Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

321–330 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#321

Why The FBI Director Puts Tape Over His Webcam "I saw something in the news, so I copied it. I put a piece of tape — I have obviously a laptop, personal laptop — I put a piece of tape over the camera. Because I saw somebody smarter than I am had a piece of tape over their camera." https://www.npr.org/sections/thetwo-way/2016/04/08/473548674... Is there anyone who doesn't do this?

Nope, in fact i have no built in mic or camera, and theyre unplugged when not strictly needed.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#323
post #307

Earlier quoted context omitted.

> I can imagine lots of people calling customer service "Q: why doesn't my camera work?", "A: Did you open the cover?" In some over-engineered world, when the camera cover is engaged the webcam video feed would be replaced by an image of the text "Slide camera cover open" (in the user's language) and an animation showing the user how to do so.

We have that on the most recent generation of Framework Laptop. When the hardware privacy switch is engaged, the image sensor is electrically powered off and the camera controller feeds a dummy frame with an illustration of the switch.

Is there a video or some images of this somewhere? I would love to see a demonstration.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#324
post #262

Earlier quoted context omitted.

> and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. I may be the oddball here, but that 3 second duration does not comfort me. The only time I would notice it is if I am sitting in front of the computer. While someone snapping a photo of me while working is disconcerting, it is not the end of the world. Someone snapping photos while I am away from the screen is m…

It's strange that none of these companies will include a closable cover for the camera. I got one aftermarket. It is very reassuring since no hacking or accidental misclicks on my part can move the cover.

I also purchased a cover for mine, although in a pinch, the removable stickers on fruit work well.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#325
post #305
post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#326

Earlier quoted context omitted.

It's strange that none of these companies will include a closable cover for the camera. I got one aftermarket. It is very reassuring since no hacking or accidental misclicks on my part can move the cover.

I have a sticky piece of post it note more or less permanently affixed over my camera.

I can remember when someone spotted tape over Zuckerberg's laptop camera. Ref: https://www.theverge.com/2016/6/21/11995032/mark-zuckerberg-...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#327

Earlier quoted context omitted.

I can't find it now, but recently I read how one company's design team added this feature to their laptops. A subsequent review by the team responsible for manufacturing found that they could change the circuit to cut down on the part count to save money. The light was still there, but it was no longer hardwired. The company continued to advertise the camera light as being hardwired even though it wasn't.

That fact pattern would setup a solid fraud case against the company and necessitate a recall at a minimum.

Which makes me doubt the anecdote, besides the lack of any specifics or reference.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#328
post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

While Apple made a laudable effort in this design, sadly it requires thoughtful care and design at every iteration. Typically the iPhone team couldn't pull it off and the only official claim is for macbooks. I think it's simpler to assume that most devices can be hacked and the LED indicator isn't infailable than to always keep in mind which device lines are supposed to be safe and which ones aren't.

Apparently it was purely in software on iPhone/iPad. However, starting with the iPhone 16 and M4 iPad Pro, the LED indicator is rendered by a separate secure exclave:

https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip...

https://mastodon.social/@_inside/112552696723119626

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#329
After GCHQ was discovered doing this back in 2014 with their 'Optic Nerve' program[0], I have tried to avoid computers with integrated webcams for use as my personal devices (exceptions are mobile devices).

An exception to that rule is if they have hardware switches for turning off the power supply to the camera and microphone.

Currently, I am very happy with my Framework, where the LED is hardwired into the power supplied to the camera[1].

[0]: https://en.wikipedia.org/wiki/Optic_Nerve_(GCHQ)

[1]: https://community.frame.work/t/how-do-the-camera-and-microph...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#330
post #69

Earlier quoted context omitted.

same... i'm also surprised that having a software controlled led would be cheaper ..

It could be something very simple, such as requiring less USB hub complexity for a camera that can be woken up via a command on the USB bus instead of needing to connect/disconnect the USB power rails (wired in parallel with the LED) to it. Somebody here has also mentioned Apple using the camera for brightness and maybe color temperature measurement, for which they wouldn't want to enable the LED (or it would effecti…

> Somebody here has also mentioned Apple using the camera for brightness and maybe color temperature measurement, for which they wouldn't want to enable the LED (or it would effectively always be on).

That is not true. MacBooks have separate light sensors. And the camera physically cannot activate without the LED lighting up and a notification from the OS. People say a lot of stupid things in the comments…

Post reply on HN