Security insights: Laptop webcam hack

People often ask about webcam hacking. “Is it possible for someone to hack a webcam on my laptop or computer? The truth is that it’s easier than you might think. All the tools needed for such an attack are commonly available (eg within the Metasploit Framework). Once the computer is broken into, the attacker needs only one command to transmit the webcam image.

I have prepared a video demonstration for you once again. However, as I wrote, it is necessary to infect the victim’s computer first.

Web browser as a way to hack your PC

I chose an exploit using bugs in FireFox to infect the laptop(CVE-2014-1510 a CVE-2014-1511). In my view, the method of infiltrating the laptop is much more interesting than the webcam hack itself, because:

• It does not require user interaction: no user interaction is required for successful hacking (no clicks or confirmation). The delivery of code is enough.
• The user cannot simply defend himself: malicious code can wait for a user on any site a user visits. The code can be put there by an insidious webmaster, a hacker who broke the site or embedded by a third party (such as malvertising). It’s important to remember that as users, we have no control over what web servers are sending to our devices. Of course, this is an old bug that is already fixed, but zero-day errors still occur.
• The attack comes through a web browser: everyone knows that it’s good to have an antivirus on your PC and to update your operating system. In general, however, it is less known that having an updated web browser is just as important.

DEMO: Webcam hack

Let’s see how such a webcam hack could happen. I have tried to prepare the video in a “playful” way and add my comments. I´ll be pleased if you could share your feedback.

Detailed insights: You may have noticed in the video that as soon as the attacker has accessed the victim’s webcam, the webcam LED has turned on to indicate that the webcam was recording. This is certainly a great tool, but it can be also bypassed (iSeeYou: Disabling the MacBook Webcam Indicator LED, or How to disable webcam light on Windows).

How to defend against webcam hacks

The safest way is to buy a device without a camera and a microphone. 😊 If you already have a webcam on your device, you can disable it in BIOS / UEFI, Device Manager, or physically paste something onto it. When you Google  „webcam sticker“, you will get a wide range of solutions, including sliders, that allow you to occasionally use the webcam.

I will devote another more detailed article to the defense, so please allow me to leave this paragraph as short as it is.

If you liked the video, check out the previous section of security insights: How To Get Hacked By An RDP Server.

Till next time.

Martin Haller

#forbetterIT ✌