Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

271–280 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#271

Post by xxs »

akira2501 wrote: post #204
perching_aix wrote: post #41

Earlier quoted context omitted.

For what it's worth, you could just power on the camera, take a pic, then turn it back off instead. Provided you can do this fast enough, an indicator LED is rendered worthless. So you'd need to make the indicator LED staggered, to stay lit for a minimum amount of time. There's also the scenario where the LED or the connections to it simply fail. If the circuit doesn't account for that, then boom, now your camera can…

LEDs are diodes. So you can run power _through_ them. Power Supply -> LED -> Camera.

While true, the amount of power would be too low, LEDs also have quite high forward voltage (~3V for blue ones) and they are current driven devices. That suggestion would require pass all the current through the LEDs. LEDs don't like to be reverse biased either. Overall, it's a rather appalling idea. On top of the fact that LEDs can fail short.

More also you'd want a hold up time for the light (few seconds at least), as taking pictures would flash them for 1/60 of a second or so.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#273

Post by xxs »

perching_aix wrote: post #80
homebrewer wrote: post #74

Earlier quoted context omitted.

JIRA is "enterprise grade", I wouldn't place too much faith into that term.

Trust me, I was using it semi-sarcastically too. This thing is slower than my old Pentium 4 would be, yet has a fast enough 30% to 3% battery discharge rate that it would make the speed of light itself blush.

The main culprit is that anyone estimating battery life in percentages. It's about voltage and current draw. The battery voltage can be read directly.

About being slow, I suppose it does run windows and its infamous 'defender'

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#275

Post by int_19h »

axoltl wrote: post #163
varenc wrote: post #81

Earlier quoted context omitted.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

Thank you for your work on this! I wish some other large companies took privacy that seriously.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#277

Post by hunter-gatherer »

Nursie wrote: post #253
ohhnoodont wrote: post #242

Earlier quoted context omitted.

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Depends what your threat model is? Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc. If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine. So sure, maybe people oug…

I'm not arguing a point here, but I'm curious what the actual number of instances exist where someone is naked or in some other extortionate way (accidently of course) potentially exposed from the position of their webcam. I too would be much more concerned about my microphone, where I know one had conversations that in front of or next to my machine that I wouldn't want "out there". In terms of where my camera is, I woukd imagine they would catch me picking my nose every so often but that's about it.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#278

Post by joeblubaugh »

Nursie wrote: post #253
ohhnoodont wrote: post #242

Earlier quoted context omitted.

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Depends what your threat model is? Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc. If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine. So sure, maybe people oug…

> Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby.

This isn't true at all, even for private citizens. Your friends, parents, children, and colleagues are all likely to care.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#279

Post by KennyBlanken »

axoltl wrote: post #163
varenc wrote: post #81

Earlier quoted context omitted.

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script th…

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

I've seen a million people parroting "oh now apple fixed it!" and not a single person who has actually verified/proved it. Go on, show my any third party security researcher who has verified this claim via examining the actual hardware.

You'll pardon us all if we don't really believe you, because a)there's no way for any of us to verify this and b)Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#280

Post by [deleted] »

lynndotpy wrote: post #203
3eb7988a1663 wrote: post #104

Earlier quoted context omitted.

I believe it is possible to turn a speaker into a microphone. Found a paper which claims to do just that[0]. So, there is no safety anywhere? SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit It is possible to manipulate the headphones (or earphones) connected to a computer, silently turning them into a pair of eavesdropping microphones - with software alone. The same is also true for some types of loudspea…

Despite this being a 2016 paper, it's worth noting that this is true in general and has been common(ish) knowledge among electrical engineers for decades. Highschoolers and undergrads in electrical engineering classes often discover this independently. What's notable about this paper is only that they demonstrate it as a practical attack, rather than just a neat fun fact of audio engineering. As a fun fact, an LED ca…

[deleted]
Post reply on HN