Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

101–110 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#101

Post by [deleted] »

salutis wrote: post #43
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

[deleted]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#102

Post by schroeding »

Eavolution wrote: post #94

I am not a hardware engineer or anything of the sort. My laptop has a slide shutter over the webcam, but this obviously does nothing about the microphone. How difficult/error prone would it be for the power signals to the microphone and camera to be individual wires/traces and have a physical switch that breaks the power or data connection physically? Surely these are very low voltage so the switch could be like the…

The Framework laptop does this for both microphone and webcam, and there are privacy focused Android phones which also have a microphone switch which cuts the power to the microphone. It's definitely possible.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#103

Post by CharlesW »

pooper wrote: post #85
ortusdux wrote: post #9

Earlier quoted context omitted.

I'd like a law to this effect.

We have to be realistic though. We can't even get a law requiring right to replace a battery on our own iPhones...

Go to https://www.ifixit.com/Device/iPhone, then search for your iPhone's battery replacement guide.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#104

Post by 3eb7988a1663 »

epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

I believe it is possible to turn a speaker into a microphone. Found a paper which claims to do just that[0]. So, there is no safety anywhere?

  SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
  It is possible to manipulate the headphones (or earphones) connected to a computer, silently turning them into a pair of eavesdropping microphones - with software alone. The same is also true for some types of loudspeakers. This paper focuses on this threat in a cyber-security context. We present SPEAKE(a)R, a software that can covertly turn the headphones connected to a PC into a microphone. We present technical background and explain why most of PCs and laptops are susceptible to this type of attack. We examine an attack scenario in which malware can use a computer as an eavesdropping device, even when a microphone is not present, muted, taped, or turned off. We measure the signal quality and the effective distance, and survey the defensive countermeasures.
[0] https://arxiv.org/abs/1611.07350

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#106

Post by 3eb7988a1663 »

james_marks wrote: post #59
salutis wrote: post #43

Earlier quoted context omitted.

macOS is a proprietary binary blob, remotely controlled by Apple. So, the light in the menu bar is not a reliable indicator of anything. There is no privacy on macOS, nor any other proprietary system. You can never be 100% sure what the system is doing right now, as can be anything it is capable of. Apple is putting a lot of money to "teach people" otherwise, but that is marketing, not truth.

You can watch network traffic for data leaving the device. Trust but verify.

For something as compressible as voice, I do not know how you would feel confident that data was not slipping through. Edge transcription models (eg Whisper) are continuing to get better, so it would be possible for malware to send a single bit if a user says a trigger word.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#107

Post by prmoustache »

okasaki wrote: post #39

Don't even understand why laptops have cameras and microphones. If you're serious about video meetings you'll want an external camera anyway. I keep covering them up with bits of paper (because like most people, I don't trust LEDs or switches) that look ugly and invariably get blown off by a gust of wind and have to be reapplied when moving. It just seems like at some point around 2010 some cabal decided that every d…

> Don't even understand why laptops have cameras and microphones. If you're serious about video meetings you'll want an external camera anyway.

The whole point of a laptop is to be able to move around and travel with it.

FWIW you can still encounter laptops without webcams (MNT reform comes to my mind) and you can also choose to disable/load/unload the kernel modules for them dynamically on linux distros and BSDs

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#108

Post by orbital-decay »

sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

It's probably done to keep it in a low powered state and reduce the initialization delay. Maybe also to prevent the Windows USB plugging sound from playing upon turning the camera on, as it would seem weird to the user ("I don't have any USB devices plugged in...")

Likely UX over security and privacy.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#110

Post by fph »

catlikesshrimp wrote: post #37
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

Soldering iron to the rescue. Locate the microphone and unsolder it. I haven't seen any microphone integrated in the processor. Yet

Going into full paranoid mode, I wonder if some other sensors / components can be used as a makeshift microphone. For instance, a sufficiently accurate accelerometer can pick up vibrations, right? Maybe even the laser in a CD drive? Anything else?
Post reply on HN