Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

351–360 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#351

Post by nine_k »

throw646577 wrote: post #342
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

> The LED should be connected to camera's power, or maybe camera's "enable" signal. Wiring it in like this is suboptimal because this way you might never see the LED light up if a still photo is surreptitiously captured. This has been a problem before: illicit captures that happen so quickly the LED never has time to warm up. Controlling the LED programmatically from isolated hardware like this is better , because th…

Pray read the third paragraph of my reply :) It specifically mentions a way to make the LED be lit for long enough.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#352

Post by perching_aix »

lxgr wrote: post #289
perching_aix wrote: post #214

Earlier quoted context omitted.

Network traffic monitoring is routinely done at enterprises. It's usually part-automated using the typical approaches (rules and AI), and part-manual (via a dedicated SOC team). There are actual compromises caught this way too, it's not (entirely) just for show. A high-profile example would be Kaspersky catching a sophisticated data exfiltration campaign at their own headquarters: https://www.youtube.com/watch?v=1f6Y…

I do believe that it sometimes works, but it's effectively like missile defense: Immensely more expensive for the defender than for the attacker. If the attacker has little to lose (e.g. because they're anonymous, doing this massively against many unsuspecting users etc.), the chance of them eventually succeeding is almost certain.

All cyberdefenses I'm aware of are asymmetric in nature like that, unfortunately.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#354

Post by sneak »

ohhnoodont wrote: post #242
axoltl wrote: post #163

Earlier quoted context omitted.

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-arch…

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

They are, but people aren’t scared of those because they can’t see them staring at them.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#355

Post by perching_aix »

akira2501 wrote: post #298
xxs wrote: post #271

Earlier quoted context omitted.

While true, the amount of power would be too low, LEDs also have quite high forward voltage (~3V for blue ones) and they are current driven devices. That suggestion would require pass all the current through the LEDs. LEDs don't like to be reverse biased either. Overall, it's a rather appalling idea. On top of the fact that LEDs can fail short. More also you'd want a hold up time for the light (few seconds at least),…

They have high forward voltage /drop/ which is a useful property. You drive them with constant current for constant brightness and improved lifespan which is most pertinent for LED light bulb replacements than it is for a simple signal status light. Fixed delay before standby isn't hard to enforce either. Even so this whole attack vector isn't solved with this. How long should the light stay on for after the camera i…

As long as you remember the previous number correctly at least... :)

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#356

Post by salutis »

perching_aix wrote: post #157
salutis wrote: post #132

Earlier quoted context omitted.

Yes, ultimately, I want everything to be open. This is not a bag of rice. These are devices packed with sensors, in our homes. As for inspection, I do not have a problem trusting others. I just do not trust big corporations with remotely controlled binary blobs, no matter how much money they put into the safety and security ads. This is a personal opinion, of course.

> As for inspection, I do not have a problem trusting others. I just do not trust big corporations with remotely controlled binary blobs I'll just highlight this excerpt of your own words for you, and usher you to evaluate whether your position is even internally consistent.

Why do you think my stance is internally inconsistent?

For example, I completely trust Emacs maintainers, as I have yet to see any malice or dark patterns coming from them. The same applies to other free and open source software I use on a daily basis. These projects respect my privacy, have nothing to hide, and I have no problem trusting them.

On the other hand, I see more and more dark patterns coming from Apple, say when signed out of their cloud services. They pour millions into their privacy ads, but I do not trust them to act ethically, especially when money is on the table.

Does this not make sense?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#357

Post by ddalex »

oneshtein wrote: post #347
jdblair wrote: post #325

Earlier quoted context omitted.

or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information.

There is no physical microphone cover there, is it ?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#358

Post by mrb »

wmlhwl wrote: post #162
mrb wrote: post #76

On a ThinkPad X1 Carbon Gen 8, it's easily possible record video with the webcam LED off. I did not verify newer generations of the X1 Carbon. Lenovo put a little physical switch—they call it "ThinkShutter"—that serves to physically obstruct the webcam lens to prevent recording. It's supposed to have only two positions: lens obstructed or not. But if the user accidentally slides it halfway, you can still record video…

In Yoga C740 it only blocks the shutter. Covering the LED doesn't make sense to me

I suppose covering the LED is a less expensive way to provide the same user experience as hooking an electrical switch to the ThinkShutter to electrically turn off the LED when it's in the "blocked" position.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#359

Post by rightbyte »

throw646577 wrote: post #342
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

> The LED should be connected to camera's power, or maybe camera's "enable" signal. Wiring it in like this is suboptimal because this way you might never see the LED light up if a still photo is surreptitiously captured. This has been a problem before: illicit captures that happen so quickly the LED never has time to warm up. Controlling the LED programmatically from isolated hardware like this is better , because th…

You can design a simple circuit such that both long and short pulses light up the led for atleast 500ms. There is no tradeoff needed to be made at all.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#360

Post by sunsetonsaturn »

rocqua wrote: post #343
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

How will microphone access be monetized? For video, it is extortion. For microphone, it's much harder.

Record, produce transcript, look for keywords, alert the puppeteer when something interesting is picked up - trade secrets, pre-shared keys, defense sector intelligence, etc.
Post reply on HN