3 ms·

I just bought my wife a new (well, refurbished) ThinkPad. I went through its BIOS menus to... well, just in case there's anything weird. Also, you know, to di

I just bought my wife a new (well, refurbished) ThinkPad. I went through its BIOS menus to... well, just in case there's anything weird. Also, you know, to disable "secure" boot. And, dear lord... there's so much Intel <three-letter-acronym> stuff that simply shouldn't be there, and some of it is even impossible to disable :( All sorts of non-consensual tracking marketed as "anti-theft" or "IT remote service support". And that's on a ThinkPad, which, at least in my memory, used to be the friendliest brand for Linux among laptops... Anyways, back to Android. Well, last thing I want it to be is a Web cam. There's even an idiom in English "butt-dialing" that stands for accidentally calling someone w/o the caller being aware of them calling them. But, with a Web cam, and the glorious Web security, and proprietary drivers... now you'll have a chance to... broadcast butt-dial? That doesn't sound as snappy though. Let's wait for the first victim, I guess, and see how they call it.

SamuelAdams 3y ago
If your threat model includes Intel IME, why did you buy an Intel laptop? There are plenty of AMD laptops available today, some are even available as a Thinkpad.
- crabbone 3y ago
  I didn't know. Didn't do enough research. Guess, next time I'll try AMD.
- iamtedd 3y ago
  What, and be subject to the AMD PSP?
NavinF 3y ago
How exactly are you gonna butt-dial with a USB webcam? Article says this feature requires a USB cable and has nothing to do with "glorious Web security". BTW I highly doubt that toggling settings in your BIOS is going to stop this supposed non-consensual tracking. But hey, if the placebo helps you feel better
- crabbone 3y ago
  There were probably hundreds of security breaches related to Web cams. These are the devices with very shady reputation. This is why you'll see laptop users taping over them. Now every time you plug your phone into a PC you have to start worrying about your phone being used to spy on you? > BTW I highly doubt that toggling settings in your BIOS is going to stop this supposed non-consensual tracking. Some are known to be impossible to stop. Some can be stopped. There are, unfortunately many of those. "Anti-theft" thing can be completely disabled for example. The "IT remote support" thing cannot, but can be configured to be less malicious (somewhat, not really, but still). It's not magic what they do. It's just (intentionally) poorly documented (and poorly implemented) stuff. But there are some enthusiastic people who try to discover what this stuff is actually doing. So, it's a fight that never ends. Eventually, enthusiasts will discover more of this stuff, take Intel to court and make them undo / allow to disable this. And then Intel will produce chips with more malicious stuff but rebranded and so on. I happen to work for another big h/w manufacturer, so... it's business as usual.
rjmunro 3y ago
It doesn't mean a Webcam in the sense of a camera that broadcasts to the internet, it means a USB camera you can plug into your PC (or any other device that supports standard USB cameras (UVC protocol). It will probably even work with something like this UVC->HDMI converter: https://www.amazon.co.uk/OBSBOT-UVC-HDMI-Adapter-Webcams/dp/B0C7433DSK/ https://www.amazon.co.uk/OBSBOT-UVC-HDMI-Adapter-Webcams/dp/... so you can go straight into a video switching device.
- crabbone 3y ago
  Yes. I understand what it means. Do you never plug your phone into a PC for a reason other than wanting to use it as a Web cam? Laptop users literally tape over the Web cam to prevent accidental / malicious uses of that device. Now they'd have to tape over the phone camera every time it's connected to a PC? Seriously?
  - rjmunro 3y ago
    If you are worried enough to cover your PC camera all the time, why aren't you worried enough to cover your phone camera all the time anyway? And are you OK to connect your phone to your potentially compromised PC with a USB cable in non-camera mode? That seems just as bad or worse. I expect that on most phones you will have to select USB camera mode for it to work (and you'll have to tell it if you want the front or back camera), and it will probably tell you that it's working on the screen.
gsich 3y ago
>And, dear lord... there's so much Intel <three-letter-acronym> stuff that simply shouldn't be there, and some of it is even impossible to disable :( All sorts of non-consensual tracking marketed as "anti-theft" or "IT remote service support". And that's on a ThinkPad, which, at least in my memory, used to be the friendliest brand for Linux among laptops... Was it activated or you just here to vent?
- crabbone 3y ago
  You literally quoted the answer to your question. Do you think if I repeat it you will pay more attention reading it next time?
  - gsich 3y ago
    I know I quoted it. I also know it's false because the Anti-theft stuff can in fact be deactivated. You didn't seem to check for that.

SamuelAdams 3y ago

If your threat model includes Intel IME, why did you buy an Intel laptop? There are plenty of AMD laptops available today, some are even available as a Thinkpad.

crabbone 3y ago
I didn't know. Didn't do enough research. Guess, next time I'll try AMD.
iamtedd 3y ago
What, and be subject to the AMD PSP?

NavinF 3y ago

How exactly are you gonna butt-dial with a USB webcam? Article says this feature requires a USB cable and has nothing to do with "glorious Web security". BTW I highly doubt that toggling settings in your BIOS is going to stop this supposed non-consensual tracking. But hey, if the placebo helps you feel better

crabbone 3y ago
There were probably hundreds of security breaches related to Web cams. These are the devices with very shady reputation. This is why you'll see laptop users taping over them. Now every time you plug your phone into a PC you have to start worrying about your phone being used to spy on you? > BTW I highly doubt that toggling settings in your BIOS is going to stop this supposed non-consensual tracking. Some are known to be impossible to stop. Some can be stopped. There are, unfortunately many of those. "Anti-theft" thing can be completely disabled for example. The "IT remote support" thing cannot, but can be configured to be less malicious (somewhat, not really, but still). It's not magic what they do. It's just (intentionally) poorly documented (and poorly implemented) stuff. But there are some enthusiastic people who try to discover what this stuff is actually doing. So, it's a fight that never ends. Eventually, enthusiasts will discover more of this stuff, take Intel to court and make them undo / allow to disable this. And then Intel will produce chips with more malicious stuff but rebranded and so on. I happen to work for another big h/w manufacturer, so... it's business as usual.

rjmunro 3y ago

It doesn't mean a Webcam in the sense of a camera that broadcasts to the internet, it means a USB camera you can plug into your PC (or any other device that supports standard USB cameras (UVC protocol). It will probably even work with something like this UVC->HDMI converter: https://www.amazon.co.uk/OBSBOT-UVC-HDMI-Adapter-Webcams/dp/B0C7433DSK/ https://www.amazon.co.uk/OBSBOT-UVC-HDMI-Adapter-Webcams/dp/... so you can go straight into a video switching device.

crabbone 3y ago
Yes. I understand what it means. Do you never plug your phone into a PC for a reason other than wanting to use it as a Web cam? Laptop users literally tape over the Web cam to prevent accidental / malicious uses of that device. Now they'd have to tape over the phone camera every time it's connected to a PC? Seriously?
- rjmunro 3y ago
  If you are worried enough to cover your PC camera all the time, why aren't you worried enough to cover your phone camera all the time anyway? And are you OK to connect your phone to your potentially compromised PC with a USB cable in non-camera mode? That seems just as bad or worse. I expect that on most phones you will have to select USB camera mode for it to work (and you'll have to tell it if you want the front or back camera), and it will probably tell you that it's working on the screen.

gsich 3y ago

>And, dear lord... there's so much Intel <three-letter-acronym> stuff that simply shouldn't be there, and some of it is even impossible to disable :( All sorts of non-consensual tracking marketed as "anti-theft" or "IT remote service support". And that's on a ThinkPad, which, at least in my memory, used to be the friendliest brand for Linux among laptops... Was it activated or you just here to vent?

crabbone 3y ago
You literally quoted the answer to your question. Do you think if I repeat it you will pay more attention reading it next time?
- gsich 3y ago
  I know I quoted it. I also know it's false because the Anti-theft stuff can in fact be deactivated. You didn't seem to check for that.