Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
Malware can turn off webcam LED and record video, demonstrated on ThinkPad X230
Tools for controlling webcam LED on ThinkPad X230. Contribute to xairy/lights-out development by creating an account on GitHub.
cross-posted from: https://lemmy.bestiver.se/post/121053
The problem here is that the led was software controlled which always struck me as more of a bandaid then a solution.
A proper hardware switch solution would mean the led and webcam are wired so if the webcam receives any power the led jumps on. The computer shouldn't even know that led exists. Not sure how many devices actually do this though.
The tape on cam solution works on video but might still record sound which is in many cases more dangerous for sensitive information.
Of course one also has to wonder how much it matters having typed this on a phone with cam and microphone uncovered and no indicators.
Yeah, this is exactly the problem. Never should have been software controlled.
And yes, it's getting harder and harder to control for these privacy issues with the number of devices we routinely carry with microphones and cameras.
I believe Framework has their webcam LED setup like this. At a minimum the physical switch cuts power to the whole webcam assembly.
And the Framework Laptop also has a switch for the mic. So even the mic can be completely turned of on the hardware level.
That is exactly how the webcam light is setup in a Framework. The light is wired up to the camera sensors power, so whenever the camera has power, so does the light. The switch also fully disconnects it from the computer itself. At least in Linux, you can verify it using
lsusb. You can see the camera indicated asRealtek Semiconductor Corp. Laptop Camera. Whenever the switch is flipped though, it disappears all together from the list.
I believe apple has the led hardwire in MacBooks webcams.
Used to, but not anymore. I recall a similar exploit for MacBooks a few years back.
The problem with that is a USB device is powered even if it's not being used. You can't communicate with it to identify it as a webcam without powering it. So the light will be on any time it's plugged in.
a USB device is powered even if it's not being used.
That's the USB-controller, not the actual cam. It's certainly possible to couple a LED with the power state of the camera chip and it was already done before.
Both android and crapple phones have mic & cam indicators nowadays, tho, and if a piece of software has a level of access high enough to bypass those, you kinda have bigger issues... Also, the webcam receives power by default currently; as the repo mentions, it's just another USB device (well, it's 3v3, and not 5v, but it doesn't really matter here)
Most laptops have a physical slider that can mask the camera. But I don't know of any tablets or phones that offer this feature.
there used to be phones with pop-up cameras for a year or two.
The Librem 5 offers hardware killswitches on the side of the phone, and the Pinephone offers hardware killswitches in the rear of the device after removing the backplate.
It can't turn off electrical tape.
Anyone else ever join large conference calls from the shower?
Shower? No.
Naked? More times than clothed.
This is why so many laptops, including Lenovo laptops, have webcam covers. You could always put a piece of tape over it lol
Most Thinkpad's have a slidy cover not sure about the mics though