Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

11–20 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#11

Post by mindslight »

Fantastic, another nothingburger proof of concept for people to point to when arguing in favor of more manufacturer-lockdown-based "security". It's not a coincidence that this demonstration is on one of the last generations of laptops that can actually be secured against Intel themselves.

In reality, remote code execution should be considered game over, end of story. Trying to obfuscate to hide that fact just ends up creating more unknown places for malware to persistently hide. The same knowledge that allows one to write new camera firmware also allows one to verify it on every boot. Meanwhile the camera model that hasn't been publicly documented is an ever-present black box.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#13

Post by quickslowdown »

nolok wrote: post #2

For what it's worth, my Lenovo laptop has a manuel shutter slider button on the side that actually physically covers the camera (and it must also does something driver wise because windows considers it unplugged). It's so easy and convenient that I always use to off the camera. Many of lenovo have that even included their gaming laptop line (it's actually even better and more convient on that one, thanks to the large…

This exploit picks up audio, too. The shutter helps make sure you're not accidentally sending nudes to North Korea's hacking teams, but audio can still be hijacked unfortunately.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#14

Post by PrismCrystal »

nolok wrote: post #2

For what it's worth, my Lenovo laptop has a manuel shutter slider button on the side that actually physically covers the camera (and it must also does something driver wise because windows considers it unplugged). It's so easy and convenient that I always use to off the camera. Many of lenovo have that even included their gaming laptop line (it's actually even better and more convient on that one, thanks to the large…

Taping your camera doesn't necessarily look like anything. I have a small piece of electrical tape over my webcam, and it blends in so perfectly with the background that other people probably wouldn't see it unless they were specifically looking for it.

(I personally just leave the tape there all the time, because if I need to videoconference, I’d rather connect my mirrorless camera with a much better lens and sexy bokeh.)

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#15

Post by paxys »

lxgr wrote: post #10

Arguably a much, much bigger problem are the (many) microphones of modern devices. These usually get neither an LED nor a switch, and unlike cameras can't easily be covered, nor pointed away from potentially sensitive topics/subjects.

No amount of microphones will ever be a bigger problem than a single compromising photo or video.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#17

Post by epistasis »

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#18

Post by WalterBright »

nolok wrote: post #2

For what it's worth, my Lenovo laptop has a manuel shutter slider button on the side that actually physically covers the camera (and it must also does something driver wise because windows considers it unplugged). It's so easy and convenient that I always use to off the camera. Many of lenovo have that even included their gaming laptop line (it's actually even better and more convient on that one, thanks to the large…

A post-it note works if you don't have a slider.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#19

Post by wodenokoto »

pesus wrote: post #6
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

I might be out of the loop, but I thought that was only for some machines - I remember the LED being wired that way being a selling point for MacBooks at some point, as a privacy feature. It definitely should be the standard, though!

[flagged]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#20

Post by 2OEH8eoCRo0 »

quickslowdown wrote: post #13
nolok wrote: post #2

For what it's worth, my Lenovo laptop has a manuel shutter slider button on the side that actually physically covers the camera (and it must also does something driver wise because windows considers it unplugged). It's so easy and convenient that I always use to off the camera. Many of lenovo have that even included their gaming laptop line (it's actually even better and more convient on that one, thanks to the large…

This exploit picks up audio, too. The shutter helps make sure you're not accidentally sending nudes to North Korea's hacking teams, but audio can still be hijacked unfortunately.

I'm a known exhibitionist. It would damage my reputation if there weren't nudes floating around.
Post reply on HN