Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 48 down vote favorite
11

I want to know how secure I am.

I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.

Recording an end-user's microphone seems to be a stealth thing. But what about the webcam? In my tests, the indicator is turned on and I can't figure out a way to do this without turning on the light.

So far, I'm assuming that if someone broke into my computer and turned on the webcam, I'll know that.

But, if it's possible to do such thing, which technique should I use to detect that the webcam is in use?

EDITED

It is probably hardware specific, as mentioned by @Steve-Dispensa. Maybe the question now is, which of the available hardware on the market is vulnerable to that kind of attack?

And the second question is: How do I know my webcam hardware specifications? Especially the built-in webcams for laptops.

share|improve this question
14  
Don't forget to have someone else test your security. It is very easy for me to design a box that I cannot break into, it is much harder to design a box that someone else cannot break into. – Freiheit Sep 1 '11 at 20:50
1  
@Freiheit I have to find someone qualified to do that ($$ or a security friend which is hard, in my case). But good idea. – KeyneON Sep 1 '11 at 23:23
Some normal users at least are getting the message that the light being on means it's recording. So turning off the light seems like it will become a common issue. See arstechnica.com/tech-policy/news/2011/09/… – AngerClown Sep 13 '11 at 13:21
1  
Apparently yes on Macks , do you remember this story? thisguyhasmymacbook.tumblr.com Or can the Hidden app do something that no virus or hacker could ever do? – daniel.sedlacek Sep 27 '12 at 16:28
A solution to the webcam light problem is to just take pictures. You can probably get a decent enough fps using this method. – WalterJ89 Sep 29 '12 at 19:12

7 Answers

up vote 33 down vote accepted

Most definitely, but in order to do this you would probably have to patch the camera's firmware and then flash it. Similar attacks have been used to disable the "shutter sound" on cameras.

share|improve this answer
3  
Thank you! If you have any resources about I would appreciate. – KeyneON Sep 1 '11 at 18:40
Does drivers have something related? – KeyneON Sep 2 '11 at 15:11
2  
@Keyne doubtful, its probably firmware. in that the device has a set reactions to an incoming command like "start recording". – Rook Sep 2 '11 at 16:33
Thanks for your time. Checked your answer as the right one, since you pointed out the direction (firmware). – KeyneON Sep 4 '11 at 2:12
11  
The answer is absolutely wrong! You're forgetting about the fact that it doesn't take firmware, but only a simple change in system configuration (as malware would be able to change). Check forums.logitech.com/t5/Webcams/Can-I-turn-off-red-LED/m-p/… for one of the many examples. LOGITECH WEBCAMS as an example DO NOT need firmware changes to have their light disabled! And note that I'm not yet talking about former Adobe Flash security issues that enabled camera use without indicating activation (read: while leaving the activity-indicating light off). Firmware only? You wish! – user6373 Jan 3 '12 at 16:03
up vote 18 down vote

Im not sure about built-in webcams, but I think it is most likely possible.

I've found info on Logitech Webcams, where you can turn off the LED in the registry keys..

For QuickCam versions 11.5.0.1169 thru 11.9.0.1263, LVUVC_LEDControl is located in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000\Settings

Note - If more than one camera is installed, you will have a "folder" for each device (i.e., 0000, 0001, 0002, etc...).

It has a default Data Value of REG_DWORD = 0x00000005 (5).

Based on your comments, I will assume that the following information is true:

0x00000000 (0) = LED Off 0x00000008 (8) = LED On

Please note that only certain cameras support this feature, so the mere addition of this key will not cause the LED Control buttons to appear in the QuickCam® Advanced Settings.

It is taken from: http://forums.logitech.com/t5/Webcams/Can-I-turn-off-red-LED/m-p/277305#M52816

Hence, I do not see why it shouldnt be possible for built-in webcams, since they also require drivers (mine is for example up side down after a fresh install)

share|improve this answer
Thanks for the information. – KeyneON Sep 5 '11 at 19:43
@Keyne Computerworld just brought an article about a flaw in flash that could allow webcam spying. computerworld.com/s/article/9221052/… – psalomonsen Oct 24 '11 at 10:57
Thanks for the info. – KeyneON Oct 24 '11 at 20:06
up vote 15 down vote

I don't know, but I'd guess it's hardware-specific.

Several friends have put tape over the cams in their laptops. At least one guy I know started doing this around 2002. :-)

share|improve this answer
5  
Put a small sticker... a heart, a smiley face, a teddy bear... normal people might think you're weird, but not paranoid. – gowenfawr Sep 1 '11 at 17:25
3  
I just get a laptop that doesn't have a camera to begin with. If I want to video conference or whatever, I plug one in via USB. – Iszi Sep 1 '11 at 19:42
9  
To solve the built-in laptop webcam problem, apply pointy end of screwdriver to webcam, apply force to handle, repeat until webcam fails to produce an image. – this.josh Sep 2 '11 at 8:38
1  
@this.josh It will hurt me do that. =) Imagine, having a $4k notebook and simply destroy the cam. Try to know what's happening seems the best option. – KeyneON Sep 2 '11 at 15:06
4  
@this.josh I'm glad you pointed out which direction to apply the pointy end to! ;) +1'ed – SteveS Sep 2 '11 at 16:35
show 5 more comments
up vote 11 down vote

Yes it can be done. Many web-camera control programs give you the ability to turn off the light. So it's definitely possible.

So as to know if the camera is active at a given time, I guess the best thing you have to do to ensure it stay disable, is to turn it off in the device manager. Off-course, you have to trust the Operating System to obey your commands. But that is a different question.

share|improve this answer
up vote 11 down vote

It seems as if the design of my ASUS notebook is good in this respect.

It uses a hardware video shutter, that cannot be turned on electronically.

That is a great solution to the privacy issue (excepting sound recording as you said).

share|improve this answer
2  
This is what I have on all my web cams - it is a prereq in my buying decision:-) – Rory Alsop♦ Sep 2 '11 at 9:26
Good to know... – KeyneON Sep 2 '11 at 14:49
up vote 9 down vote

It really depends on the type of camera, and how it is built. On Apple MacBook Pros (at least recent ones), the camera light is directly connected via the power supply to the camera module, so the light can't be circumvented even via a firmware hack. Older (really old) Logitech cameras had a similar design.

But just to be safe, I'm one of those guys with a dark tape over the camera.

share|improve this answer
up vote 8 down vote

One other thing that I haven't seen mentioned was popularized during the Lower Merion District School spying scandal last year is that the software that was used (LANRev TheftTrack) got around the Apple Macbook's camera light protections (camera light is hardwired to camera power) by simply turning it on briefly for a snapshot. Thus the camera isn't on all the time, but only at random intervals for a split-second.

share|improve this answer
1  
This is a common feature on metasploit framework and it's used to take pictures. – KeyneON Sep 13 '11 at 16:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.