Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

291–300 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#291

Post by Nursie »

joeblubaugh wrote: post #278
Nursie wrote: post #253

Earlier quoted context omitted.

Depends what your threat model is? Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc. If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine. So sure, maybe people oug…

> Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. This isn't true at all, even for private citizens. Your friends, parents, children, and colleagues are all likely to care.

It's very limited, it's certainly not going to be passed around like naked pictures could be.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#292

Post by ohhnoodont »

jamesmotherway wrote: post #263
ohhnoodont wrote: post #242

Earlier quoted context omitted.

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

"All Apple silicon-based Mac notebooks and Intel-based Mac notebooks with the Apple T2 Security Chip feature a hardware disconnect that disables the microphone whenever the lid is closed. On all 13-inch MacBook Pro and MacBook Air notebooks with the T2 chip, all MacBook notebooks with a T2 chip from 2019 or later, and Mac notebooks with Apple silicon, this disconnect is implemented in hardware alone." [1] [1] https:/…

Obviously the camera is also 'disabled' when the lid is closed regardless of the controlling circuitry. So while that's a good feature, it's not relevant.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#293

Post by ohhnoodont »

qingcharles wrote: post #258
ohhnoodont wrote: post #242

Earlier quoted context omitted.

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Yes, photos of naked people are used to extort them (usually into just paying the holder to delete them). https://news.ycombinator.com/item?id=42261730

This raises a different but related question. In what world should a victim of a crime be extorted for doing innocent things in their home. If a peeping tom took a photo though a window, could that be used to extort someone?

When people are extorted for these kinds of things it's usually catfishing that leads to sexual acts being recorded. That's not related to cybersecurity.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#294

Post by WalterBright »

lxgr wrote: post #23
WalterBright wrote: post #12

Of course it can. Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? Never. Me, I unplug the camera and mike when not in use.

> Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? Your preferences are not everybody's. Personally, I'd be totally fine with a camera and microphone LED that is guaranteed to activate whenever there is power/signal flowing from either. > Me, I unplug the camera and mike when not in use. That's a bit hard to do on a laptop that has both built in.

> guaranteed

I used to design airplane parts and systems. A guarantee isn't worth squat. Being able to positively verify it is what works.

You're right that I don't use a laptop for videoconferencing. I wouldn't use the builtin mike and camera anyway, as a 5 cent microphone can make it hard for the other party to understand you. I use a semi pro mike. If you're in business, I recommend such a setup.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#295

Post by trogdor »

KennyBlanken wrote: post #279
axoltl wrote: post #163

Earlier quoted context omitted.

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

I've seen a million people parroting "oh now apple fixed it!" and not a single person who has actually verified/proved it. Go on, show my any third party security researcher who has verified this claim via examining the actual hardware. You'll pardon us all if we don't really believe you, because a)there's no way for any of us to verify this and b)Apple lied about it before, claiming the LED was hard-wired in blah bl…

> Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware.

Source?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#296

Post by WalterBright »

pessimizer wrote: post #156
WalterBright wrote: post #12

Of course it can. Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? Never. Me, I unplug the camera and mike when not in use.

> Cameras and microphones and write enable must have physical switches, not software ones. When will people learn? I feel like people were pleading for this when people were getting ratted and began taping over their cameras, and the tiny number of laptop manufacturers just ignored what would be a cheap easy change. Eventually, people just accepted that it must be impossible to install a switch. I couldn't ever think…

I remember the repair book "How To Keep Your Volkswagen Alive for the Complete Idiot". On some beetles the battery light would flicker dimly, though nothing seemed to be wrong. The recommended fix was to put enough tape over it to block the flicker, but not the full on.

Black electrical tape was also the solution for the blinking 12:00 on consumer VCRs.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#297

Post by ohhnoodont »

Nursie wrote: post #253
ohhnoodont wrote: post #242

Earlier quoted context omitted.

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

Depends what your threat model is? Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc. If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine. So sure, maybe people oug…

My point is that the threat model is backwards. The threat associated with a camera is the least severe compared to anything else a malicious person could do with access to your computer. Recored conversations, chats and email, browsing history, etc are all much more likely to result in harm if leaked than a recording of you innocently in your home.

> Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby.

That destroys families, standing within a community, and very often careers.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#298

Post by akira2501 »

xxs wrote: post #271
akira2501 wrote: post #204

Earlier quoted context omitted.

LEDs are diodes. So you can run power _through_ them. Power Supply -> LED -> Camera.

While true, the amount of power would be too low, LEDs also have quite high forward voltage (~3V for blue ones) and they are current driven devices. That suggestion would require pass all the current through the LEDs. LEDs don't like to be reverse biased either. Overall, it's a rather appalling idea. On top of the fact that LEDs can fail short. More also you'd want a hold up time for the light (few seconds at least),…

They have high forward voltage /drop/ which is a useful property. You drive them with constant current for constant brightness and improved lifespan which is most pertinent for LED light bulb replacements than it is for a simple signal status light. Fixed delay before standby isn't hard to enforce either.

Even so this whole attack vector isn't solved with this. How long should the light stay on for after the camera is put in standby before a user considers it a nuisance? 5 seconds? So if I turn my back for longer than that I'm out of luck anyways.

The anti-TSO means would be a hardware serial counter with a display on the camera. Each time the camera is activated the number is incremented effectively forming a camera odometer. Then if my previous value does not match the current value I know it's been activated outside of my control.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#299

Post by axoltl »

II2II wrote: post #262
axoltl wrote: post #163

Earlier quoted context omitted.

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

> and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. I may be the oddball here, but that 3 second duration does not comfort me. The only time I would notice it is if I am sitting in front of the computer. While someone snapping a photo of me while working is disconcerting, it is not the end of the world. Someone snapping photos while I am away from the screen is m…

Right, so this is all defense in depth. That LED is sort of the last line of defense if all others have failed, like:

The exploit mitigations to prevent you from getting an initial foothold.

The sandboxing preventing you from going from a low-privileged to a privileged process.

The permissions model preventing unauthorized camera access in the first place.

The kernel hardening to stop you from poking at the co-processor registers.

etc. etc.

If all those things have failed, the last thing to at least give you a chance of noticing the compromise, that's that LED. And that's why it stays on for 3 seconds, all to increase the chances of you noticing something is off. But things had to have gone pretty sideways before that particular hail-mary kicks in.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#300

Post by jmb99 »

xxs wrote: post #273
perching_aix wrote: post #80

Earlier quoted context omitted.

Trust me, I was using it semi-sarcastically too. This thing is slower than my old Pentium 4 would be, yet has a fast enough 30% to 3% battery discharge rate that it would make the speed of light itself blush.

The main culprit is that anyone estimating battery life in percentages. It's about voltage and current draw. The battery voltage can be read directly. About being slow, I suppose it does run windows and its infamous 'defender'

> The main culprit is that anyone estimating battery life in percentages.

I thought this was a solved problem, like, decades ago? At least I remember even the first gen MacBooks having accurate battery percentages, and it’s a more vague memory but my PowerBook G4 did too I think.

Post reply on HN