Earlier quoted context omitted.
You can watch network traffic for data leaving the device. Trust but verify.
Good luck auditing even just a single day of moderately active web browsing.
It's easier than reading all of the code in Ubuntu.
Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
171–180 of 554 posts
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#172Earlier quoted context omitted.
I believe it is possible to turn a speaker into a microphone. Found a paper which claims to do just that[0]. So, there is no safety anywhere? SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit It is possible to manipulate the headphones (or earphones) connected to a computer, silently turning them into a pair of eavesdropping microphones - with software alone. The same is also true for some types of loudspea…
I recall in the early or mid 2000s using some cheap earbuds plugged into the microphone port of my family computer as a pair of microphones in lieu of having a real microphone nor the money for one. Then I used Audacity to turn the terrible recording into a passable sound effect for the video games I was making. Not knowing much about how soundcards work, I imagine it would be feasible to flash some soundcards with c…
This is common at nightclubs (or was) - a DJ can use their headphones as a microphone, speaking into one channel and listening to another
Example https://m.youtube.com/watch?v=1NNP6AFkpjs
:-)
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#173Earlier quoted context omitted.
They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…
I wonder how quickly it turns on/off as per Gruber’s worry - if you just record a single frame would it even be visible if looking right at it?
Below, axoltl writes:
> no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured.
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#174My laptop just has a little plastic cover you slide over the lens when not in use. Why isn’t this simply more common?
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#175Earlier quoted context omitted.
In the past I've used microsnitch on macos which tells you when the mic or camera are activated, but macos seems to have support for this baked into the os now. In zoom calls the menu bar shows what is active. If this can be sidestepped and avoided in software, and the camera can be activated without any indicator, I do not know. If direct access can be done, and you don't need to go through some apple api to hit the…
Did it ever snitch on anything interesting?
idk, but maybe you know! it was probably easily bypassed anyway. hardware disconnects are the only thing that can ever be trusted imo
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#176I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.
Since some sort of firmware is required, this seems like a "turing tarpit" security exploit from my laymans perspective. There's no standard that I know, that, like "Secure EFI / Boot" (or whatever exact name it is), locks the API of periphery firmware and that would be able to statically verify that said API doesn't allow for unintended exploits. That being said: imagination vs reality: the Turing tarpit has to be h…
No firmware is required. Macbooks manufactured since 2014 turn on the LED whenever any power is supplied to the camera sensor, and force the LED to remain on for at least 3 seconds.
(Source: I architected the feature)
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#177How does the Macbook check the ambient light to determine the screen brightness, does it have a separate ambient light detector buried under the screen somewhere or inside the camera? (if the camera is not used for this I mean which would have been the best thing to do, but would require the camera to grab frames now and then without the LED flashing)
Macbooks have a dedicated ALS (Ambient Light Sensor). They don't use the camera.
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#178Another demonstration that duct tape can fix almost everything. Put a little over the webcam and presto, no more malware spying on you through webcam video. Now about something for the microphone?
It’s easy enough to disassemble your thinkpad and unplug the mike. Use external mikes if you need them, they will be better quality anyways
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#179[deleted]
Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
#180Earlier quoted context omitted.
Since some sort of firmware is required, this seems like a "turing tarpit" security exploit from my laymans perspective. There's no standard that I know, that, like "Secure EFI / Boot" (or whatever exact name it is), locks the API of periphery firmware and that would be able to statically verify that said API doesn't allow for unintended exploits. That being said: imagination vs reality: the Turing tarpit has to be h…
No firmware is required. Macbooks manufactured since 2014 turn on the LED whenever any power is supplied to the camera sensor, and force the LED to remain on for at least 3 seconds. (Source: I architected the feature)
Thanks for your reply — yourself as the Source can only make me feel flattered then for you responding to me.
> Macbooks manufactured since 2014 turn on the LED whenever any power is supplied to the camera sensor, and force the LED to remain on for at least 3 seconds.
That convinced me originally I think, good old days! I'd almost forgotten about it. The way you phrased it, it sounded like 50% OS concern to me.
But if cam & LED rly share a power supply, and the LED is always on without any external switch, Good then!