Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

81–90 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#81

Post by varenc »

aftbit wrote: post #71
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong.

You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame.

I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures one quick frame.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#82

Post by a2800276 »

criddell wrote: post #54
larusso wrote: post #4

I assumed that most if not all of these webcam LEDs are wired in series with the power to the camera itself. Which then makes it impossible to disable them. Who designs this LED to be software addressable?

Does that mean if the LED dies the camera is dead?

You could wire it up either way. In general the LED is extremely likely to outlive the rest of the laptop, though.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#83

Post by bilbo0s »

naming_the_user wrote: post #70
wodenokoto wrote: post #19

Earlier quoted context omitted.

[flagged]

At least half of your comment is wrong as the latest model MBP has an ambient light sensor, a camera, and an LED, I'm looking at them. Maybe the Air?

Doesn’t matter if it’s true. It only matters that they spell your name right.

Threads filled with inaccurate posts like that are a large part of the reason that educating the general populace on security issues is so difficult.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#84

Post by kiwijamo »

connicpu wrote: post #72
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

An indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for…

Interesting, my work HP Probook does not have that functionality. I wonder why HP chooses to do this only for some laptop lines.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#85

Post by pooper »

ortusdux wrote: post #9
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

I'd like a law to this effect.

We have to be realistic though. We can't even get a law requiring right to replace a battery on our own iPhones...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#86

Post by ajsnigrutin »

sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

Most business class thinkpads have a physical cover in the screen that covers the camera with a piece of plastic.

Led, no led, who cares, plastic is blocking the lens. Move the cover away, say hi on zoom, wave, turn the camera back off, cover on, and stay with audio only, as with most meetings :)

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#87

Post by MaxikCZ »

varenc wrote: post #81
aftbit wrote: post #71

Earlier quoted context omitted.

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

A capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#88

Post by MaxikCZ »

kiwijamo wrote: post #84
connicpu wrote: post #72

Earlier quoted context omitted.

An indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for…

Interesting, my work HP Probook does not have that functionality. I wonder why HP chooses to do this only for some laptop lines.

Money.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#89

Post by lxgr »

james_marks wrote: post #59
salutis wrote: post #43

Earlier quoted context omitted.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

You can watch network traffic for data leaving the device. Trust but verify.

Good luck auditing even just a single day of moderately active web browsing.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#90

Post by kiwijamo »

LorenDB wrote: post #26
WalterBright wrote: post #12

Of course it can. Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? Never. Me, I unplug the camera and mike when not in use.

Some laptops (I've seen it on a lot of Thinkpads) include a physical cover that can be slid over the webcam when you aren't using it. While that doesn't cut power to the camera or mic, I figure would pretty straightforward for manufacturers to add contacts to the camera cover to use it as a power killswitch instead of just a privacy cover.

I think that's pretty standard outside the Apple ecosystem. HP seem to have this on most (if not all) the laptops I've seen at $DAY_JOB which uses HP for all laptops.
Post reply on HN