Last month I was browsing the internet, and clicked on a link on a website. If you click a link at this site ususally a pop up comes up. Therefore I knew a pop up was going to come up and I closed it as usual. But for that brief second my webcam turned on. Ingnoring it I continued working.

A few days back this happened again and I installed antivirus (which I didn't have before). Nothing came up, but now I'm very worried that a hacker has installed malware on my laptop and is secretly spying on me by disabling the led, and that the led turning on was just to take a pic.

But on the other hand, if someone goes through so much work (like installing malware without me installing anything, etc) he would have held ransom against me already, as my laptop is on all day in my room and I change in my room. But he didn't.

Is there any way to identify if something like this happened?

  • Why do you assume there would be a ransom? If what you're saying is accurate, the act of voyeurism itself is the end goal, not financial gain.
    – Ivan
    Dec 29, 2016 at 14:46
  • what do you mean
    – John Brown
    Dec 29, 2016 at 14:50
  • You don't know there is a financial motive involved. If someone is spying on you, it could just be for the sake of watching, not extortion. This happened to teenage girls with pirated Sims content some years ago.
    – Ivan
    Dec 29, 2016 at 14:59
  • why would someone do so much hardwork like first finding a zero day exploit as my software is always updated. and then writing a driver to disable my led
    – John Brown
    Dec 29, 2016 at 15:02
  • 1
    @Johnny I think we can separate the OP's concerns about his events from the core question: How to identify if the webcam is sending data without the user's consent; spying. The ransom part is just noise IMHO. Dec 29, 2016 at 15:03

3 Answers 3


It's extremely unlikely. For a start, many of the camera-enable LEDs are driven by a microcontroller on the webcam itself, switching on when the camera is in use, so the driver doesn't make a difference here. In fact, last I checked, most webcams use a generic driver (e.g. WIA) for image capture.

If you're really worried, install a privacy cover over the camera.

  • blog.erratasec.com/2013/12/… but what about this
    – John Brown
    Dec 29, 2016 at 15:27
  • @JohnBrown Which is why I said "many", not all. It's still very unlikely despite the cases where some poorly designed devices use a driver-enabled light, and the solution is still the same.
    – Polynomial
    Dec 29, 2016 at 15:40
  • I really appreciate your answer but i want to say is that the webcam driver also does control the led. And adding a filter driver could chabge that
    – John Brown
    Dec 29, 2016 at 15:50
  • @JohnBrown Regardless, it's unlikely that they targeted your specific webcam, and the physical "tape over the camera" solution is still the same.
    – Polynomial
    Dec 29, 2016 at 15:53

All webcams leave a forensic trace, meaning somewhere there is a directory with a cached image (a web-stream is just a series of still images just as a movie is).

If the webcam has been used at least once, this cache directory should contain an image. Specifically, it should contain the last image the webcam sent.

The question of where the cache directory is located is dependant upon many variables. There are a number of good ways to find it:

  1. identify what software is running your webcam and read the documentation associated with that software;
  2. use digital forensic tools (such as The Sleuth Kit (TSK) to find it
  3. Google search your webcam hardware / operating system combination adding the word "+cache"

Although the webcam light can be manipulated (turned off/on) the caching of images by the webcam cannot be. That said, a sufficiently skilled hacker could, (in theory) find the cache directory and delete the image. In practice, most hackers are either unaware or too lazy to clean up the cache.

I was able to prove (to law enforcement) that someone was 'video taping' people without their consent using a webcam, even though the webcam light never came on. I used this very strategy to produce some cached images, which were good examples of proof.

"Few things are harder to put up with than the annoyance of a good example." - Mark Twain

  • 1
    This answer would be more helpful when it would contain information about how to find that cache directory.
    – Philipp
    Dec 29, 2016 at 15:31
  • The location of the cache directory is a function of the hardware, the installed webcam software, and a host of other variables. I will add what I can.
    – user34445
    Dec 29, 2016 at 15:33
  • It is trivial to pipe a video stream to a netstream without caching. There are numerous CLI programs for e.g. Mac OS that accomplish this. The correct (albeit cumbersome) way to detect if a webcam is active is by using hardware ... totalphase.com/solutions/apps/usb-analyzer-benefits . A cheaper method is simply measuring consumed current of camera when active with a multimeter, and checking later if it consumes the same current when it should be inactive. Usually webcams block, so only one program can use it at a time - you can try any webcam app, it will report error.
    – user400344
    Dec 29, 2016 at 16:39
  • ... unless malware hands over control to other apps, of course.
    – user400344
    Dec 29, 2016 at 16:40
  • I agree, that would be intelligent. How often do you see that happen in the real world, though? Not often. Just because something is possible, doesn't make it likely.
    – user34445
    Dec 29, 2016 at 16:45

When a program is running your cam a led will show. If it is on than a program is running your web cam. And most people that would be getting to into a low profile person like your self a attacker would not have any thing that would block out the led from turning on.

  • Welcome to Information Security SE. This answer does not address OP's concerns or statements that the LED could be disabled. It's is also opinion-based.
    – Jedi
    Feb 11, 2017 at 4:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .