3

Last month I was browsing the internet, and clicked on a link on a website. If you click a link at this site ususally a pop up comes up. Therefore I knew a pop up was going to come up and I closed it as usual. But for that brief second my webcam turned on. Ingnoring it I continued working.

A few days back this happened again and I installed antivirus (which I didn't have before). Nothing came up, but now I'm very worried that a hacker has installed malware on my laptop and is secretly spying on me by disabling the led, and that the led turning on was just to take a pic.

But on the other hand, if someone goes through so much work (like installing malware without me installing anything, etc) he would have held ransom against me already, as my laptop is on all day in my room and I change in my room. But he didn't.

Is there any way to identify if something like this happened?

  • Why do you assume there would be a ransom? If what you're saying is accurate, the act of voyeurism itself is the end goal, not financial gain. – Ivan Dec 29 '16 at 14:46
  • what do you mean – John Brown Dec 29 '16 at 14:50
  • You don't know there is a financial motive involved. If someone is spying on you, it could just be for the sake of watching, not extortion. This happened to teenage girls with pirated Sims content some years ago. – Ivan Dec 29 '16 at 14:59
  • why would someone do so much hardwork like first finding a zero day exploit as my software is always updated. and then writing a driver to disable my led – John Brown Dec 29 '16 at 15:02
  • 1
    @Johnny I think we can separate the OP's concerns about his events from the core question: How to identify if the webcam is sending data without the user's consent; spying. The ransom part is just noise IMHO. – Mindwin Dec 29 '16 at 15:03
1

It's extremely unlikely. For a start, many of the camera-enable LEDs are driven by a microcontroller on the webcam itself, switching on when the camera is in use, so the driver doesn't make a difference here. In fact, last I checked, most webcams use a generic driver (e.g. WIA) for image capture.

If you're really worried, install a privacy cover over the camera.

  • blog.erratasec.com/2013/12/… but what about this – John Brown Dec 29 '16 at 15:27
  • @JohnBrown Which is why I said "many", not all. It's still very unlikely despite the cases where some poorly designed devices use a driver-enabled light, and the solution is still the same. – Polynomial Dec 29 '16 at 15:40
  • I really appreciate your answer but i want to say is that the webcam driver also does control the led. And adding a filter driver could chabge that – John Brown Dec 29 '16 at 15:50
  • @JohnBrown Regardless, it's unlikely that they targeted your specific webcam, and the physical "tape over the camera" solution is still the same. – Polynomial Dec 29 '16 at 15:53
1

All webcams leave a forensic trace, meaning somewhere there is a directory with a cached image (a web-stream is just a series of still images just as a movie is).

If the webcam has been used at least once, this cache directory should contain an image. Specifically, it should contain the last image the webcam sent.

The question of where the cache directory is located is dependant upon many variables. There are a number of good ways to find it:

  1. identify what software is running your webcam and read the documentation associated with that software;
  2. use digital forensic tools (such as The Sleuth Kit (TSK) to find it
  3. Google search your webcam hardware / operating system combination adding the word "+cache"

Although the webcam light can be manipulated (turned off/on) the caching of images by the webcam cannot be. That said, a sufficiently skilled hacker could, (in theory) find the cache directory and delete the image. In practice, most hackers are either unaware or too lazy to clean up the cache.

I was able to prove (to law enforcement) that someone was 'video taping' people without their consent using a webcam, even though the webcam light never came on. I used this very strategy to produce some cached images, which were good examples of proof.

"Few things are harder to put up with than the annoyance of a good example." - Mark Twain

  • 1
    This answer would be more helpful when it would contain information about how to find that cache directory. – Philipp Dec 29 '16 at 15:31
  • The location of the cache directory is a function of the hardware, the installed webcam software, and a host of other variables. I will add what I can. – user34445 Dec 29 '16 at 15:33
  • It is trivial to pipe a video stream to a netstream without caching. There are numerous CLI programs for e.g. Mac OS that accomplish this. The correct (albeit cumbersome) way to detect if a webcam is active is by using hardware ... totalphase.com/solutions/apps/usb-analyzer-benefits . A cheaper method is simply measuring consumed current of camera when active with a multimeter, and checking later if it consumes the same current when it should be inactive. Usually webcams block, so only one program can use it at a time - you can try any webcam app, it will report error. – user400344 Dec 29 '16 at 16:39
  • ... unless malware hands over control to other apps, of course. – user400344 Dec 29 '16 at 16:40
  • I agree, that would be intelligent. How often do you see that happen in the real world, though? Not often. Just because something is possible, doesn't make it likely. – user34445 Dec 29 '16 at 16:45
0

When a program is running your cam a led will show. If it is on than a program is running your web cam. And most people that would be getting to into a low profile person like your self a attacker would not have any thing that would block out the led from turning on.

  • Welcome to Information Security SE. This answer does not address OP's concerns or statements that the LED could be disabled. It's is also opinion-based. – Jedi Feb 11 '17 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.