Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

511–520 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#511

Post by elevaet »

curun1r wrote: post #95
epistasis wrote: post #17

I can see why some people might be concerned about the camera, but I'm far more concerned by the microphone. There's far more sensitive and actionable information that can be gathered from me that way! I'm glad that macOS started putting a light in the menubar when the microphone is in use, but I'd prefer to have unhackable hardware for that instead.

The microphone also can't be covered with a $1 plastic camera cover off Amazon. It's so easy to solve the camera issue if you care about it, but there's really nothing you can do about the mic.

You can do it even cheaper with some painter's tape!

For the mic, perhaps you could disable it by plugging in an unconnected trrs plug into the audio jack. I'm not sure how low level the switching of the microphone source is when you do this, so maybe it's not a good method.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#512

Post by abtinf »

mrweasel wrote: post #435
paxys wrote: post #15

Earlier quoted context omitted.

No amount of microphones will ever be a bigger problem than a single compromising photo or video.

If an attacker is at the point where they can turn on your microphone, or video, it doesn't really matter anymore, it's been game over for a long time. This never really registered to me, before a former colleague commented on the nonsense with people putting tape over their camera. If an attacker has access to your camera, or microphone, then they have access to pretty much very thing else. The difference in damage…

> If an attacker is at the point where they can turn on your microphone, or video, it doesn't really matter anymore, it's been game over for a long time.

This is obviously incorrect.

There is lots of software that can get access to your camera/microphone but not have access to anything else, like browser-based applications. And on Mac even locally installed applications are limited; getting access to user data directories requires a separate permission grant from webcam access.

You might also simply have nothing incriminating on your machine.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#513

Post by Thorrez »

rocqua wrote: post #338
ohhnoodont wrote: post #310

Earlier quoted context omitted.

I think we may just be bumping into cultural differences here. I grew up in a household were being naked around family members was common. I spend time in clothing-optional spaces. I rarely draw the blinds on my windows, etc. I'm not concerned with what other people think in this way and such images could never be used to extort me. Consider the case of Germany - people there are extremely concerned about their priva…

Empirically, most low level extortion does seem to be about leaking video. I would see a threat model based on 'criminal wants to extort me for money'. As more reasonable than 'creep wants to look through my computer for creeping'. And it seems like extortion focusses on video, so that is the bigger threat. Even if it is less invasive. I presume the reason behind this is that video is much more likely to be re-shared…

I think extortion in the form of "I've encrypted your data, pay to get it back" is much more common. Ransomware. It's scalable, automatable. Extortion of video is harder to automate.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#514

Post by Vogtinator »

alwyn wrote: post #473
jdblair wrote: post #325

Earlier quoted context omitted.

or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!

My previous HP Envy x360 had such a switch on the side of the laptop that would electronically disconnect the webcam; it would completely disconnect according to the system. Enabling it would show a new device being connected in `dmesg`. Not a great laptop otherwise, but that was pretty good!

My envy x360 has that button as well and it even puts a physical shutter in front of the webcam in addition to disconnecting USB.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#515

Post by KetoManx64 »

whatevaa wrote: post #433
MarcusE1W wrote: post #403

Earlier quoted context omitted.

My Pinephone has a switch for the microphone and also my Pinebook Pro laptop. But I also would agree that this is exotic hardware.

Well i have Pinebook Pro and it's pretty much abandonware, pine doesn't do any software and OSS lacks maintainers, nobody want's it, e-waste laptop. Take it as you will.

Don't they warn you on the product page that you are buying hardware that is fully reliant on the community for functionality? That's the reason it's so inexpensive

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#516

Post by unglaublich »

mrb wrote: post #76

On a ThinkPad X1 Carbon Gen 8, it's easily possible record video with the webcam LED off. I did not verify newer generations of the X1 Carbon. Lenovo put a little physical switch—they call it "ThinkShutter"—that serves to physically obstruct the webcam lens to prevent recording. It's supposed to have only two positions: lens obstructed or not. But if the user accidentally slides it halfway, you can still record video…

This tells you a lot about Lenovo's engineering.

They fail to develop a reliable webcam indicator, and patch that with some half-assed attempt at physical view obstruction. The whole approach is a demonstration of bad engineering and unreliability. And that's just the part that became public.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#517

Post by throw16180339 »

camgunz wrote: post #395
ddalex wrote: post #357

Earlier quoted context omitted.

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

A picture of you with the subject "I know what you were looking at when I took this picture of you" is pretty good blackmail--I think there's an active campaign doing this even.

I received a phishing email from this campaign or a similar one several months ago. The email opened with my name and contained a Google Maps photo of a house where I'd lived 8 years before. The author claimed to have hacked my laptop and captured videos of me doing embarrassing things. They would release the videos unless I paid them $1000 in Bitcoin. I searched and it's an extremely common scam, but I did panic for a few minutes.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#518

Post by unglaublich »

Roark66 wrote: post #460

Note, that someone somewhere made a decision not to hardwire the led to the camera enable line. This to me is far more of a scandal than the fact another person decided to exploit it.

In reality, those engineering faults are more stupidity than malice.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#519

Post by 4k93n2 »

71bw wrote: post #424
curun1r wrote: post #95

Earlier quoted context omitted.

The microphone also can't be covered with a $1 plastic camera cover off Amazon. It's so easy to solve the camera issue if you care about it, but there's really nothing you can do about the mic.

I went the "batshit insane" route and my microphone hole is plugged in with some clay. It did most likely physically damage it forever, but at least I now know it's OFF for good.

i tried that with some sugru on an old phone (samsung s10e) and it does a really good job of blocking the microphone.

if you have a case on your phone its a lot less destructive too since you can just stuff the sugru into the microphone hole in the case. the case i was using was soft rubber so it was easy enough to pop out the corner of the case to be able to use the microphone for a call.

that wasnt my daily phone at the time though so im not sure how well it would work in reality. i could see myself forgetting to pop out the case when i get a call and the other person just handing up before i realised what was going on.

it also doesnt work on every phone. i tried the same thing on a pixel 5 but blocking the mic hole did nothing, but that phone uses an under screen speaker so maybe there is something similar going on with the mic

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#520

Post by IanGabes »

unglaublich wrote: post #516
mrb wrote: post #76

On a ThinkPad X1 Carbon Gen 8, it's easily possible record video with the webcam LED off. I did not verify newer generations of the X1 Carbon. Lenovo put a little physical switch—they call it "ThinkShutter"—that serves to physically obstruct the webcam lens to prevent recording. It's supposed to have only two positions: lens obstructed or not. But if the user accidentally slides it halfway, you can still record video…

This tells you a lot about Lenovo's engineering. They fail to develop a reliable webcam indicator, and patch that with some half-assed attempt at physical view obstruction. The whole approach is a demonstration of bad engineering and unreliability. And that's just the part that became public.

I think that its easier to compare the shutter to airplane windows.

The windows are there just to make the humans inside more comfortable, similar to how many people would be more comfortable without a camera pointed at them.

Flashing firmware is a big hill to climb for bad guys in most peoples worlds.

Post reply on HN