15 ms·
I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power
by sbarre 2y ago
I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what.
Having the LED control exposed through the firmware completely defeats this.
- pesus 2y agoI might be out of the loop, but I thought that was only for some machines - I remember the LED being wired that way being a selling point for MacBooks at some point, as a privacy feature. It definitely should be the standard, though!
- wodenokoto 2y ago[flagged]
- pesus 2y agoThey removed the LED? My 2023 model pro still has it. Google is failing me trying to find information about it, though.
- subjectsigma 2y agoCan you point me to a link? This is very disturbing to me as I thought they were wired together. I can’t find any source confirming or denying newer than like 2022…
- naming_the_user 2y agoAt least half of your comment is wrong as the latest model MBP has an ambient light sensor, a camera, and an LED, I'm looking at them. Maybe the Air?
- bilbo0s 2y agoDoesn’t matter if it’s true. It only matters that they spell your name right. Threads filled with inaccurate posts like that are a large part of the reason that educating the general populace on security issues is so difficult.
- cruffle_duffle 2y agoAnd it all goes right into your friendly LLM training data and then spewed right back out again!
- deleted 2y ago[deleted]
- bayindirh 2y agoI don't know whether 2024 models has the LED or not, but there's an unmaskable/global overlay warning for Webcam / Microphone / Location services, and I think they are controlled at Kernel level. You can't bypass these indicators when any software accesses these devices. These warnings have hysteresis and logging. They don't disappear the moment you close the device, and you can see which app is using which device. ...and no, ambient light sensor handles the true tone and brightness. It's not the camera.
- itslennysfault 2y agoYeah, my understanding is that is how the light on MacBooks works, but I'm not sure about any other makes/models. Obviously, if this is possible that Thinkpad model doesn't do that.
- ortusdux 2y agoI'd like a law to this effect.
- pooper 2y agoWe have to be realistic though. We can't even get a law requiring right to replace a battery on our own iPhones...
- CharlesW 2y agoGo to https://www.ifixit.com/Device/iPhone https://www.ifixit.com/Device/iPhone, then search for your iPhone's battery replacement guide.
- Aaargh20318 2y agoWe can’t? Then what is this? : https://environment.ec.europa.eu/news/new-law-more-sustainable-circular-and-safe-batteries-enters-force-2023-08-17_en https://environment.ec.europa.eu/news/new-law-more-sustainab... ?
- bluGill 2y agoWe may already have this law. If the manufactures makes claims about this LED, then that this attack is possible mean a lawyer can force them to recall and fix everything.
- jiggawatts 2y ago"Add an LED next to the camera, our customers demand it!" "Job done boss!" That's it. That's what happens. Nobody ever reviews anything in the general industry. It's extremely rare for anyone to raise a stink internally about anything like this, and if they do, they get shouted down as "That's more expensive" even if it is in every way cheaper, or "We'll have to repeat this work! Are you saying Bob's work was a waste of time and money!?" [1] [1] Verbatim, shouted responses I've received for making similar comments about fundamentally Wrong things being done with a capital W.
- bluGill 2y agoLawyers after the fact review this. I expect one to start a class action - they will make millions, and everyone else who has this laptop will get $1. The real point is the millions means every other company is on notice that these mistakes hurt the bottom line and so the industry starts to review these things. So long as it doesn't hurt they won't review. I feel really dirty calling lawyers the good guy here, but ...
- daedrdev 2y agoWhat law as been broken by not implementing this feature?
- bluGill 2y agoIf they promise a feature they don't have that is falwe advertising.
- jiggawatts 2y agoThe feature is an LED light next to the camera. They delivered it.
- bluGill 2y agoThe exact words matter. If they call it a led they are maybe fine. If they call it a camera on led they are sunk. Even if they just call it a led, the implication that it is about camera on is an arguement the courts will not toss out - though how they rule is not as clear
- agumonkey 2y agosame... i'm also surprised that having a software controlled led would be cheaper ..
- lxgr 2y agoIt could be something very simple, such as requiring less USB hub complexity for a camera that can be woken up via a command on the USB bus instead of needing to connect/disconnect the USB power rails (wired in parallel with the LED) to it. Somebody here has also mentioned Apple using the camera for brightness and maybe color temperature measurement, for which they wouldn't want to enable the LED (or it would effectively always be on). That doesn't automatically make that a good tradeoff, of course; I'd appreciate such a construction.
- kergonath 2y ago> Somebody here has also mentioned Apple using the camera for brightness and maybe color temperature measurement, for which they wouldn't want to enable the LED (or it would effectively always be on). That is not true. MacBooks have separate light sensors. And the camera physically cannot activate without the LED lighting up and a notification from the OS. People say a lot of stupid things in the comments…
- TheRealPomax 2y agoIt wasn't. Only responsible manufacturers wired them up that way.
- geor9e 2y agoSure, for a brand headquartered in Cupertino they might design it that way. But this one is a Beijing brand.
- perching_aix 2y agoFor what it's worth, you could just power on the camera, take a pic, then turn it back off instead. Provided you can do this fast enough, an indicator LED is rendered worthless. So you'd need to make the indicator LED staggered, to stay lit for a minimum amount of time. There's also the scenario where the LED or the connections to it simply fail. If the circuit doesn't account for that, then boom, now your camera can function without the light being on. Can't think of any other pitfalls, but I'm sure they exist. Personally, I'll just continue using the privacy shutter, as annoying as that is. Too bad it doesn't do anything about the mic input.
- TZubiri 2y agoA minimum light duration seems pretty trivial to physically engineer. For one the energy to take a picture is probably enough to power a light for a noticeable amount of time. And if it isn't, a capacitor that absorbs energy and only allows energy through once it's full would allow the light to remain on for a couple of seconds after power subsides.
- perching_aix 2y agoWasn't arguing that it's difficult, just that it's needed (and that I'm not expecting it to be done in practice. Because the indicator LED on my laptop doesn't do it either, despite being enterprise grade).
- homebrewer 2y agoJIRA is "enterprise grade", I wouldn't place too much faith into that term.
- perching_aix 2y agoTrust me, I was using it semi-sarcastically too. This thing is slower than my old Pentium 4 would be, yet has a fast enough 30% to 3% battery discharge rate that it would make the speed of light itself blush.
- TZubiri 2y agoThe idea has been around for quite some time. But it is always dropped. My guess is that, assuming the most basic and absolute physicial design, the light would flash for silly things like booting, upgrading firmware, checking health or stuff like that.
- greenthrow 2y agoFlashing is easily fixed with a capacitor and also not a bad thing if it turns off when it loses power immediately. The only explanation that makes sense to me is it being separately controlled is a feature not a bug.
- TZubiri 2y agoI agree on the capacitor fix for flashing, I pointed it out in another post. In this case I was referring to false positives to the user. This would mean we can't update the firmware without causing the user some paranoia. Also. Would an app requesting permission to use camera itself send some power to the camera to verify it is available? In a similar vein, what about checking if the camera is available before even showing the user the button to use the camera? Maybe there's solutions to this, I'm just pointing out some reasons they may have gone the software route instead of the hardware route.
- criddell 2y agoI can't find it now, but recently I read how one company's design team added this feature to their laptops. A subsequent review by the team responsible for manufacturing found that they could change the circuit to cut down on the part count to save money. The light was still there, but it was no longer hardwired. The company continued to advertise the camera light as being hardwired even though it wasn't.
- adolph 2y agoIt isn't clear to me that webcam firmware ever powers down a typical camera module. See below for data about how the Sony IMX708 sensor is an I2C device with start and stop streaming commands. https://github.com/Hermann-SW/imx708_regs_annotated?tab=readme-ov-file https://github.com/Hermann-SW/imx708_regs_annotated?tab=read...
- 542458 2y agoThey are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. […] > So, no, I don’t believe that malware could be installed to enable the camera without lighting the LED. My concern would be a situation where a frame is captured so the LED is lit only for a very brief period of time. https://daringfireball.net/2019/02/on_covering_webcams https://daringfireball.net/2019/02/on_covering_webcams
- aftbit 2y ago>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.
- varenc 2y agoI believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures one quick frame.
- MaxikCZ 2y agoA capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed
- connicpu 2y agoAn indicator light hardwired is nice but I apparently can't trust hardware manufacturers to design it properly. My work laptop (HP Dragonfly) has a physical blocker that closes over the camera when I haven't explicitly pressed the button that enables the camera. The blocker is black and white stripes so it's very obvious when it's covering the sensor. This should absolutely be the security standard we all strive for with camera privacy.
- kiwijamo 2y agoInteresting, my work HP Probook does not have that functionality. I wonder why HP chooses to do this only for some laptop lines.
- MaxikCZ 2y agoMoney.
- zeroping 2y agoSupporting that theory: my HP EliteBook does have a slide-over cover. (It could also be contention between thickness of the display vs enterprise customer sensitivity to cameras)
- throwaway984393 2y ago[dead]
- nox101 2y agoI suspect most people don't want it. I can imagine lots of people calling customer service "Q: why doesn't my camera work?", "A: Did you open the cover?" There's just a valid an argument to do the same for phones. How many phones ship with camera covers and how many users want them? You can get a stick on camera cover for $5 or less if you want one. I have them on my laptops but not on my phone. They came in packs of 6 so I have several left. https://www.google.com/search?q=camera+cover+laptop https://www.google.com/search?q=camera+cover+laptop
- ajsnigrutin 2y agoMost business class thinkpads have a physical cover in the screen that covers the camera with a piece of plastic. Led, no led, who cares, plastic is blocking the lens. Move the cover away, say hi on zoom, wave, turn the camera back off, cover on, and stay with audio only, as with most meetings :)
- orbital-decay 2y agoIt's probably done to keep it in a low powered state and reduce the initialization delay. Maybe also to prevent the Windows USB plugging sound from playing upon turning the camera on, as it would seem weird to the user ("I don't have any USB devices plugged in...") Likely UX over security and privacy.
- moritzwarhier 2y agoSince some sort of firmware is required, this seems like a "turing tarpit" security exploit from my laymans perspective. There's no standard that I know, that, like "Secure EFI / Boot" (or whatever exact name it is), locks the API of periphery firmware and that would be able to statically verify that said API doesn't allow for unintended exploits. That being said: imagination vs reality: the Turing tarpit has to be higher in the chain than the webcam firmware when flashing new firmware via internal USB was the exploit method.
- axoltl 2y agoNo firmware is required. Macbooks manufactured since 2014 turn on the LED whenever any power is supplied to the camera sensor, and force the LED to remain on for at least 3 seconds. (Source: I architected the feature)
- moritzwarhier 2y agoThanks for your reply — yourself as the Source can only make me feel flattered then for you responding to me. > Macbooks manufactured since 2014 turn on the LED whenever any power is supplied to the camera sensor, and force the LED to remain on for at least 3 seconds. That convinced me originally I think, good old days! I'd almost forgotten about it. The way you phrased it, it sounded like 50% OS concern to me. But if cam & LED rly share a power supply, and the LED is always on without any external switch, Good then!
- axoltl 2y agoI was not very popular with the camera firmware folks for a while. They had to re-architect a bunch of things as they used to occasionally power on the camera logic without powering the sensor array to get information out of the built-in OTP. Because the LED now came on whenever the camera was powered they had to defer all that logic.
- ProfessorLayton 2y ago
- Shekelphile 2y agoOnly apple does this properly.
- wutwutwat 2y agoIn the past I've used microsnitch on macos which tells you when the mic or camera are activated, but macos seems to have support for this baked into the os now. In zoom calls the menu bar shows what is active. If this can be sidestepped and avoided in software, and the camera can be activated without any indicator, I do not know. If direct access can be done, and you don't need to go through some apple api to hit the camera, maybe. edit: looks easily bypassed https://github.com/cormiertyshawn895/RecordingIndicatorUtility https://github.com/cormiertyshawn895/RecordingIndicatorUtili...
- 0xDEAFBEAD 2y agoDid it ever snitch on anything interesting?
- wutwutwat 2y agoidk, but maybe you know! it was probably easily bypassed anyway. hardware disconnects are the only thing that can ever be trusted imo
- endigma 2y agoUsing this tool requires disabling SIP, so not "easily bypassed" at least from a malware perspective.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- TacticalCoder 2y ago> I thought the whole point of these camera LEDs was to have them wired to/through the power to the camera, so they are always on when the camera is getting power, no matter what. This definitely happened too on Mac in the past, then they went in damage control mode. Not only had Apple access to turn off the LED while the camera was filming, but there was also a "tiny" company no-one had ever heard off that happened to have the keys allowing to trigger the LED off too. Well "tiny company" / NSA cough cough maybe. After that they started saying, as someone commented, that it requires a firmware update to turn the LED off. My laptop has a sticker on its camera since forever and if I'm not mistaken there's a famous picture of the Zuck where he does the same. I've got bridges to sell to those who believe that the LED has to be on for the camera to be recording.
- samatman 2y agoI believe every paragraph of this besides the personal anecdote is completely made up. Care to change my mind?
- m463 2y agoThere was a school district that took pictures of the kids at home. They briefly saw the LED flash. But it was not on for any length of time and you could miss it. This stuff should be completely in hardware, and sensible - stay on for a minimum time, and have a hardware cutoff switch.
- WiSaGaN 2y agoThat's why many ThinkPads have physical covers over their cameras. You don't even need to worry about whether the LEDs are hardwired - relying on any electronic indicator is already a half-baked security measure. If you want real security, just go with a physical solution.
- DaiPlusPlus 2y ago…until it isn’t: my ThinkPad P1 Gen 6 has the camera cover, yes - but it doesn’t have a cover for the depth-sensing camera, only the RGB cam, even though userland applications can get imaging data from that camera just as easily - which is potentially a bigger security issue: I imagine you could reconstruct my facial shape from the data and build a dummy head to get into my iPhone/iPad via FaceID. (No, I’m not actually worried about this, I’m far too unimportant for anyone to make a targeted attack against)
- bigbacaloa 2y ago[dead]
- esprehn 2y agoYeah, on Chromebooks and MacBooks the LED is hardwired to ensure it's always on when the camera is enabled.
- qingcharles 2y agoI stumbled on a forum once where it was just filled with people trying to modify the software for various laptops to disable the "tally lamp" (as it is called). There were people selling the mods and one guy claiming he was selling his cracks to three-letter agencies. The people on there seemed to be using this to extort people (mostly women) by being able to record videos without the owner knowing. Some really dark shit.
- Nursie 2y agoYeah the first day I read about RATers... jesus. The camera LED seemed to be a major thing for them, because if they could bypass it then the chance their RAT would be discovered was much lower. Really nasty world they've made for themselves, blackmailing, extorting and generally controlling other people (mostly women and girls, but some men too) with threats of releasing compromising material.
- Anna3321AQ 2y ago[dead]
- red-iron-pine 2y agoEnterprise organizations want to be able to watch their employees without them knowing. Other organizations like law enforcement, are also ambivalent about this. The easy solution, of course, is a folded business card or piece of tape. But tbh I'm not surprised they didn't implement that approach, and likely deliberately.
- riedel 2y agoActually astound about the same thing with the microphone mute LED and the speaker mute LED. Even without any attack they are sometimes malfunctioning. None of those seem remotely hardwired on my ThinkPad Z13.