Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

501–510 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#501

Post by jamesmotherway »

rickdeckard wrote: post #400

Production of the ThinkPad X230 stopped 10 years ago in 2014. Would be more interesting to read something about a RECENT model. In late 2014 was the last big webcam vulnerability "hype" I remember [1], which led to a wave of media attention, webcam covers, vendor statements that LED-control is / will be hard-wired etc. I'm more interested how this big attention impacted future designs of laptops (like my cheap HP her…

The X230 is still relevant for those who want a ThinkPad that supports Libreboot (an alternative firmware without proprietary components). I personally found this demonstration interesting; users of these devices often believe they're at risk of targeted attacks.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#502

Post by xvector »

Qem wrote: post #492
sandywaffles wrote: post #489

Earlier quoted context omitted.

It is more likely your GPS placed you in the vicinity (regularly?) with another AD ID that regularly searches for, purchases, or visits dog centric locations. It's also entirely possible that the other AD ID's (your grandma) dog food schedule is predictable and you happen to be visiting within a time frame of dog food purchases.

My grandma never owned a cellphone, only an old landline. And she buys dogfood in the neighborhood mom & pop store.

Well, we know for a fact it wasn't your mic being recorded. Maybe you walked by WiFi networks where people purchase dog food.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#503

Post by sharpshadow »

lukan wrote: post #393
ddalex wrote: post #357

Earlier quoted context omitted.

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

Sound is usually more sensitive, yes. But even if there is a physical switch on the laptop, only very exotic smartphones have them. Also, loudspeakers can act as microphones, too. In other words, paranoia gets exhausting in modern times. (And my smartphone has a replacable battery for that reason to at least sometimes enjoy potentially surveillance free time)

I have an old iPhone 7 which has an audio IC issue and the microphone is physically disconnected. Calls don’t work, video records without sound etc. need to connect an external microphone to have one.

Apart from the inconvenience it was somehow liberating knowing there is no microphone physically active.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#504

Post by meindnoch »

goodpoint wrote: post #387
meindnoch wrote: post #131

Earlier quoted context omitted.

Camera + bag of chips: https://people.csail.mit.edu/mrub/VisualMic/

Impossible with normal cameras.

"We also explore how to leverage the rolling shutter in regular consumer cameras to recover audio from standard frame-rate videos, and use the spatial resolution of our method to visualize how sound-related vibrations vary over an object’s surface, which we can use to recover the vibration modes of an object."

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#505

Post by gregmac »

dole wrote: post #193
connicpu wrote: post #72

Earlier quoted context omitted.

An indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for…

The Dell Latitude business laptops now have a wired led and wired switch. Besides the white led, there’s no indication which is on or off, and I don’t trust any of the software or firmware chain to be reliable. (score one for macs being transparent and prescient)

Yeah, the physical barrier is key. It's not that hard, and provides absolute certainty. As indicated by this thread, software experts (rightly) don't trust software by itself enough. It's by the same rationale software people are proponents of electronic voting machines printing physical, verifiable paper copies of votes.

My Latitude 7440 has a physical slider switch that covers the camera, in addition to turning it off in a software-detectable way (it shows "no signal" and not just a black screen once the slider is about 50% covering the lens). My only criticism of this is that it's subtle and at a glance hard to tell the difference between open and closed, but I guess you just get used to the slider being to the right.

I was just testing and the white LED comes on when I open something that wants to use the camera, even when the cover is closed. This seems like a useful way to detect something (eg malware) trying to use the camera, and is a good reason to not bluntly cut power to the entire camera module.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#506

Post by ewoodrich »

ComputerGuru wrote: post #463
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Cameras are now always on, to reduce the latency to taking a picture or scrubbing video feed. You’d need to wire the led to something tied to the data lines, perhaps.

My M1 Macbook has some pretty extreme latency going from opening Photobooth black screen -> displayed image. Roughly five seconds to useable image.

  :00 Photobooth window open 
  :03 Camera LED lights up 
  :05 First image displayed

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#507

Post by nrp »

netsharc wrote: post #391
vaylian wrote: post #323

Earlier quoted context omitted.

Is there a video or some images of this somewhere? I would love to see a demonstration.

I looked it up on YouTube https://www.youtube.com/watch?v=k6AsIqAmpeQ&t=1145s And adding 2+2, the man being interviewed (Nirav Patel) is the same man who replied to my comment (HN user nrp), i.e. the man who actually did the overengineering. If you rewind to 17:03, he talks about the changes of what the switch does (previously: USB disconnection, now: as he described in grandparent comment).

Our engineering team did the engineering!

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#508

Post by megous »

whatevaa wrote: post #433
MarcusE1W wrote: post #403

Earlier quoted context omitted.

My Pinephone has a switch for the microphone and also my Pinebook Pro laptop. But I also would agree that this is exotic hardware.

Well i have Pinebook Pro and it's pretty much abandonware, pine doesn't do any software and OSS lacks maintainers, nobody want's it, e-waste laptop. Take it as you will.

Yeah, that's nonsense. Pinebook Pro is well supported by Linux kernel and you can thus put any aarch64 Linux distro on it. And it's been this way for the last 3-4 years at the very least.

I've been using it daily for 3 years for watching movies and main notebook while traveling.

It's not at all abandonware or e-waste.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#509

Post by Thorrez »

nine_k wrote: post #305
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

From this comment: https://news.ycombinator.com/item?id=42260379

it sounds like Apple is doing something similar to what you suggest.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#510

Post by kazinator »

nine_k wrote: post #305
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Even if the LED were controlled by hardware, merely that you can reprogram the camera firmware on this Thinkpad is troubling. Malicious things can be done without the ability to turn off the LED during recording. Like capture images during legitimate recording, or start recording with the LED on banking on the user not noticing.

Firmware programming should require physical access, like temporarily installing a jumper, or pushing some button on the circuit board or something.

(I don't want to suggest signed images, because that's yet another face of the devil).

Post reply on HN