Page 1 of 1

Why is openwebstart requesting to record my computer screen?

Posted: 01 Nov 2020, 20:19
by javadev
Today is the first time I install and use openwebstart. I am honestly very happy with it, but I just had a vey concerning security popup that is now worrying me a little bit. It might be a legitimate thing, but the paranoid security person that I am is uneasy with the whole deal.
I am on MacOS 10.15.7 with openwebstart 1.2.2. While using the application, I got a security popup from the system asking me if I wanted to allow openwebstart "to record the computer screen". I declined it since I saw no reason for it to use that permission.
I would like to know why is the application trying to record my computer screen and what's the driver behind it.

Re: Why is openwebstart requesting to record my computer screen?

Posted: 01 Nov 2020, 21:10
by Stephan Classen
Hi, thank you for reporting this.
We are a little puzzled by this. OWS does not do any screen recording. It also does not take any screen shots.

Could it be that the application which you have launched using OWS is trying to capture the screen?
Since OWS runs the application in its own process the OS cannot tell which part of the code (OWS or the application) is trying to capture the screen

Re: Why is openwebstart requesting to record my computer screen?

Posted: 02 Nov 2020, 16:15
by javadev
Hi and thanks for the reply.
It's very unlikely that the app is responsible for the screen recording permission request. I just ran the Cisco firewall config UI (ASDM) using OWS.
It also didn't prompt me for the permission right away, I used the app for about 20 seconds, then I got the popup.
Also, it didn't happen the first time I ran the app with it, it happened the second time.

Re: Why is openwebstart requesting to record my computer screen?

Posted: 02 Nov 2020, 21:57
by Stephan Classen
OK, very interesting.
The code for OpenWebStart is all on github, also the one of icedtea-web.
Feel free to have a look. I don't think I opened all java files in the last 2 years.
But in none of the files I looked into did I find any code which would capture the screen

Re: Why is openwebstart requesting to record my computer screen?

Posted: 03 Nov 2020, 08:15
by Andreas Ehret
what about this feature of ASDM (see chapter "Configure and Run Captures with the Packet Capture Wizard "):
https://www.cisco.com/c/en/us/td/docs/s ... ouble.html

Re: Why is openwebstart requesting to record my computer screen?

Posted: 03 Nov 2020, 21:28
by javadev
That feature is for capturing the network packets that are transiting through the firewall. ASDM doesn't capture the screen or video of any sort.
Also, the Oracle java webstart doesn't prompt for the same permission when running ASDM.
It might be that ows is using a library or requires a permission that might be perceived by the OS as a request to record the screen.
In any case, I don't think it is an issue since you can deny the permission, but it's an unnecessary thing especially that people are looking at ows as a true alternative to commercially supported alternatives and this can be perceived as a security vulnerability.