3

I'm worried about camfecting (webcam hacking). The camera light on my mac (running OSX) is not on, but it isn't hard wired so that doesn't say a lot.

I've ran a virus scan but no signs. Now my idea was to watch outbound traffic in activity monitor. If there is live streaming (most likely when camfecting is occurring?) the outgoing traffic can't be under 1 kB/s right? Or will such traffic be invisible for the total data traffic in activity monitor?

Improve this question

4 Answers 4

Reset to default
5

There is no good software way to do this.

Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the stats on another computer, and, besides that it is extremely inconvenient, the router can be attacked, too.

I protect me from camfecting with a thick tape. I can pull it (partly) off when I need it, and as my cellphone already includes a microphone that can tap me, I don't care for the webcam's mic, at least most times.

If you also cared for your mic, or had a tin foil hat, I'd suggest to completely disable the microphone and camera on the hardware side, most times by removing it. The NSA recommends to remove the camera (pdf). In the pdf are additional tips on how to protect yourself from camfecting:

The best way to disable an integrated iSight camera is to have an Apple-certified technician remove it. Placing opaque tape over the camera is less secure but still helpful. A less persistent but still helpful method is to remove /System/Library/Quicktime/QuicktimeUSBVDCDigitizer.component, which will prevent some programs from accessing the camera.

To disable the microphone, even if it means crippling the sound system, remove the following file from /System/Library/Extensions: IOAudioFamily.kext

Don't overestimate the software-side solutions above. Through a privilege escalation attack they can be defeated.

You can buy yourself a cheap usb webcam and use that instead of the built in one, and when you don't need it you can simply disconnect it.

Improve this answer
2
  • Thanks for your reply. Tape of course works for the imaging as long as you don't need the camera. But there is absolutely no way to gain some certainty about whether it happened/is happening? How likely is such a hack, especially one also affecting routers? Any idea how to monitor network activity from another computer in a simple way? Logging in to a router didn't give me insight on data transfer yet...
    – user55015
    Sep 6, 2014 at 17:56
  • I've a tape I can pull partially off in the case I need my camera. And no there is no feasible way. Of course, you could try to hardwire your LED, but I suspect the controller chip gets powered all the time, so installing a new camera may be easier than hardwiring. And about likeliness: read about threat models. I personally want to prevent unauthorized access to my webcam. Do you watch the LED every time you undress/get dressed?
    – user10008
    Sep 6, 2014 at 23:08
1

Check out the name of the device through Device Manager in windows.

When you have the name you can look it up with Process Explorer. Is any process running your device?

Improve this answer
1
  • Thanks, but remember I'm on OSX. Is there a way to check this in terminal or otherwise?
    – user55015
    Sep 5, 2014 at 12:16
1

Perhaps the best and only way to determine if your webcam is transmitting images without your knowledge would be to use a network monitoring tool to actually inspect the traffic packets themselves.

Just because your outgoing traffic is 1kB/s doesnt mean images are not still being sent -just slowly or broken up.

You best bet would be to install something like wireshark on a computer that is connected to your network but not the suspected infected computer.

Check this out for more info on tools and incident response.

You may also be interested in router based firewalls.

Update: The key here is to maintain positive accountability for all of your network traffic -that is know how much each process/service is supposed to use and verify that no other transmissions are occurring. I say use wireshark to do this because you can simply filter out all traffic but specific applications (or end points). In conjunction with a firewall you can also filter out traffic at that level and look at all information via wireshark (or a simple tcpdump). Also you can play with using an IDS (intrusion detection system) although I would simply put tape over the webcam (or remove it).

Improve this answer
4
  • I tried Wireshark but that seems risky to use? Anyway it's not easy to analyze results from it. The 1 kB/s does indicate though no video streaming takes place, or is there a way to send packets that are not in this measurement. Normally it measures TOTAL outgoing traffic, not?
    – user55015
    Sep 5, 2014 at 19:59
  • @user55015, why is Wireshark 'risky'? Regardless, there are other tools out there. If you are concerned that someone has exploited your webcam, it is not a stretch (and you should) to assume that your entire mac is compromised, thus using 'activity monitor' may not be accurate, which is why I say monitor the network outside the infected machine. Also, I've updated my answer with router based firewalls
    – Matthew Peters
    Sep 5, 2014 at 20:07
  • This assumes that video data would necessarily be sent concurrent with the recording. It could be buffered for later transmission.
    – StayOnTarget
    Aug 25, 2016 at 15:46
  • @DaveInCaz, even if it is buffered, it would still show, just not at the same time. The key is to account for all your network traffic...
    – Matthew Peters
    Aug 25, 2016 at 17:53
0

The only truly way accurate way to monitor web traffic from your Mac is by forcing traffic through a gateway machine, such as a custom router or a (Linux?) PC with two ethernet ports. You can run jpeg/mpeg sniffing software such as dvbsnoop or driftnet to detect any images or video frames being broadcast over your network, or nettop (or tcpdump or Wireshark) to determine the size and possibly the content of the packets your Mac is transmitting. For example If your Mac is constantly transmitting 250kbps in an "idle" state, that is highly suspicious.

Improve this answer
1
  • 1
    It's important to realize that videos may be recorded and saved persistently, then uploaded in bulk at a set time (or while other uploads are occurring). Not only this, but if the videos are uploaded encrypted or in a strange format, they won't be detected on a gateway machine.
    – forest
    Jul 8, 2018 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .