Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

471–480 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#471

Post by gravitronic »

dghughes wrote: post #445
ddalex wrote: post #357

Earlier quoted context omitted.

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

And the true or not Google or other apps listening then you see ads based on that conversation. I think it's true since far too many times obscure things I've spoken about appear in ads soon after the conversation. So yes I'd say a mic blocking feature you can confirm is working, blocking, is needed.

Reminds me of the chrome bug I filed years ago that is still unfixed. An extension with access to all browsing tabs can open a hidden iframe to a website that commonly would have mic and camera permission (like hangouts.google.com), and then inject its own JavaScript into that hidden iframe to capture mic or camera.

For this to work hangouts.google.com had to not include the HTTP header to block iframing but thankfully if you make up a URL the 404 page served on that domain does not include that http header.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#472

Post by codedokode »

oneshtein wrote: post #347
jdblair wrote: post #325

Earlier quoted context omitted.

or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

My laptop has built-in physical camera cover, and it doesn't cost even as much as a half MacBook.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#473

Post by alwyn »

jdblair wrote: post #325
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!

My previous HP Envy x360 had such a switch on the side of the laptop that would electronically disconnect the webcam; it would completely disconnect according to the system. Enabling it would show a new device being connected in `dmesg`.

Not a great laptop otherwise, but that was pretty good!

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#474

Post by codedokode »

beAbU wrote: post #363
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Yet some laptops (Thinkpads ironically) come with a built in camera shutter that's entirely mechanical.

And they often cost less than a MacBook for which you need to buy an external shutter.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#475

Post by [deleted] »

Nursie wrote: post #331
ohhnoodont wrote: post #310

Earlier quoted context omitted.

I think we may just be bumping into cultural differences here. I grew up in a household were being naked around family members was common. I spend time in clothing-optional spaces. I rarely draw the blinds on my windows, etc. I'm not concerned with what other people think in this way and such images could never be used to extort me. Consider the case of Germany - people there are extremely concerned about their priva…

I think, though am prepared to be wrong, that you'll probably find yourself in the minority there. It's not just about nudity and extortion, but someone having access to watch you, whenever they feel like, in your safe space. That sense of violation that people also feel when (for instance) they have been the victim of burglary - the missing stuff is often secondary to the ruined sense of security. There's a vast dif…

[deleted]

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#476

Post by wmlhwl »

mrb wrote: post #358
wmlhwl wrote: post #162

Earlier quoted context omitted.

In Yoga C740 it only blocks the shutter. Covering the LED doesn't make sense to me

I suppose covering the LED is a less expensive way to provide the same user experience as hooking an electrical switch to the ThinkShutter to electrically turn off the LED when it's in the "blocked" position.

But if we're talking about privacy, I would like to know if something is using the camera even when it's obstructed

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#477

Post by muzster »

Just tried to programatically take a picture on my MacBook Pro 2012. Managed to take a picture in sub second. The LED flashes briefly and you could easily miss it .

Would be good to keep that LED ON well after the Camera switches off (Not sure what that minimum would be without causing an inconvenience - but how about 15 minutes ? - Long enough to educate the users to worry about their privacy and perhaps take breaks between making video calls !) - Just a thought.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#478

Post by canadaduane »

muzster wrote: post #477

Just tried to programatically take a picture on my MacBook Pro 2012. Managed to take a picture in sub second. The LED flashes briefly and you could easily miss it . Would be good to keep that LED ON well after the Camera switches off (Not sure what that minimum would be without causing an inconvenience - but how about 15 minutes ? - Long enough to educate the users to worry about their privacy and perhaps take breaks…

I like the thought, but if it becomes an "oh, that light's always on, just ignore it" kind of experience, that might train people to think it is not an important signal.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#479

Post by fsflover »

epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

My Librem 14 has a microphon+camera kill switch.

Also, on Qubes OS, everything runs in VMs and you choose explicitly which one has the access to microphone and camera (non by default). Admin VM has no network.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#480

Post by [deleted] »

LadyCailin wrote: post #409
ohhnoodont wrote: post #244

Earlier quoted context omitted.

Yup it's wild to me how much anxiety there is about cameras while no mind is given to microphones. Conversations are much more privileged than potentially seeing me in my underwear. That said the most sensitive information is what we already willingly transmit: search queries, interactions, etc. We feed these systems with so much data that they arguably learn things about us that we're not even consciously aware of.…

I’m just going to assume you’re a man, and don’t generally worry about things like revenge porn. Because that is a bigger concern to me than you, it seems. Sure, I don’t want my sound to be recorded either, but that’s why I put a cover on the webcam AND turn off the physical switch on my (external) microphone. They are both easy things to do.

[deleted]
Post reply on HN