Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

61–70 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#61

Post by lxgr »

salutis wrote: post #43
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

> There is no privacy on macOS, nor any other proprietary system.

Nor is there on any free system for which you didn't make every hardware component yourself, as well as audit the executable of the compiler with which you compiled every executable. (You did self-compile everything, hopefully?)

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#62

Post by greycol »

larusso wrote: post #4

I assumed that most if not all of these webcam LEDs are wired in series with the power to the camera itself. Which then makes it impossible to disable them. Who designs this LED to be software addressable?

Assuming Hanlon's razor it's a Chesterton's fence situation you just see a LED that indicates the camera is on. Assuming they ask the question at all they think it's just to remind you your still streaming/in a meeting. Then someone asks any of the following questions:

Can we use it to indicate additional information?

Can we make it standard with the other LEDs?

Can we dim it so it's more pleasant to use at night or make it a customisable colour?

I'm sure plenty of other questions take you down the same path and you've just destroyed one of the LEDs most useful functions.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#63

Post by perching_aix »

TZubiri wrote: post #44
perching_aix wrote: post #41

Earlier quoted context omitted.

For what it's worth, you could just power on the camera, take a pic, then turn it back off instead. Provided you can do this fast enough, an indicator LED is rendered worthless. So you'd need to make the indicator LED staggered, to stay lit for a minimum amount of time. There's also the scenario where the LED or the connections to it simply fail. If the circuit doesn't account for that, then boom, now your camera can…

A minimum light duration seems pretty trivial to physically engineer. For one the energy to take a picture is probably enough to power a light for a noticeable amount of time. And if it isn't, a capacitor that absorbs energy and only allows energy through once it's full would allow the light to remain on for a couple of seconds after power subsides.

Wasn't arguing that it's difficult, just that it's needed (and that I'm not expecting it to be done in practice. Because the indicator LED on my laptop doesn't do it either, despite being enterprise grade).

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#65

Post by kasey_junk »

TZubiri wrote: post #50
salutis wrote: post #43

Earlier quoted context omitted.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

I get it, free software take, nothing new. But this is a pretty extremist take. Just because a company doesn't push source code and you can't deterministically have 100% certainty, doesn't mean you can't make any assertions about the software. To refuse to make any claims about software without source is as principled as it is lazy. Imagine an engineer brought to a worksite, and they don't have blueprints, can he do…

It’s even dumber than that because the people that do assurance work don’t rely solely on source even when it’s available.

Reversing the software is table stakes for assurance work already so suggesting source is a requirement just doesn’t match reality.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#66

Post by joemag »

salutis wrote: post #43
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

The root of all trust is eventually some human, or group of humans. See "Reflections on Trusting Trust." At least so far, Apple has convinced me that they are both willing and competent enough to maintain that trust.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#67

Post by coffeeoverlord »

catlikesshrimp wrote: post #27
WalterBright wrote: post #18

Earlier quoted context omitted.

A post-it note works if you don't have a slider.

People won't look at you the same way after you do this. And it won't be for the better

More effective than trying to get permanent marker ink to block light getting through the lens.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#68

Post by perching_aix »

catlikesshrimp wrote: post #27
WalterBright wrote: post #18

Earlier quoted context omitted.

A post-it note works if you don't have a slider.

People won't look at you the same way after you do this. And it won't be for the better

It's an extremely common practice in enterprise IT, literally nobody gives a shit.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#69

Post by lxgr »

agumonkey wrote: post #31
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

same... i'm also surprised that having a software controlled led would be cheaper ..

It could be something very simple, such as requiring less USB hub complexity for a camera that can be woken up via a command on the USB bus instead of needing to connect/disconnect the USB power rails (wired in parallel with the LED) to it.

Somebody here has also mentioned Apple using the camera for brightness and maybe color temperature measurement, for which they wouldn't want to enable the LED (or it would effectively always be on).

That doesn't automatically make that a good tradeoff, of course; I'd appreciate such a construction.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#70

Post by naming_the_user »

wodenokoto wrote: post #19
pesus wrote: post #6

Earlier quoted context omitted.

I might be out of the loop, but I thought that was only for some machines - I remember the LED being wired that way being a selling point for MacBooks at some point, as a privacy feature. It definitely should be the standard, though!

[flagged]

At least half of your comment is wrong as the latest model MBP has an ambient light sensor, a camera, and an LED, I'm looking at them.

Maybe the Air?

Post reply on HN