Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

241–250 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#241

Post by vanchor3 »

larusso wrote: post #4

I assumed that most if not all of these webcam LEDs are wired in series with the power to the camera itself. Which then makes it impossible to disable them. Who designs this LED to be software addressable?

In series with the power to the camera would be odd. You would be passing the same amount of current through both the camera and the LED. Unless you meant in parallel, which still leaves the other issue that the camera is likely always powered even when not in use, so the LED would always be on.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#242

Post by ohhnoodont »

axoltl wrote: post #163
varenc wrote: post #81

Earlier quoted context omitted.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#243

Post by internetter »

ferbivore wrote: post #117
catlikesshrimp wrote: post #37

Earlier quoted context omitted.

Soldering iron to the rescue. Locate the microphone and unsolder it. I haven't seen any microphone integrated in the processor. Yet

M2 and newer MacBooks have an IMU on-board, which is just a funny way of spelling microphone. Admittedly a very low quality one; I'm not sure if you could pick up understandable speech at the 1.6kHz sample rate Bosch's IMUs seem to support.

> M2 and newer MacBooks have an IMU on-board

Why?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#244

Post by ohhnoodont »

epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

Yup it's wild to me how much anxiety there is about cameras while no mind is given to microphones. Conversations are much more privileged than potentially seeing me in my underwear.

That said the most sensitive information is what we already willingly transmit: search queries, interactions, etc. We feed these systems with so much data that they arguably learn things about us that we're not even consciously aware of.

Covering your camera with tape seems like a totally backwards assessment of privacy risk.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#246

Post by internetter »

yndoendo wrote: post #223

The top part of a sticky note, found in most offices, works great with having to take off and put back on. Always assume that the company's provided laptop is a RAT with voice and video recording with notice is a norm.

> Always assume that the company's provided laptop is a RAT with voice and video recording with notice is a norm.

I... don't? Depends on the company, but I trust that my company has no override for the hardware based LED light on my Mac, as well as the software based microphone indicator. If they did, I would consider this highly scandalous for apple

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#247

Post by esprehn »

sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

Yeah, on Chromebooks and MacBooks the LED is hardwired to ensure it's always on when the camera is enabled.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#248

Post by bluGill »

daedrdev wrote: post #153
bluGill wrote: post #120

Earlier quoted context omitted.

Lawyers after the fact review this. I expect one to start a class action - they will make millions, and everyone else who has this laptop will get $1. The real point is the millions means every other company is on notice that these mistakes hurt the bottom line and so the industry starts to review these things. So long as it doesn't hurt they won't review. I feel really dirty calling lawyers the good guy here, but ..…

What law as been broken by not implementing this feature?

If they promise a feature they don't have that is falwe advertising.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#249

Post by coppsilgold »

lxgr wrote: post #10

Arguably a much, much bigger problem are the (many) microphones of modern devices. These usually get neither an LED nor a switch, and unlike cameras can't easily be covered, nor pointed away from potentially sensitive topics/subjects.

And having a microphone in the same chassis as the keyboard would make creating a keylogger easier. A microphone in the same room as the keyboard can be made into a keylogger[1].

[1] https://github.com/shoyo/acoustic-keylogger>

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#250

Post by accrual »

542458 wrote: post #51
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

> My concern would be a situation where a frame is captured so the LED is lit only for a very brief period of time.

Maybe enable a pre-charged capacitor to the LED whenever the circuit is activated? A "minimum duty cycle" for the LED might help solve this.

Post reply on HN