Organizer
Partner Company
Lights Out: Covertly turning off the ThinkPad webcam LED indicator
Andrey Konovalov
Positive Technologies
Abstract
Are you one of the people who cover the laptop webcam with a sticker to avoid being secretly recorded? Even though the LED indicator supposedly shows whether the camera is actually active. As it turns out, your fear of being recorded without an indication is well-grounded!
This talk shows how malicious software can turn off the LED indicator of the webcam module used in a few classic ThinkPad laptops while keeping the camera recording. Demonstrating this required finding a way to reprogram the camera's 8051-based controller's EEPROM firmware over USB, leaking and reverse engineering the controller's Boot ROM, and infecting the camera's firmware to add custom USB commands for controlling the LED indicator.
Speaker Info
Andrey Konovalov is a security researcher focusing on the Linux kernel.
Andrey found multiple zero-day bugs in the Linux kernel and published proof-of-concept exploits for these bugs to demonstrate the impact.
Andrey contributed to several security-related Linux kernel subsystems and tools: KASAN — a fast dynamic bug detector; syzkaller — a production-grade kernel fuzzer; and Arm Memory Tagging Extension (MTE) — an exploit mitigation.
See xairy.io for all of Andrey's articles, talks, and projects.