Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

361–370 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#361

Post by perching_aix »

salutis wrote: post #356
perching_aix wrote: post #157

Earlier quoted context omitted.

> As for inspection, I do not have a problem trusting others. I just do not trust big corporations with remotely controlled binary blobs I'll just highlight this excerpt of your own words for you, and usher you to evaluate whether your position is even internally consistent.

Why do you think my stance is internally inconsistent? For example, I completely trust Emacs maintainers, as I have yet to see any malice or dark patterns coming from them. The same applies to other free and open source software I use on a daily basis. These projects respect my privacy, have nothing to hide, and I have no problem trusting them. On the other hand, I see more and more dark patterns coming from Apple, s…

Thinking about it, I might have misunderstood what you wrote a bit. What I read was that you trust people, but then you also don't. That's not really a fair reading of what you wrote.

That being said, I have seen "patterns" with open source software as well, so I'm hesitant to agree on trusting it. But that's a different problem.

I also know how little hardware, microcode and firmware can be trusted, so that doesn't help either.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#363

Post by beAbU »

nine_k wrote: post #305
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Yet some laptops (Thinkpads ironically) come with a built in camera shutter that's entirely mechanical.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#364

Post by klausa »

ddalex wrote: post #357
oneshtein wrote: post #347

Earlier quoted context omitted.

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

Modern (2019-ish? forwards?) MacBooks have physical disconnect for microphones when the lid is shut.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#365

Post by d1sxeyes »

aendruk wrote: post #218
connicpu wrote: post #72

Earlier quoted context omitted.

An indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for…

> The blocker is black and white stripes On my ThinkPad it’s instead painted with a red dot. Because, obviously, the conventional meaning of a red dot appearing on a camera is “not recording”.

Same on my Dell Latitude. Seems a very odd design decision. They've also centrally aligned the switch so that it's not immediately obvious from the switch position whether the cover is iver the lens or not. Super annoying.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#367

Post by xxs »

perching_aix wrote: post #345
xxs wrote: post #273

Earlier quoted context omitted.

The main culprit is that anyone estimating battery life in percentages. It's about voltage and current draw. The battery voltage can be read directly. About being slow, I suppose it does run windows and its infamous 'defender'

No, I think it's fairly easy to see that a third of the charge suddenly disappearing is a fairly uncommon behavior. Same for your Windows idea...

"A third" is again fraction/percentage - it's still a representation stuff that depends on charge and charge cycles... and likely previous over charging and heat (Li-Ion doesn't like heat).

To put it simply: the charge level, usually, is just a lookup table for voltage (not under load).

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#368

Post by atoav »

throw646577 wrote: post #342
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

> The LED should be connected to camera's power, or maybe camera's "enable" signal. Wiring it in like this is suboptimal because this way you might never see the LED light up if a still photo is surreptitiously captured. This has been a problem before: illicit captures that happen so quickly the LED never has time to warm up. Controlling the LED programmatically from isolated hardware like this is better , because th…

The mentioned one shot circuit does precisely that, in hardware for less cost and 100% non-overridable.

The only time that isolated hardware approach is benefitial in terms of costs would be when you already have to have that microcontroller there for different reasons and the cost difference we are talking about is in the order of a few cents max.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#369

Post by xxs »

jmb99 wrote: post #300
xxs wrote: post #273

Earlier quoted context omitted.

The main culprit is that anyone estimating battery life in percentages. It's about voltage and current draw. The battery voltage can be read directly. About being slow, I suppose it does run windows and its infamous 'defender'

> The main culprit is that anyone estimating battery life in percentages. I thought this was a solved problem, like, decades ago? At least I remember even the first gen MacBooks having accurate battery percentages, and it’s a more vague memory but my PowerBook G4 did too I think.

The "accurate" charging level mostly happens with specific amount of charge cycles (i.e. new). Laptop batteries suffer from higher temperature (over 60C), overcharging (over 4.22 per Li-Ion for most chemistries).

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#370

Post by jdblair »

ddalex wrote: post #357
oneshtein wrote: post #347

Earlier quoted context omitted.

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

The Framework has a physical microphone switch next to the camera switch.
Post reply on HN