Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

51–60 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#51

Post by 542458 »

sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer.

> All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. […]

> So, no, I don’t believe that malware could be installed to enable the camera without lighting the LED. My concern would be a situation where a frame is captured so the LED is lit only for a very brief period of time.

https://daringfireball.net/2019/02/on_covering_webcams

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#52

Post by schroeding »

WalterBright wrote: post #12

Of course it can. Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? Never. Me, I unplug the camera and mike when not in use.

Agreed. I find so much peace of mind in the microphone / webcam hardware switches of my Framework laptop.

Seeing the webcam actually vanish from the list of devices is very nice. :D

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#53

Post by ansgri »

catlikesshrimp wrote: post #37
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

Soldering iron to the rescue. Locate the microphone and unsolder it. I haven't seen any microphone integrated in the processor. Yet

Well it doesn’t need to be visible to work in contrast to camera. Seriously though, no technological and almost no economic barrier preventing embedding a mic into every wireless communication chip.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#54

Post by criddell »

larusso wrote: post #4

I assumed that most if not all of these webcam LEDs are wired in series with the power to the camera itself. Which then makes it impossible to disable them. Who designs this LED to be software addressable?

Does that mean if the LED dies the camera is dead?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#55

Post by perching_aix »

salutis wrote: post #43
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

> There is no privacy on macOS, nor any other proprietary system.

Which is to say, every system in actual widespread use. All such CPUs, GPUs, storage devices, displays, etc. run closed microcode and firmware. It'd be funny if it wasn't so profoundly sad.

And even if they didn't, the silicon design is again, closed. And even if it wasn't closed, it's some fab out somewhere that manufactures it into a product for you. What are you gonna do, buy an electron microscope, etch/blast it layer by layer, and inspect it all the way through? You'll have nothing by the end. The synchrotron option isn't exactly compelling either.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#57

Post by 542458 »

epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

FWIW, modern Macbooks also hardware disable the mic when the lid is closed.

https://support.apple.com/en-ca/guide/security/secbbd20b00b/...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#58

Post by 8f2ab37a-ed6c »

lxgr wrote: post #10

Arguably a much, much bigger problem are the (many) microphones of modern devices. These usually get neither an LED nor a switch, and unlike cameras can't easily be covered, nor pointed away from potentially sensitive topics/subjects.

At the same time we're at a point where synthesizing your voice is getting more trivial everyday, you need only a few seconds of it and you can be made to say whatever someone wants.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#59

Post by james_marks »

salutis wrote: post #43
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

You can watch network traffic for data leaving the device. Trust but verify.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#60

Post by nharada »

okasaki wrote: post #39

Don't even understand why laptops have cameras and microphones. If you're serious about video meetings you'll want an external camera anyway. I keep covering them up with bits of paper (because like most people, I don't trust LEDs or switches) that look ugly and invariably get blown off by a gust of wind and have to be reapplied when moving. It just seems like at some point around 2010 some cabal decided that every d…

I'm not serious about video meetings, but that doesn't mean I never have to take them.
Post reply on HN