Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

251–260 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#251

Post by greycol »

hugh-avherald wrote: post #233
greycol wrote: post #62

Earlier quoted context omitted.

Assuming Hanlon's razor it's a Chesterton's fence situation you just see a LED that indicates the camera is on. Assuming they ask the question at all they think it's just to remind you your still streaming/in a meeting. Then someone asks any of the following questions: Can we use it to indicate additional information? Can we make it standard with the other LEDs? Can we dim it so it's more pleasant to use at night or…

What do you mean by Hanlon's razor and Chesterton's fence ?

Both are common sayings and easily googleable:

Hanlon's Razor: Don't attribute to malice what can be attributed to stupidity

Chesterton's Fence (worth googling as it's a nice little parable, or it might be a derivation of the parable,can't quite remember): Can boil it down to: if you don't know what something does assume it serves a purpose until you've figured out what purpose it used to serve. In this case I'm implying these people are playing the part of wanting to change the fence without knowing it's purpose.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#252

Post by qingcharles »

sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

I stumbled on a forum once where it was just filled with people trying to modify the software for various laptops to disable the "tally lamp" (as it is called). There were people selling the mods and one guy claiming he was selling his cracks to three-letter agencies. The people on there seemed to be using this to extort people (mostly women) by being able to record videos without the owner knowing. Some really dark shit.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#253

Post by Nursie »

ohhnoodont wrote: post #242
axoltl wrote: post #163

Earlier quoted context omitted.

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Depends what your threat model is?

Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc.

If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine.

So sure, maybe people ought to be more concerned about microphones as well, rather than instead.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#254

Post by darig »

aendruk wrote: post #218
connicpu wrote: post #72

Earlier quoted context omitted.

An indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for…

> The blocker is black and white stripes On my ThinkPad it’s instead painted with a red dot. Because, obviously, the conventional meaning of a red dot appearing on a camera is “not recording”.

[dead]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#255

Post by II2II »

JumpCrisscross wrote: post #186
nox101 wrote: post #118

Earlier quoted context omitted.

I suspect most people don't want it. I can imagine lots of people calling customer service "Q: why doesn't my camera work?", "A: Did you open the cover?" There's just a valid an argument to do the same for phones. How many phones ship with camera covers and how many users want them? You can get a stick on camera cover for $5 or less if you want one. I have them on my laptops but not on my phone. They came in packs of…

It's also a moving part. Worse, a part the customer moves. Which means more opportunity for crap getting crammed in or breaking.

The cover on my laptop's camera is behind the glass. I suppose there is a chance that the slider itself could get damaged, but at least they minimized the exposed surface that could be damaged.

That said, I really can't comment on how durable it is. I only remove the cover about a half dozen times a year.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#256

Post by altairprime »

squarefoot wrote: post #195
MaxikCZ wrote: post #87

Earlier quoted context omitted.

A capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed

I don't think they would waste a high value capacitor just to keep a led lit for longer, also a led directly lit by a capacitor would be noticeable by slowly dimming when the capacitor discharges. It's more likely that the signal driving the led comes out of a monostable implemented in code: pin_on() drives the led on; pin_off() waits n secs then drives the led off.

This is Apple, so that assertion isn’t guaranteed valid like it would be for non-enterprise HP or Lenovo. They absolutely would invest in a capacitor if that’s what it takes, as they are maximally focused on camera privacy concerns and have made a point of that in their security marketing over time; or else they wouldn’t be allowing hardware security engineers to brag about it, much less talk publicly about it, at all.

EDIT: It’s not just a capacitor, it’s a full custom chip, that can’t be software-modified, that keeps the light on for 3 seconds. https://news.ycombinator.com/item?id=42260379

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#257

Post by Nursie »

qingcharles wrote: post #252
sbarre wrote: post #3

I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. Having the LED control exposed through the firmware completely defeats this.

I stumbled on a forum once where it was just filled with people trying to modify the software for various laptops to disable the "tally lamp" (as it is called). There were people selling the mods and one guy claiming he was selling his cracks to three-letter agencies. The people on there seemed to be using this to extort people (mostly women) by being able to record videos without the owner knowing. Some really dark…

Yeah the first day I read about RATers... jesus. The camera LED seemed to be a major thing for them, because if they could bypass it then the chance their RAT would be discovered was much lower.

Really nasty world they've made for themselves, blackmailing, extorting and generally controlling other people (mostly women and girls, but some men too) with threats of releasing compromising material.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#258

Post by qingcharles »

ohhnoodont wrote: post #242
axoltl wrote: post #163

Earlier quoted context omitted.

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Yes, photos of naked people are used to extort them (usually into just paying the holder to delete them).

https://news.ycombinator.com/item?id=42261730

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#259

Post by jorvi »

dole wrote: post #193
connicpu wrote: post #72

Earlier quoted context omitted.

An indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for…

The Dell Latitude business laptops now have a wired led and wired switch. Besides the white led, there’s no indication which is on or off, and I don’t trust any of the software or firmware chain to be reliable. (score one for macs being transparent and prescient)

For some inexplicable reason Dell has chosen to mark the button as "mute mic" (mic icon + X). So if the LED on the keyboard is lit up, the microphone is off, or rather, the microphone muting is on on. Brilliant design.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#260

Post by dhosek »

cthalupa wrote: post #219
perching_aix wrote: post #63

Earlier quoted context omitted.

Wasn't arguing that it's difficult, just that it's needed (and that I'm not expecting it to be done in practice. Because the indicator LED on my laptop doesn't do it either, despite being enterprise grade).

My 2023 MBP webcam light stays on for nearly 3 seconds after the webcam itself turns off.

Which is part of the design (see comments from the security architect elsewhere in the discussion).
Post reply on HN