Why not just wire the LEDs up to the same power line that goes to the camera?
Why not just wire the LEDs up to the same power line that goes to the camera?
Besides, the vast majority of users will not be under active attack. Having an on-screen popup when you try to use the webcam telling you that it has been hardware-disabled is quite a must-have. If you don't have something like this, you'll get a lot of support calls which boil down to "you accidentally pressed the kill switch, press it again to re-enable".
For example, when you are "required" [1] to run surveillance software on your computer.
[1] https://www.vice.com/en/article/n7wxvd/students-are-rebellin...
How well would tape work on that?
Yep. This was an extremely common issue in the mid-2000s, when laptops started integrating wireless hardware with hard power switches, often on the side of the laptop where they could easily be toggled by accident.
It's basically a false sense of security which is generally worse than doing nothing.
Detecting the pattern in a prng stream is equivalent to finding its Kolmogorov complexity. https://en.m.wikipedia.org/wiki/Kolmogorov_complexity#Chaiti...
This assumes an attacker is targeting you specifically since otherwise this is all moot (a broad attack could care less as to why your microphone is off).
Really, though, in general there's just no point to this altogether; just cutting power/data to the mic is fine. There's no need to attempt to fool someone with fake audio, outside of some very edge-case scenarios that I'm sure Dell (rightly) does not care about.
And the spy device/software knowing the user has "switched off the means" vs "they are broken" is important because?
What exactly do you expect that to accomplish. Anyone actively targeting you getting literally NO SOUND OR VIDEO is going to know that you've flipped the switch just the same.
Even the quietest apartment has HVAC that will be picked up. If they're recording for hours they're going to hear people walking by. The camera itself will still provide an image, even if it's black, that looks different than no signal at all.
If a nation state is able to get to your laptop they're going to figure out pretty quickly that you're "feeding something pre-recorded" into the mic and camera every time you have a meeting. Ignoring the insane effort you'd have to put out to feed that in and make it even semi-believable. For starters they are presumably tracking who you're meeting with - are you going to have a meeting before your meeting to pre-record? Hope they don't figure out that you're saying the exact same thing in two different meetings? Somehow have root on your laptop but aren't bright enough to figure out you're feeding data from a local file into your mic and camera?
If you have a spy device connected to your computer or have malware running, you are very screwed in a million different ways already. Limiting knowledge of hardware state to malware doesn't buy you much.
It's just difficult enough to not bother considering the market doesn't care.
Webcams are typically USB 2.0 devices using generic drivers from the operating system or manufacturer. It's easy from a hardware and software perspective to send a command to the webcam to disable itself and turn off its LED. If you want to completely cut power then you need to add power switching circuitry.
You could use one of your CPU's limited GPIO pins to control the switching but now you probably need a smart power switch (~$0.30, which is significant) since the low voltage (1.2V?) GPIO can't handle switching a regular mosfet gate. GPIO writes are usually easy (just write to a memory address), but you'd still need to modify the vendor driver to do this and then distribute the driver.
Motherboards typically have embedded controllers which have GPIO - on desktops there is a SuperIO chip, I believe laptops typically use a regular microcontroller. Now you have some 3.3V GPIOs that can handle gate switching so you can use a regular MOSFET (~$0.10). You still need to modify and distribute the webcam driver, and now it might have to communicate with another driver which is handling the embedded controller.
Now you have to deal with the webcam disconnecting and reconnecting as you switch power to it. You want the device to always be present even if it's not enumerating on the USB bus, so you can select the webcam in zoom and turn it on and so you're not constantly playing the hardware connect/disconnect sound - even more driver changes. Maybe the webcam takes significantly longer to turn on now because it has to boot and enumerate.
That was all somewhat informed speculation, but I think it illustrates how a seemingly simple thing gets complicated. The electronics industry could easily solve these issues if there was motivation, but there just isn't.
Edit: Well, I'm posting this on an article talking about a vendor which is doing the work to make this happen. I guess I should say there's just enough motivation to eventually get around to solving this problem in a mature market.
The market does care.
People want: hardware kill switches.
They want to cut their camera. (I've seen tape many times)
They want to mute their microphone for real.
Even non-nefarious "on-screen" mute buttons are subject to abuse.
For instance, in webex the conference host can unmute one or all of other people's mute buttons remotely. (To be clear there is a use case for this)
I wonder how many apps are listening even while mute is on. I would expect many of them.
and then there are exploits, which are lower probability but can do much more damage.
You'll need a special firmware for the cam (like apple device), need to ensure integrity of the said firmware and also need a customized driver which needs maintenance work.
I have an old Logitech Pro 9000 camera with a lot of bells and whistles but, when I found out that its light can be managed by the driver and the UVC client in Linux AND it can turned off while it's recording, I've never kept it connected longer than it should be.
So yes, custom and secure hardware is hard.
Basically any modern laptop with a build-in webcam has a hardware controlled LED, not software controlled.
Kill switches should be mechanical and should physically disconnect the device from the system. Kill switches and lights that are controllable by software will be exploited.
Or because once the light is on, it's too late?
Or because I don't want to risk missing the light being on, just because the computer is on but I m not behind it?
My lenovo laptop has basically a builtin webcam cover, and I absolutely love it.