simple way is to make the tool run a local Web server, and have the page reference that Web server as an iframe. Thus, the user (you) will see the "configuration wizard" as occurring "in the Web page" but it would really be just a display thing, the actual processing being done in the locally installed tool.

There are other ways to make local code interact with a Web page, but a local Web server is one of the simplest and it is easy to make compatible with all the usual Web browsers.

share|improve this answer
$10 says it's not just allowing local access either. – Steve Aug 6 '13 at 15:57

Most likely the driver exposes some service on the machine that can be called through AJAX. It is then just a matter of Javascript calling the services. It could also be Flash based, but AJAX would be simpler. It could also register the driver as the handler for some additional protocol (other than HTTP). For example, TeamSpeak (a voice chat client) does this by registering the ts:// protocol to call itself. Then could do something like plantronics:// and make calls to it and the calls would be redirected to the registered handler for that protocol (the driver).

This is a non-exclusive list obviously and other possibilities exist, but that's a few possible ways it could be done.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.