Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

91–100 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#91

Post by cruffle_duffle »

bilbo0s wrote: post #83
naming_the_user wrote: post #70

Earlier quoted context omitted.

At least half of your comment is wrong as the latest model MBP has an ambient light sensor, a camera, and an LED, I'm looking at them. Maybe the Air?

Doesn’t matter if it’s true. It only matters that they spell your name right. Threads filled with inaccurate posts like that are a large part of the reason that educating the general populace on security issues is so difficult.

And it all goes right into your friendly LLM training data and then spewed right back out again!

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#92

Post by zeroping »

MaxikCZ wrote: post #88
kiwijamo wrote: post #84

Earlier quoted context omitted.

Interesting, my work HP Probook does not have that functionality. I wonder why HP chooses to do this only for some laptop lines.

Money.

Supporting that theory: my HP EliteBook does have a slide-over cover.

(It could also be contention between thickness of the display vs enterprise customer sensitivity to cameras)

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#94

Post by Eavolution »

I am not a hardware engineer or anything of the sort. My laptop has a slide shutter over the webcam, but this obviously does nothing about the microphone. How difficult/error prone would it be for the power signals to the microphone and camera to be individual wires/traces and have a physical switch that breaks the power or data connection physically? Surely these are very low voltage so the switch could be like the iphone mute switch?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#95

Post by curun1r »

epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

The microphone also can't be covered with a $1 plastic camera cover off Amazon. It's so easy to solve the camera issue if you care about it, but there's really nothing you can do about the mic.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#96

Post by throwaway984393 »

varenc wrote: post #81
aftbit wrote: post #71

Earlier quoted context omitted.

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

[dead]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#97

Post by ASalazarMX »

chgs wrote: post #29
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

Hardware switch in line with the microphone. Can’t be turned on behind my back.

Wireless noise-cancelling headphones. Oh no, the microphone is back through bluetooth.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#98

Post by throwaway984393 »

zeroping wrote: post #92
MaxikCZ wrote: post #88

Earlier quoted context omitted.

Money.

Supporting that theory: my HP EliteBook does have a slide-over cover. (It could also be contention between thickness of the display vs enterprise customer sensitivity to cameras)

[dead]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#99

Post by yjftsjthsd-h »

ansgri wrote: post #53
catlikesshrimp wrote: post #37

Earlier quoted context omitted.

Soldering iron to the rescue. Locate the microphone and unsolder it. I haven't seen any microphone integrated in the processor. Yet

Well it doesn’t need to be visible to work in contrast to camera. Seriously though, no technological and almost no economic barrier preventing embedding a mic into every wireless communication chip.

Sure, but that requires the manufacturer to be intending to spy, in contrast to someone compromising after the fact.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#100

Post by aftbit »

varenc wrote: post #81
aftbit wrote: post #71

Earlier quoted context omitted.

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

See then it's not hardwired at all. It is equally vulnerable to a reflash. Apple just did hardware security (i.e. signed firmware) better and also are relying on security through obscurity (its not a publicly available part).
Post reply on HN