Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

391–400 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#391

Post by netsharc »

vaylian wrote: post #323
nrp wrote: post #307

Earlier quoted context omitted.

We have that on the most recent generation of Framework Laptop. When the hardware privacy switch is engaged, the image sensor is electrically powered off and the camera controller feeds a dummy frame with an illustration of the switch.

Is there a video or some images of this somewhere? I would love to see a demonstration.

I looked it up on YouTube

https://www.youtube.com/watch?v=k6AsIqAmpeQ&t=1145s

And adding 2+2, the man being interviewed (Nirav Patel) is the same man who replied to my comment (HN user nrp), i.e. the man who actually did the overengineering.

If you rewind to 17:03, he talks about the changes of what the switch does (previously: USB disconnection, now: as he described in grandparent comment).

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#392

Post by unit149 »

>getting software control of the webcam LED on ThinkPad X230 without physical access to the laptop.

adding an LED implant control by flashing a USB, internally on an "8051-based" CPU, where the value's dependence is a feature of a dynamic memory allocator.

going one step further with cron tasks scheduled at irregular intervals would be interesting.

used to be able to do the inverse with an old TV set using a RFID controller back in the early 90's.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#393

Post by lukan »

ddalex wrote: post #357
oneshtein wrote: post #347

Earlier quoted context omitted.

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

Sound is usually more sensitive, yes. But even if there is a physical switch on the laptop, only very exotic smartphones have them.

Also, loudspeakers can act as microphones, too.

In other words, paranoia gets exhausting in modern times.

(And my smartphone has a replacable battery for that reason to at least sometimes enjoy potentially surveillance free time)

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#394

Post by atoav »

throw646577 wrote: post #379
atoav wrote: post #368

Earlier quoted context omitted.

The mentioned one shot circuit does precisely that, in hardware for less cost and 100% non-overridable. The only time that isolated hardware approach is benefitial in terms of costs would be when you already have to have that microcontroller there for different reasons and the cost difference we are talking about is in the order of a few cents max.

Well there is a microcontroller there, isn't there? For the camera.

But is it isolated? If you can update its Firmware from the computer it isn't.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#395

Post by camgunz »

ddalex wrote: post #357
oneshtein wrote: post #347

Earlier quoted context omitted.

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

A picture of you with the subject "I know what you were looking at when I took this picture of you" is pretty good blackmail--I think there's an active campaign doing this even.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#396

Post by spacemanspiff01 »

ddalex wrote: post #357
oneshtein wrote: post #347

Earlier quoted context omitted.

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

I honestly like the physical switch on the framework, which disconnects the microphone/webcam fully.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#397

Post by sylware »

Saw that a decade ago, and let's not talk about the mic you cannot mechanically disable.

Deliverable computer security is something which does _NOT_ exist. If somebody is telling you otherwise, they are trying to sell you something.

Less worse scenario: you need to strip down software (including the SDK) and hardware to the bear minimum, and to aim for excrutiating simplicity still able to do a good enough job (this is currently mostly denied by the "planned obsolescence" and "overkill complexity" from Big Tech or brain damaged "standards/SDK"). Maybe, then, and I say maybe, you may have a little chance, but usually that chip(CPU) you are using is full of backdoors (or convenient bugs) anyway.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#398

Post by ashoeafoot »

ddalex wrote: post #357
oneshtein wrote: post #347

Earlier quoted context omitted.

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

Your speakers are a microphone ..

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#399

Post by ddalex »

camgunz wrote: post #395
ddalex wrote: post #357

Earlier quoted context omitted.

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

A picture of you with the subject "I know what you were looking at when I took this picture of you" is pretty good blackmail--I think there's an active campaign doing this even.

This would've been blackmail 20 years ago.... nowadays it's just "of course you know, I shared my OF likes publicly", will not even raise an eyebrow; or perhaps I'm living in too bohemian society circles

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#400

Post by rickdeckard »

Production of the ThinkPad X230 stopped 10 years ago in 2014. Would be more interesting to read something about a RECENT model.

In late 2014 was the last big webcam vulnerability "hype" I remember [1], which led to a wave of media attention, webcam covers, vendor statements that LED-control is / will be hard-wired etc.

I'm more interested how this big attention impacted future designs of laptops (like my cheap HP here, which has a built-in camera cover)

[1]: https://www.usenix.org/conference/usenixsecurity14/technical...

Post reply on HN