5 ms·
If you're so concerned about having your webcam subverted, it seems like the first step would be to insist on a hardware LED that can't be subverted in firmware
by ipsin 10y ago
If you're so concerned about having your webcam subverted, it seems like the first step would be to insist on a hardware LED that can't be subverted in firmware. If nothing else, it would serve as a canary, indicating that your machine has been thoroughly compromised.
- gkoberger 10y agoAnd who do we trust to do that? More importantly, is it even possible?
- krastanov 10y agoIn terms of electronics it is fairly trivial and it can be inspected by eye (or microscope) if the manufacturer decides to not encapsulate everything on a chip (which presumably would be the point of such a feature). Just have the only positive voltage rail going to the camera be the same one that is directly powering the LED. The firmware will be turning this rail on and off, hence turning the camera and the LED on and off simultaneously.
- 1_2__3 10y agoIdle though on possible attack vectors: Convince the firmware to use a lower voltage, one that doesn't hit the breakover voltage on the LED but still powers the camera. Strobe the line, get snapshots without the LED doing more than very faintly glowing.
- krastanov 10y agoI have a very hard time believing that the camera itself will not brownout in such a case.
- umanwizard 10y agoLED activation voltage is less than what cameras typically require.
- deleted 10y ago[deleted]
- 3chelon 10y agoNeat ideas. It never even occurred to me that the power rail would be voltage-programmable, but of course it probably would. Your second idea is even more scary and realistic.
- boxkite 10y agoEven if it was, most of the time when people are taking surveillance webcam photos (a hacker or a person trying to recover their stolen laptop) you can take the picture so quickly that they probably won't see the light.
- throwanem 10y agoHave you a source for that? My experience of laptop webcams is that they need at least a second or two after power on to initialize the camera. That'd be pretty noticeable if you're using the machine, at least.
- boxkite 10y agoI do! DEF CON 23 - Ken Westin - Confessions of a Professional Cyber Stalker https://www.youtube.com/watch?v=Tyel1gfSjl4 https://www.youtube.com/watch?v=Tyel1gfSjl4 Specifically around the 18:00 mark. Also he does provide source examples that you can ruin your computer with if you want. He gets into a lot of it, but shows quite a few examples including what I'm talking about. The people that he catches aren't necessarily savvy, but he does talk about taking pictures fast enough for the light not to be visible.
- throwanem 10y agoThanks!
- anexprogrammer 10y agoIf it was on my radar I would much rather have an LED for microphone active (laptop and phone) than webcam - precisely because I can put a sticker on webcam. Better still a hardware switch.
- sporkologist 10y agoMaybe a toggle for enabling/disabling device driver for mic?
- 3eto 10y agoThe Librem 13 comes with two hardware kill switches, microphone/camera and wireless/bluetooth. They raised $450k for their $1,400 laptop. https://puri.sm/librem-13 https://puri.sm/librem-13
- greglindahl 10y agoHow can you tell if it can be subverted? Here's a paper about subverting the Apple Mac camera led indicator from userland: https://jscholarship.library.jhu.edu/bitstream/handle/1774.2/36569/camera.pdf https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...
- williamscales 10y agoIf the LED were simply wired in series somehow with the mic power supply I imagine it would be easier to tell. The problem with the Mac LED indicator was that it was controlled by a microcontroller that was ultimately accessible via user land. It's harder to surreptitiously bypass a simple electrical circuit.
- greglindahl 10y agoSorry, but how do you tell the difference? I agree that the Mac LED indicator was poorly designed, but...
- deleted 10y ago[deleted]
- StavrosK 10y agoAs a user, you can't. The hardware manufacturer has to tell you.