> "because this particular thing does affect me personally, it doesn't matter. And because it doesn't matter to me it doesn't matter at all"
Blackmailing people with pictures taken from webcams is not theoretical. It happens[0] and it's good advice to tape up your cam. It may not affect you personally, but it may affect your wife, daughter, or sister in a much more sinister way. Believe it or not this kind of thing can ruin someone's life.
[0] http://www.computerweekly.com/news/2240209018/US-teen-hacker...
Beyond blackmail, it is probably close to the psychological equivalent of a stranger just suddenly appearing in your home watching you.
I think that every electronic camera and mic device should have a hard switch/button that physically disables both the camera and mic. Having to use tape or a cover does not keep you from being spied on; it only eliminates the visual spying. The attacker can still listen.
An up-to-date Nexus or iPhone is about the most secure thing you own.
This is all that I hate about stackoverflow.
What he's describing is something that also happened (with far greater, more rage-inducing frequency) on tech forums before SO existed.
What about recognizing keys, credit card details or important information in letters on the desk? Some simple image recognition for these, and a large dragnet-style attack with this seems quite lucrative from a minute or two of thought.
This was a little bit more.
What is the point of this comment? Even if you had some way to know (EDIT: which you (https://news.ycombinator.com/item?id=12506075) point out is the case), why should it matter, especially since no-one else in this thread seems to have brought up gender?
In particular, he was calling attention to all the people that cover up their camera and proudly exclaim "Done! Safe at last", while oblivious to all the other hacks and malware that could already be infecting their computer.
More importantly, there's the fact that the level of access required to take over a webcam implies the ability to do all sorts of other things.
What I took away was that if his system was compromised, an open webcam wouldn't likely be the chosen vector for ruining his life.
As someone who was profiled and eventually experienced an attempted-blackmailed by a company in India (employer details gained among other things) - everything seems inconsequential ("I've done nothing wrong"), until it is used, abused (and lies added to) to threaten you.
It doesn't matter whether things are true or not. What matters is, when someone gains details about you, the story and lies they can spin. The cost, distress, and difficulty in trying to resolve and take control of the story can be incredible.
Your personal details should remain just that.
Don't be complacent.
Is this a well-known thing? I haven't heard of it before. Is there some sort of common pattern that such attacks follow? (E.g. most phishing attacks seem to be categorizable, following a number of set patterns, because the people who do them basically try to run the same attack against a lot of people at once to get one or two victims. Is this similar, or is it a matter of individual targeting?)
A hypothetical, ruthless hacker manages to install malware on a person's computer. Hell they could target certain zip codes. All the information is on the Internet. Hell, they could get a picture of your home. (By the way, Google will blure out you home, if you ask. It tends to reappear, although they claim its permanent. If your house has been sold recently, a thief/criminal has easy access to interior layout through Zillow, and the like.)
They watch you through your cams. A lot can be deduced with that information--valuable information that could be sold.
Maybe I've watched too many movies, or crime shows, but I just picture certain questions being asked, "Does the home look like its worth robbing?" "Are there hostages we could take?" "What times do they leave, we need to install our cams because they might find our malware?" "Do they have a safe, or do they seem like they have money/valuables in the house, bedroom?" "Are they doing anything illegial themselfs?" They could develop psychological profiles for people?
I hate to think like this, but certain people think nothing of doing some horrid crimes. A hacker overseas gains some valuable information, and makes a phone call to the Triads, or Russian mob? Your life becomes a statistic.
It sounds far fetched, but just what if? (And am I going to cover my cams? No, because I don't have a life, and I'm poor.)
the only real solution to this is good insurance and good luck.
Wholesale information theft is another level. Someone in a different state or country has access not only to me, but potentially hundreds of people's details, without ever leaving their home. And then they can leverage a whole community that is doing the same. This is how "The Fappening" occurred. This sort of crowdsourced stalking would be impossible pre-internet.
Obviously there are other reasons to worry about webcam access, but "they could spy on me to set up a robbery" is exceedingly low on my list since it just recreates a pattern that doesn't involve a computer.
For the slightly more technical, you've got frameworks like metasploit which can perform network attacks, but even that is getting much more like a kit these days. Port scan for services, fingerprint them, check database for known vulnerabilities, automatically attempt to exploit known vulnerabilities, deploy payload (the trojan).
Once you've been convicted of something, or even arrested really, you have few legal options to support yourself.
I think a substantial share of those drug dealers who aren't working formal-economy jobs as well are also drug addicts that would not be able to keep such jobs particularly well even if they weren't drug dealers, and/or convicts that wouldn't be likely to be offered such jobs if they chose to pursue them.
How can one blackmail a person with webcam pictures where the person just stares into a screen?
If you mean NSFW pics I don't think they're done with a computer's webcam cam. Nowadays, people use phones for that use case.
There was a case about 5-6 years ago when a guy recorded and streamed his secretly gay roomate having sex in the dorm. The gay roomate committed suicide later.
Work computers can be taken home or to business trips where things can happen in the hotel after the deal is struck.
Serious question: what happens when a deal is struck? They go out to drink? They go back to their hotels? They have sex with their coworkers?
Protecting your privacy should NOT be weird and a sticker over your webcam is a very visible way of showing that to the public. When people ask why I do it, its a good opportunity to educate them on the capabilities of the US government, other nation-state actors, and hackers in general. If they don't believe me and haven't heard of Snowden its simple to show them images of Zuckerberg, the FBI director, and other in tech with taped over webcams to convince them.
John Oliver also did a special last year that showed that a lot of people don't really care about the government getting most of their personal information on their computer. But when they think that the government is getting naked pictures of them and their family they're a lot more interested and upset. Bringing up the fact that the government can see them nude in conversation scares a lot more people and they are more inclined to become more privacy conscious.
If you use one of the bookmark post-it notes, it makes it easy to remove the sticker and put it back when you're done with your video conversation.
Am I the only one to receive disarming responses when trying to educate anybody over this matter? The vast majority of people (and when I say "vast majority" I mean everybody but two or three people tops, so far) I tried to explain things to don't care. All they have to say are things like "Where is your tinfoil hat?", "This is conspiracy theory", "If they want to spy us there's nothing we can do" and the never old "I have nothing to fear because I have nothing to hide."
Even when you provide material from authoritative sources you still risk being told "Bullshit, go figure who wrote this".
My laptop is black and I keep a piece of black electrical tape over it so it's mostly unnoticeable if you aren't close enough. I do this to avoid giving explanations because from my experience it is pointless.
The best comeback to this is usually asking if they have drapes/shades for their windows at home. I think I read that in a CCC guide to talking about privacy/security somewhere. At least that has lead to somewhat interesting discussions and the occasional moment of "you might have a point".
Cool. Now, can I have your wallet/purse? Also, get naked. I want to see what you're hiding under your clothes.
And you can forward your medical record, along with your business emails to me as well.
Because you have nothing to hide....
Maybe something like 'security theatre'.
The potential to listen to audio on unpatched, compromised devices, is a huge attack vector! And yet we tape up cameras.
Worked like a charm.
The warm and fuzzy feeling that discovery gave me is why my daily driver is still on Win7 since I almost always have both audio directions muted.
I mean, if you can turn the LED off through software, it's really no better than the little menu bar icon that every other laptop has. If it were done all in hardware, that would be cool.
The fact that Windows10 breaks it surely suggests it's a software feature?
There's a difference between "I can turn this off as long as the driver is properly installed and has not been hacked" and "I can't turn this off." While the second statement is abstractly true for both, the bar for some software silently and invisibly turning on the microphone is quite a bit higher if it also requires replacing or hacking the audio hardware drivers.
When I'm done using my laptop I close it.
Given how everything is angled, I suppose a webcam infiltrator would have a perfect view of me sleeping.
Personally, I only use my laptop when I am away from my office. And my office happens to be my bedroom.
My mother learned to do this from the IT Security team at her company. And I learned to do that from her. It simply never occurred to me that the Facetime camera, hidden on the MBP, can be turned on at anytime without the status light being activated. I keep a small box of those post-its in my go bag and share them liberally.
It is creating general awareness.
Bash isn't pretty but it does work.
My hardened laptop is an older Thinkpad laptop with LibreBoot to replace the BIOS, microphone and speakers and camera disconnected internally, removed the wireless cards, encrypted the partitions, and use Whonix as the OS. I've password protected the BIOS and it's set to boot only from the hard drive and I've also epoxied the screw heads in place as well as put globs of epoxy over all the ports other than USB in order to protect against hardware devices that can access memory through DMA vulnerabilities.
It was mostly an exercise in "how secure can I get". I'm not sure what else is possible.
If someone manufactured and sold a more modern hardened laptop, I would be interested in buying it.
Admittedly, though, it's not a laptop.
As far as laptops go, the librem 13[2], with Qubes OS and coreboot would be a pretty good bet.
If you haven't already, definitely take a look at Qubes OS[3]. It offers security by compartmentalizing different workspaces in different vm's managed by Xen so, in theory, even a kernel exploit isn't getting very far into the system.
[1] https://www.crowdsupply.com/design-shift/orwl [2] https://puri.sm/librem-13/ [3] https://www.qubes-os.org
2. Use DropBox
3. Use Skype
4. Use Google services, always logged in
5. Use Windows 10
6. Use Google Chrome
7. Tape webcam ¯\_(ツ)_/¯
I could also point out that you are more likely to slip in your shower and injure yourself than get struck by lightning, but I expect there are more people who know how to stay safe in a lightning storm than who have non-slip mats in their shower. You're also far more likely to get injured or killed driving your own car, but I expect many people avoid public transit out of fear, lack of convenience , etc.
No question our assessment of risk is poor, but that doesn't mean we shouldn't take what steps will fit into our lives.
No security habit short of Ludditism was going to keep people safe from Heartbleed. And it does feel a little on the nose for Comey to be pushing a security 'story' that's conveniently removed from crucial steps like "update your software regularly". I was irritated to see him describe that as "caring about people's personal security" when his stance on all other tech topics is to make people give up security for access.
None of which makes taping up a webcam wrong, of course. It's easy, it's nontechnical, and it eliminates a whole (very real) class of threat at a single stroke. That's actually pretty good, and webcam spying/blackmail certainly does happen.
I work at a public library and occasionally teach computer classes. In one we cover security, but it's infuriatingly difficult. When you're working with people who have trouble with the mouse, or even with basic literacy (I mean reading literacy, not computer), it's hard to explain "attack surfaces" or "the cloud". It usually comes down to:
1. Understand the difference between identity and security. 2. Update your software regularly. 3. Use different passwords for different services and write them down (the number of people who don't know their password because they have email on their phone is... too high). 4. Be aware of who you are giving information to and why. Do they need that information? Is what they are offering worth providing it.
It's hard to cover much more than that.
If we aren't there already, the direction of technology seems to me to be: "cameras all around, everywhere, 360 degrees all the time." Ubiquitus video/audio recording and real time processing.
So what are we left with in terms of privacy? I believe we can only hope to control how data is used in this aggregate sense to some extent or other. If even that.
A new sense of what privacy is. It is increasingly rare that someone should have a sense of privacy or anonymity while in a public place.
It's reasonable to worry about government abuse of power from monopoly access to the full aggregation of surveillance data (even if that data was not originally intended as surveillance). Many people advocate for damming the flood of data, but this is futile. A more effective solution is to end the monopoly of access -- public aggregation of surveillance data. Twitch for everything.
Don't worry quite yet. Wait until we all have wearable cameras.
We all do weird things or at least act slightly differently when we feel alone (being naked is one of those). Your records can be easily used to put a little pressure on you to do something little, not big. Why do you think you're so important to FBI CIA KGB? Regular fraudster will send you your photos and say that your boss/wife/friend will see it, and though there is 'nothing really wrong' on these, you'll pay or feel unprotected, or your party will.
That said, far too many people do have personally secret behavior like cheating, gambling, smoking, jerking off (oops, said it), having sex, private speech, strange comments that can be abused out of context (e.g. n-word while playing role in gta:sa). So many ways to get f-ed up.
But hardware can also get better. Surely the next-gen of laptops have depth-sensing cameras too? Its becoming an integral part of game console motion detection, and normal smartphones will have them too e.g. hype I found by googling: https://3dprint.com/117809/depth-sensing-phone-cameras/
But Nevertheless activating one of the many microphones around (mobile phones, phones, laptops, "echo" like devices, speech controlled televison) would concern me much more then.
Because webcams record at 60hz (max), they can only capture enough data to reconstruct sound at 30hz, way below the human voice range.
I do lots of calls, but I've never seen a good reason to use video except perhaps with one's SO.
Giving an attacker the ability to monitor your body language while they have full control of your computer is extremely dangerous as they have established a closed loop to interact with you without your consent or knowledge.
As the FBI also excell in this kind of subversive intelligence gathering, it figures they would be wary of being on the other end of it. An example is if a chinese, Russian, corporate spy had them on the other end without their knowledge.
Edit: Another topic is the issue of criminals who use extortion. This is far more common than you likely realize or aware of. Where we are the criminals and intelligence saboteurs/spies are alot more sophisticated, and use computer hacks as part of their planning to extort and blackmail their targets.
I solve that by never talking to anyone ;)
I'm thinking you might shell out a few bucks to keep someone from posting pics of you doing something embarrassing while naked.
At the end, all they will see is a bearded man staring to the front. May they be able to see me naked? Well, probably, but I honestly don't think that they will make a lot of money by selling my naked pictures... My wife tells me that I still look good, but I suspect that she is being nice to me.
What would scare more is that they manage to capture what is on my screen, or install a keylogger, or activate the microphones to hear my conversations, or that they access my hard disks and steal data, including my private keys.
Hey, but putting a sticker on your webcam is a way to show how 1337 your are!
I prefer not to have to bother removing stickers every time I want to do a Skype call.