Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

461–470 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#461
It's mind-boggling that this is not enforced by hardware: as other commenters has said, both by powering the LED from the same power as the camera, and also by making the enabling of that power use a simple hardware pulse-stretcher that would prevent the attacker from enabling the camera at such a low duty cycle that its flickering would be invisible to the user.

Ideally, the same should also be true of the microphone pre-amp, with its own LED separate from the camera one.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#462
post #357

Earlier quoted context omitted.

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

As someone who often speaks gibberish to myself due to ptsd, if someone recorded me in my room they could convince anyone I am utterly insane, beyond any hope. It is a great way to blackmail people with coprolalia or other verbal tics. And yeah, if they had access to my webcam, they would just see a guy staring into the screen or walking back and forth in the room.

Eh, random utterances are more common than you think. Especially amongst older people. Most will know at least a couple family members who tend to mutter random things to themselves.

Nobody who is themselves sane is going to judge another for random crap they say when they think themselves alone.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#463
post #305
post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Cameras are now always on, to reduce the latency to taking a picture or scrubbing video feed. You’d need to wire the led to something tied to the data lines, perhaps.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#464
post #367

Earlier quoted context omitted.

No, I think it's fairly easy to see that a third of the charge suddenly disappearing is a fairly uncommon behavior. Same for your Windows idea...

"A third" is again fraction/percentage - it's still a representation stuff that depends on charge and charge cycles... and likely previous over charging and heat (Li-Ion doesn't like heat). To put it simply: the charge level, usually, is just a lookup table for voltage (not under load).

In case it was somehow magically unclear, it's not that I don't understand how batteries work, but that either that exact charge approximation mechanism is working exceptionally incorrectly, making it appear as if the battery suddenly lost so much charge, or the battery is a bust.

I do not know whether the battery is actually experiencing that sudden loss in charge, nor do I care, because in practice the end result is the same...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#465
post #431
post #406

Earlier quoted context omitted.

> Would a bit of Post-It Note (for minimal adhesion) damage the screen coating if left on most of the time? Possible, I have one IPS monitor with a spot on screen where the color is pale. I had a post-it note there and I guess something bad happened when I tore it off.

I used electrical pvc tape for many years on my macbooks, no damage but I got tired of them leaving glue residue. Switched to post-its about 10 years ago, works perfectly. I've never tried them on a matte or coated screen though.

I use painter’s tape for a similar effect.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#466

Earlier quoted context omitted.

or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!

You can buy/print and stick a physical «webcam cover»[1] manually on your notebook or phone. My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find. [1]: https://www.printables.com/model/2479-webcam-cover-slider

Just to note: Apple will refuse to cover any screen damage under warranty if one of these sorts of things was in use.

I would not be surprised if the same is true for some other manufacturers, too, but I can only speak definitely to Mac.

The issue is that lids close too closely + tightly now, and so anything more than a piece of tape winds up focusing all the pressure applied to the closed lid on that one spot in the glass, since the cover winds up holding the display slightly off the base of the laptop when in the closed position.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#467
post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Cameras are now always on, to reduce the latency to taking a picture or scrubbing video feed. You’d need to wire the led to something tied to the data lines, perhaps.

Any links you could share abouy someone confirming this?

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#468
post #357

Earlier quoted context omitted.

Am I the only one that is not worried at all about the camera and super concerned about microphones ? The camera may see me staring into the screen, woo hoo. The microphones will hear everything I discuss, incl. confidential information. There is no physical microphone cover there, is it ?

And the true or not Google or other apps listening then you see ads based on that conversation. I think it's true since far too many times obscure things I've spoken about appear in ads soon after the conversation. So yes I'd say a mic blocking feature you can confirm is working, blocking, is needed.

Recommendation engines work on vast amounts of data they have on you and whatever made you speak about thing X was likely preceded by your internet activity which is not very unique as a precursor to speaking about X. In other words, if other people do Y on the internet and then end up doing stuff related to X, the recommendation engine will show you X just because you also did Y.

The other explanation is one of your contacts who were part of the conversation did things that either directly related to thing X, which you spoke about, or something the algorithm see other people do that relates to X, and you got shown ads based on your affiliation to this person.

I've also worked at FAANG and never seen proof to such claims anywhere in the code, and with the amount of people working there who care about these issues deeply I'd expect this to leak by now, if this happens but is siloed...

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#469
post #457

Earlier quoted context omitted.

And the true or not Google or other apps listening then you see ads based on that conversation. I think it's true since far too many times obscure things I've spoken about appear in ads soon after the conversation. So yes I'd say a mic blocking feature you can confirm is working, blocking, is needed.

> I think it's true since far too many times obscure things I've spoken about appear in ads soon after the conversation People have been making claims like this since at least the early 90s, about TV then, and no one ever credibly claims to have worked on something like this. I've worked with purchased ad data and I've never seen this data or anything that implies that it exists. It seems far more likely that its a t…

I agree with this sentiment, people talk about x product then realise they are seeing ads for x product. Most likely the ads were there first and the people only start talking about it cause the ads have been working.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#470
post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Cameras are now always on, to reduce the latency to taking a picture or scrubbing video feed. You’d need to wire the led to something tied to the data lines, perhaps.

Source? This seems extremely unlikely to me, running a camera all the time consumes a fair bit of energy and they don't take long to turn on. Unless that's because they're always on?

Regardless, that's a pretty strong claim. I'd love to learn more if you have a link that can back you up!

Post reply on HN