4 ms·

Frankly, by the time the indicator is noticed, it may be too late. Even with the LED wired in place and a 'feature' (capacitor or software?) forcing it to stay

Frankly, by the time the indicator is noticed, it may be too late. Even with the LED wired in place and a 'feature' (capacitor or software?) forcing it to stay lit for 3 seconds, the damage may be done. It does, at least, let you know an attack occurred. I really think an LED is barking up the wrong tree. A built-in hardware cover would have the same effect as the LED, and no one would have to trust it, since the camera would just be recording the back of the cover if it was hacked in stealth mode.

JadeNB 6y ago
How would you handle the microphone? I don't know any hardware way to make sure my microphone's not hearing me if I can't trust the software.
- CydeWeys 6y ago
  A physical electrical on/off switch for the microphone (that actually interrupts the wires going to the mic).
  - JadeNB 6y ago
    Doesn't that require the same kind of trust in the correctness of the wiring that is at issue in some other comments? I can see that a camera cover works, but I think I couldn't see that a physical switch was actually interrupting the wiring without doing a teardown.
    - retrac 6y ago
      > I can see that a camera cover works Well, I don't mean to fuel your paranoia, but there are materials opaque to the human eye but not necessarily fully opaque to a CMOS sensor, especially one without infrared/UV filters. It would be quite possible, trivial even, to design a web camera with a nice built-in black camera cover -- which is transparent to the camera.
    - solarkraft 6y ago
      You want your equipment to be verifiably secure? Boy, wait until you find about what's possible manipulating PCB or processor designs (the Bloomberg fiction piece "The big Hack" illustrates what would be possible with just PCB manipulation). Or firmware or anything else proprietary running with elevated rights (normal ones are already enough to cause a lot of damage on most systems). All you can do is reduce attack surface.
      - saagarjha 6y ago
        A fiction piece isn't a great demonstration of anything, really.
        waterhouse 6y ago
        Well, what got it declared fiction was "a broad search doesn't turn up good evidence that this has been done", rather than "experts agree this is obviously impossible". So the reaction to the piece did demonstrate something.
    - tuco86 6y ago
      It takes one external party checking the wiring to make sure and it can't be patched by an update.
    - neltnerb 6y ago
      If you don't assume the internal wiring is as described I do not think there is a way for you to guarantee the microphone is not recording. It's even less obvious than a camera lens being covered or not, and taping over the "microphone hole" won't actually block receiving sound at all. I do physically disconnect or cover cameras. My desktop computer has no microphone unless I plug one in. Laptop and phone though? I definitely remember in the aughts that the police could remotely turn your phone into a bug without any user indication at all. To the best of my knowledge the only way to actually be sure you aren't being recorded with your own equipment is to remove power... of course now the batteries are soldered on, totally a coincidence I'm sure.
- jsjohnst 6y ago
  Plug in a headphone cable that has the wire to the microphone cut. There’s also pre-made plugs on Amazon too (search “microphone blocker”).
  - JadeNB 6y ago
    Wikipedia says that doesn't work for smartphones: https://en.wikipedia.org/wiki/Microphone_blocker#Smartphone_incompatibility https://en.wikipedia.org/wiki/Microphone_blocker#Smartphone_... . If a smartphone can override it in software, then couldn't a computer also do so?
    - jsjohnst 6y ago
      Depends on the laptop hardware in question, just as it does on which smartphone you’re using, as your link indicates. If your laptop (or iPad, in the case of the latest gen) is an Apple T2 equipped device, this is somewhat relevant (“somewhat” as it’s not directly related to my original reply) https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1#spaceexplored https://support.apple.com/en-gb/guide/security/secbbd20b00b/...
  - solarkraft 6y ago
    That does nothing except switching the default audio source to the blocked channel. Any app that can access the default source can access the still working microphone just as well.
    - jsjohnst 6y ago
      There’s apps (it’s also pretty easy to write one yourself like I did) that monitor when the input source is changed and forces it back immediately. Yes, wish that feature was built into the OS, but I also don’t grant almost any app microphone access.
- cgriswald 6y ago
  If the microphone is built into the laptop it should have a hardware switch. That still has problems as you note, but it is far better than the current state of affairs for most devices. And it still requires trust in someone (or opening the device yourself). A better solution would be to have the microphone be physically removable, but even then it could have an internal power source and storage...
TedDoesntTalk 6y ago
Magnetic sliding cover: https://www.amazon.com/SpiShutter-Slim-RoseGold-Magnetic/dp/B06XFLLMNB https://www.amazon.com/SpiShutter-Slim-RoseGold-Magnetic/dp/...
- ryanianian 6y ago
  I used one of those (same asin) for a while. Cracked my screen just like TFA says. Thankfully Apple repaired it and looked the other way. I'm guessing they won't be so forgiving now with this article out there.
  - TedDoesntTalk 6y ago
    Ah... got it. Thank you for writing that.
sscarduzio 6y ago
Ironically for Americans' wariness China, the "pop-up webcam" in Huawei laptops completely resolves the security and trust issue, by providing a physical way to disable the camera. https://www.youtube.com/watch?v=IKY3hvYKPpA https://www.youtube.com/watch?v=IKY3hvYKPpA Too bad it mainly shows your nostrils :(
- PascLeRasc 6y ago
  The attack most people are worried about is your camera being activated while your laptop is open. Huawei's approach seems worse since you can't just apply a cover to it.
  - a_t48 6y ago
    What? It's a physical button, you have to press it to open. I don't think there's a software control for it, is there?
    - PascLeRasc 6y ago
      Oh I didn't know that, I thought it popped up when the camera was activated. My mistake.
- int_19h 6y ago
  There are plenty of laptops with a built-in hardware cover for the camera.
lukevp 6y ago
My x1 carbon has a built in webcam blocker slider built in, and it disables the hardware too when it’s slid closed.

JadeNB 6y ago

How would you handle the microphone? I don't know any hardware way to make sure my microphone's not hearing me if I can't trust the software.

CydeWeys 6y ago
A physical electrical on/off switch for the microphone (that actually interrupts the wires going to the mic).
- JadeNB 6y ago
  Doesn't that require the same kind of trust in the correctness of the wiring that is at issue in some other comments? I can see that a camera cover works, but I think I couldn't see that a physical switch was actually interrupting the wiring without doing a teardown.
  - retrac 6y ago
    > I can see that a camera cover works Well, I don't mean to fuel your paranoia, but there are materials opaque to the human eye but not necessarily fully opaque to a CMOS sensor, especially one without infrared/UV filters. It would be quite possible, trivial even, to design a web camera with a nice built-in black camera cover -- which is transparent to the camera.
  - solarkraft 6y ago
    You want your equipment to be verifiably secure? Boy, wait until you find about what's possible manipulating PCB or processor designs (the Bloomberg fiction piece "The big Hack" illustrates what would be possible with just PCB manipulation). Or firmware or anything else proprietary running with elevated rights (normal ones are already enough to cause a lot of damage on most systems). All you can do is reduce attack surface.
    - saagarjha 6y ago
      A fiction piece isn't a great demonstration of anything, really.
      - waterhouse 6y ago
        Well, what got it declared fiction was "a broad search doesn't turn up good evidence that this has been done", rather than "experts agree this is obviously impossible". So the reaction to the piece did demonstrate something.
  - tuco86 6y ago
    It takes one external party checking the wiring to make sure and it can't be patched by an update.
  - neltnerb 6y ago
    If you don't assume the internal wiring is as described I do not think there is a way for you to guarantee the microphone is not recording. It's even less obvious than a camera lens being covered or not, and taping over the "microphone hole" won't actually block receiving sound at all. I do physically disconnect or cover cameras. My desktop computer has no microphone unless I plug one in. Laptop and phone though? I definitely remember in the aughts that the police could remotely turn your phone into a bug without any user indication at all. To the best of my knowledge the only way to actually be sure you aren't being recorded with your own equipment is to remove power... of course now the batteries are soldered on, totally a coincidence I'm sure.
jsjohnst 6y ago
Plug in a headphone cable that has the wire to the microphone cut. There’s also pre-made plugs on Amazon too (search “microphone blocker”).
- JadeNB 6y ago
  Wikipedia says that doesn't work for smartphones: https://en.wikipedia.org/wiki/Microphone_blocker#Smartphone_incompatibility https://en.wikipedia.org/wiki/Microphone_blocker#Smartphone_... . If a smartphone can override it in software, then couldn't a computer also do so?
  - jsjohnst 6y ago
    Depends on the laptop hardware in question, just as it does on which smartphone you’re using, as your link indicates. If your laptop (or iPad, in the case of the latest gen) is an Apple T2 equipped device, this is somewhat relevant (“somewhat” as it’s not directly related to my original reply) https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1#spaceexplored https://support.apple.com/en-gb/guide/security/secbbd20b00b/...
- solarkraft 6y ago
  That does nothing except switching the default audio source to the blocked channel. Any app that can access the default source can access the still working microphone just as well.
  - jsjohnst 6y ago
    There’s apps (it’s also pretty easy to write one yourself like I did) that monitor when the input source is changed and forces it back immediately. Yes, wish that feature was built into the OS, but I also don’t grant almost any app microphone access.
cgriswald 6y ago
If the microphone is built into the laptop it should have a hardware switch. That still has problems as you note, but it is far better than the current state of affairs for most devices. And it still requires trust in someone (or opening the device yourself). A better solution would be to have the microphone be physically removable, but even then it could have an internal power source and storage...

TedDoesntTalk 6y ago

Magnetic sliding cover: https://www.amazon.com/SpiShutter-Slim-RoseGold-Magnetic/dp/B06XFLLMNB https://www.amazon.com/SpiShutter-Slim-RoseGold-Magnetic/dp/...

ryanianian 6y ago
I used one of those (same asin) for a while. Cracked my screen just like TFA says. Thankfully Apple repaired it and looked the other way. I'm guessing they won't be so forgiving now with this article out there.
- TedDoesntTalk 6y ago
  Ah... got it. Thank you for writing that.

sscarduzio 6y ago

Ironically for Americans' wariness China, the "pop-up webcam" in Huawei laptops completely resolves the security and trust issue, by providing a physical way to disable the camera. https://www.youtube.com/watch?v=IKY3hvYKPpA https://www.youtube.com/watch?v=IKY3hvYKPpA Too bad it mainly shows your nostrils :(

PascLeRasc 6y ago
The attack most people are worried about is your camera being activated while your laptop is open. Huawei's approach seems worse since you can't just apply a cover to it.
- a_t48 6y ago
  What? It's a physical button, you have to press it to open. I don't think there's a software control for it, is there?
  - PascLeRasc 6y ago
    Oh I didn't know that, I thought it popped up when the camera was activated. My mistake.
int_19h 6y ago
There are plenty of laptops with a built-in hardware cover for the camera.

lukevp 6y ago

My x1 carbon has a built in webcam blocker slider built in, and it disables the hardware too when it’s slid closed.