Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

github.com

Post reply on HN
Print view View original

541–550 of 554 posts

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#541

Post by TheKarateKid »

izacus wrote: post #439
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

Yep, and Apple changed that after some schools were spying on their students through software that could enable cameras on MacBooks without the light: https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...

I've also read of exploits which found ways to burn out the Macbook LED light by somehow messing with the power being supplied to the webcam without damaging the camera. Thus afterward, the LED light no longer powers on when in use but the camera still works.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#542

Post by peishang »

eggy wrote: post #261

Turning off camera LEDs and recording video is an old hack and old news. This is for a specific firmware and computer model and attack surface via USB to update the webcam's firmware, so I am assuming that makes it news? EDIT: I keep a piece of black electric tape over any of my notebook's webcams.

Same - I use a folded playing card but since the machine's docked it works in the unlikely event that I need to use it.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#543

Post by salutis »

perching_aix wrote: post #361
salutis wrote: post #356

Earlier quoted context omitted.

Why do you think my stance is internally inconsistent? For example, I completely trust Emacs maintainers, as I have yet to see any malice or dark patterns coming from them. The same applies to other free and open source software I use on a daily basis. These projects respect my privacy, have nothing to hide, and I have no problem trusting them. On the other hand, I see more and more dark patterns coming from Apple, s…

Thinking about it, I might have misunderstood what you wrote a bit. What I read was that you trust people, but then you also don't. That's not really a fair reading of what you wrote. That being said, I have seen "patterns" with open source software as well, so I'm hesitant to agree on trusting it. But that's a different problem. I also know how little hardware, microcode and firmware can be trusted, so that doesn't…

Thank you for the clarification. I certainly could have worded my comment better. I agree with you on that we should never trust open-source software blindly. That said, we can at least audit it, along with every new patch, which is impossible with binary blobs. That is why, I personally think, open-source should be preferred, for free and non-free software alike.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#544

Post by Nifty3929 »

hackernewds wrote: post #496
Nifty3929 wrote: post #494

Can we not require physical, electromechanical switches (like an old-fashioned light switch) for each of the following: camera, mic, cell/LTE, gps, bluetooth, wifi? Each should have their own switch, otherwise they will group them all into one "privacy mode" switch that also includes something you basically can't live without. Like the keyboard doesn't work in privacy mode or something. Plus, I'd like to be able to l…

That would make too much sense and cost profits, sir. This is a capitalism.

I would pay a lot more for a phone with these switches. But you're probably right - there aren't enough of us to build a product around.

If there are any independent phone makers listening - I would switch from iPhone to Android if it had switches like these.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#545

Post by fragmede »

Nifty3929 wrote: post #544
hackernewds wrote: post #496

Earlier quoted context omitted.

That would make too much sense and cost profits, sir. This is a capitalism.

I would pay a lot more for a phone with these switches. But you're probably right - there aren't enough of us to build a product around. If there are any independent phone makers listening - I would switch from iPhone to Android if it had switches like these.

Pinephone has em.

https://pine64.org/documentation/PinePhone/Privacy_switches/

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#546

Post by saagarjha »

ComputerGuru wrote: post #463
nine_k wrote: post #305

Earlier quoted context omitted.

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would…

Cameras are now always on, to reduce the latency to taking a picture or scrubbing video feed. You’d need to wire the led to something tied to the data lines, perhaps.

That's generally not the case. Keeping the camera on requires power and processing its video stream is resource-intensive.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#547

Post by saagarjha »

izacus wrote: post #439
542458 wrote: post #51

Earlier quoted context omitted.

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there ar…

Yep, and Apple changed that after some schools were spying on their students through software that could enable cameras on MacBooks without the light: https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...

Your Wikipedia article disagrees with the claim that it could disable the light.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#548

Post by saagarjha »

microtonal wrote: post #328
makeitdouble wrote: post #290

Earlier quoted context omitted.

While Apple made a laudable effort in this design, sadly it requires thoughtful care and design at every iteration. Typically the iPhone team couldn't pull it off and the only official claim is for macbooks. I think it's simpler to assume that most devices can be hacked and the LED indicator isn't infailable than to always keep in mind which device lines are supposed to be safe and which ones aren't.

Apparently it was purely in software on iPhone/iPad. However, starting with the iPhone 16 and M4 iPad Pro, the LED indicator is rendered by a separate secure exclave: https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip... https://mastodon.social/@_inside/112552696723119626

That is purely in software.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#549

Post by Nifty3929 »

fragmede wrote: post #545
Nifty3929 wrote: post #544

Earlier quoted context omitted.

I would pay a lot more for a phone with these switches. But you're probably right - there aren't enough of us to build a product around. If there are any independent phone makers listening - I would switch from iPhone to Android if it had switches like these.

Pinephone has em. https://pine64.org/documentation/PinePhone/Privacy_switches/

Wow, that's really awesome! I might buy one just to fool around with it.

I looked at pictures of the phone in their store, and cannot see the same switches as are shown on the page you linked to. I'll assume they're under the back cover or something. I hope at some point they'll move these to a quickly-accessible location on the outside. I'll leave them some feedback to that effect as well.

Re: Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230

#550

Post by chipsrafferty »

xvector wrote: post #502
Qem wrote: post #492

Earlier quoted context omitted.

My grandma never owned a cellphone, only an old landline. And she buys dogfood in the neighborhood mom & pop store.

Well, we know for a fact it wasn't your mic being recorded. Maybe you walked by WiFi networks where people purchase dog food.

Or maybe the mic IS being recorded. We don't know it for a fact until all phone software is open sourced.
Post reply on HN