Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

161–170 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#161

Post by netsharc »

nox101 wrote: post #118
kiwijamo wrote: post #84

Earlier quoted context omitted.

Interesting, my work HP Probook does not have that functionality. I wonder why HP chooses to do this only for some laptop lines.

I suspect most people don't want it. I can imagine lots of people calling customer service "Q: why doesn't my camera work?", "A: Did you open the cover?" There's just a valid an argument to do the same for phones. How many phones ship with camera covers and how many users want them? You can get a stick on camera cover for $5 or less if you want one. I have them on my laptops but not on my phone. They came in packs of…

> I can imagine lots of people calling customer service "Q: why doesn't my camera work?", "A: Did you open the cover?"

In some over-engineered world, when the camera cover is engaged the webcam video feed would be replaced by an image of the text "Slide camera cover open" (in the user's language) and an animation showing the user how to do so.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#162

Post by wmlhwl »

mrb wrote: post #76

On a ThinkPad X1 Carbon Gen 8, it's easily possible record video with the webcam LED off. I did not verify newer generations of the X1 Carbon. Lenovo put a little physical switch—they call it "ThinkShutter"—that serves to physically obstruct the webcam lens to prevent recording. It's supposed to have only two positions: lens obstructed or not. But if the user accidentally slides it halfway, you can still record video…

In Yoga C740 it only blocks the shutter. Covering the LED doesn't make sense to me

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#163

Post by axoltl »

varenc wrote: post #81
aftbit wrote: post #71

Earlier quoted context omitted.

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-architect how the LED is turned on. I was the security architect for the feature.

A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.)

On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds.

This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board.

tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured.

0: https://www.usenix.org/system/files/conference/usenixsecurit...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#164

Post by danielheath »

aftbit wrote: post #71
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

AFAIK iOS devices use a tiny firmware on the camera and a larger one on the secure enclave chip.

If you successfully compromise the host OS and also the secure enclave firmware, that might be enough to let you turn on the camera (without vsync) and reconstruct the correct image via later analysis... but at that point you have committed tens of millions to the hack (so you'd better not overuse it or it'll get noticed & patched).

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#165

Post by IAmNotACellist »

When those cameras first came out I said that of course the LEDs could be disabled with firmware only, and it was probably a government-mandated requirement to be able to do so, and I was called a conspiracy theorist.

Well who's laughing from within a tinfoil Faraday cage now?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#166

Post by [deleted] »

aftbit wrote: post #100
varenc wrote: post #81

Earlier quoted context omitted.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

See then it's not hardwired at all. It is equally vulnerable to a reflash. Apple just did hardware security (i.e. signed firmware) better and also are relying on security through obscurity (its not a publicly available part).

[deleted]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#167

Post by TZubiri »

greenthrow wrote: post #47
TZubiri wrote: post #42

Earlier quoted context omitted.

The idea has been around for quite some time. But it is always dropped. My guess is that, assuming the most basic and absolute physicial design, the light would flash for silly things like booting, upgrading firmware, checking health or stuff like that.

Flashing is easily fixed with a capacitor and also not a bad thing if it turns off when it loses power immediately. The only explanation that makes sense to me is it being separately controlled is a feature not a bug.

I agree on the capacitor fix for flashing, I pointed it out in another post.

In this case I was referring to false positives to the user.

This would mean we can't update the firmware without causing the user some paranoia.

Also. Would an app requesting permission to use camera itself send some power to the camera to verify it is available? In a similar vein, what about checking if the camera is available before even showing the user the button to use the camera?

Maybe there's solutions to this, I'm just pointing out some reasons they may have gone the software route instead of the hardware route.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#168

Post by mkj »

throwaway74354 wrote: post #129
lxgr wrote: post #10

Arguably a much, much bigger problem are the (many) microphones of modern devices. These usually get neither an LED nor a switch, and unlike cameras can't easily be covered, nor pointed away from potentially sensitive topics/subjects.

>These usually get neither an LED nor a switch Lots of ThinkPads have «Microphone is muted» LED. Not exactly what's requested (and is bound to a software mute/unmute shortcut), but it's better than nothing regarding state of machine being observable with a quick glance.

That one seems to be software controlled. I'm fairly sure I remember having the mic working with the mute LED lit, which was confusing. That was on a x1 carbon gen9.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#169

Post by axoltl »

perching_aix wrote: post #41
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

For what it's worth, you could just power on the camera, take a pic, then turn it back off instead. Provided you can do this fast enough, an indicator LED is rendered worthless. So you'd need to make the indicator LED staggered, to stay lit for a minimum amount of time. There's also the scenario where the LED or the connections to it simply fail. If the circuit doesn't account for that, then boom, now your camera can…

I worked on this feature for Apple Macbooks around 2014 as the security architect. All Macbooks since then have a camera indicator LED that is (barring the physical removal of the LED) always on at least 3 seconds. This feature is implemented in gates in the power management controller on the camera sub-board.

There's a LOT of pitfalls still (what if you manage to pull power from the entire camera sub-assembly?), this was a fun one to threat-model.

Post reply on HN