Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

151–160 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#151

Post by jonplackett »

542458 wrote: post #51
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

I wonder how quickly it turns on/off as per Gruber’s worry - if you just record a single frame would it even be visible if looking right at it?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#152

Post by Aaron2222 »

prmoustache wrote: post #107
okasaki wrote: post #39

Don't even understand why laptops have cameras and microphones. If you're serious about video meetings you'll want an external camera anyway. I keep covering them up with bits of paper (because like most people, I don't trust LEDs or switches) that look ugly and invariably get blown off by a gust of wind and have to be reapplied when moving. It just seems like at some point around 2010 some cabal decided that every d…

> Don't even understand why laptops have cameras and microphones. If you're serious about video meetings you'll want an external camera anyway. The whole point of a laptop is to be able to move around and travel with it. FWIW you can still encounter laptops without webcams (MNT reform comes to my mind) and you can also choose to disable/load/unload the kernel modules for them dynamically on linux distros and BSDs

HP also allows ordering some of their business laptops without webcams.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#153

Post by daedrdev »

bluGill wrote: post #120
jiggawatts wrote: post #25

Earlier quoted context omitted.

"Add an LED next to the camera, our customers demand it!" "Job done boss!" That's it. That's what happens. Nobody ever reviews anything in the general industry. It's extremely rare for anyone to raise a stink internally about anything like this, and if they do, they get shouted down as "That's more expensive" even if it is in every way cheaper, or "We'll have to repeat this work! Are you saying Bob's work was a waste…

Lawyers after the fact review this. I expect one to start a class action - they will make millions, and everyone else who has this laptop will get $1. The real point is the millions means every other company is on notice that these mistakes hurt the bottom line and so the industry starts to review these things. So long as it doesn't hurt they won't review. I feel really dirty calling lawyers the good guy here, but ..…

What law as been broken by not implementing this feature?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#154

Post by ortusdux »

criddell wrote: post #45
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

I can't find it now, but recently I read how one company's design team added this feature to their laptops. A subsequent review by the team responsible for manufacturing found that they could change the circuit to cut down on the part count to save money. The light was still there, but it was no longer hardwired. The company continued to advertise the camera light as being hardwired even though it wasn't.

That fact pattern would setup a solid fraud case against the company and necessitate a recall at a minimum.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#155

Post by dagmx »

ryanisnan wrote: post #138
542458 wrote: post #57

Earlier quoted context omitted.

FWIW, modern Macbooks also hardware disable the mic when the lid is closed. https://support.apple.com/en-ca/guide/security/secbbd20b00b/...

How is that true? I use my macbook mic occasionally with the lid closed, and an external monitor.

Are you sure it’s the MacBook (T2 or Arm) mic? I imagine you’d sound super muffled if you were trying to use it while closed anyway, so I can’t imagine it’s very usable to yourself?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#156

Post by pessimizer »

WalterBright wrote: post #12

Of course it can. Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? Never. Me, I unplug the camera and mike when not in use.

> Cameras and microphones and write enable must have physical switches, not software ones. When will people learn?

I feel like people were pleading for this when people were getting ratted and began taping over their cameras, and the tiny number of laptop manufacturers just ignored what would be a cheap easy change. Eventually, people just accepted that it must be impossible to install a switch. I couldn't ever think of any motivation for a lack of a switch other than government pressure, so I've always assumed that the cameras and microphones are backdoored.

I don't get how "some tape" became the standard solution for these thousand dollar devices.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#157

Post by perching_aix »

salutis wrote: post #132
perching_aix wrote: post #55

Earlier quoted context omitted.

> There is no privacy on macOS, nor any other proprietary system. Which is to say, every system in actual widespread use. All such CPUs, GPUs, storage devices, displays, etc. run closed microcode and firmware. It'd be funny if it wasn't so profoundly sad. And even if they didn't, the silicon design is again, closed. And even if it wasn't closed, it's some fab out somewhere that manufactures it into a product for you.…

Yes, ultimately, I want everything to be open. This is not a bag of rice. These are devices packed with sensors, in our homes. As for inspection, I do not have a problem trusting others. I just do not trust big corporations with remotely controlled binary blobs, no matter how much money they put into the safety and security ads. This is a personal opinion, of course.

> As for inspection, I do not have a problem trusting others. I just do not trust big corporations with remotely controlled binary blobs

I'll just highlight this excerpt of your own words for you, and usher you to evaluate whether your position is even internally consistent.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#158

Post by wutwutwat »

Loughla wrote: post #148
wutwutwat wrote: post #146

There's a reason that zuck has tape over his webcam and a 3.5mm dummy plugged into his combo headphone/mic jack

Yeah but he's also WAAAAYYYYY more likely to be targeted than any of us, I would argue.

The odds of being targeted don't matter in what we're talking about. The fact its possible is what we're talking about. High value targets like zuck being well aware of that fact, and taking steps to guard against it is just icing on the cake.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#159

Post by NTARelix »

3eb7988a1663 wrote: post #104
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

I believe it is possible to turn a speaker into a microphone. Found a paper which claims to do just that[0]. So, there is no safety anywhere? SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit It is possible to manipulate the headphones (or earphones) connected to a computer, silently turning them into a pair of eavesdropping microphones - with software alone. The same is also true for some types of loudspea…

I recall in the early or mid 2000s using some cheap earbuds plugged into the microphone port of my family computer as a pair of microphones in lieu of having a real microphone nor the money for one. Then I used Audacity to turn the terrible recording into a passable sound effect for the video games I was making.

Not knowing much about how soundcards work, I imagine it would be feasible to flash some soundcards with custom firmware to use the speaker port for input without the user knowing.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#160

Post by 0xDEAFBEAD »

wutwutwat wrote: post #147
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

In the past I've used microsnitch on macos which tells you when the mic or camera are activated, but macos seems to have support for this baked into the os now. In zoom calls the menu bar shows what is active. If this can be sidestepped and avoided in software, and the camera can be activated without any indicator, I do not know. If direct access can be done, and you don't need to go through some apple api to hit the…

Did it ever snitch on anything interesting?
Post reply on HN