A Security researcher Andrey Konovalov finds that the ThinkPad X230 webcam LED can be controlled by software, even without physically accessing the laptop. He created a set of tools to demonstrate that malware can remotely disable the webcam LED of a ThinkPad X230 laptop.
Andrey Konovalov, in his presentation "Lights Out: Covertly turning off the ThinkPad webcam LED indicator" details how he discovered a vulnerability in the ThinkPad X230's webcam that allows an attacker to control the LED remotely without physical access to the laptop
He claims that this is possible because the webcam connects to the laptop internally through USB, and the LED is connected to a pin on the camera's controller chip, which can be manipulated through firmware.
This discovery raises concerns about potential privacy breaches, as malware could potentially record video without the user's knowledge.
Table of Contents
How the Exploit Works
The exploit hinges on the fact that the webcam's firmware can be reflashed over USB. The firmware has a section called the SROM, which resides on an SPI flash chip on the webcam board. By overwriting the SROM with modified firmware, it is possible to gain control over various aspects of the webcam, including the LED.
Konovalov was able to determine that the LED on the X230 webcam is connected to the GPIO B1 pin on the Ricoh R5U8710 USB camera controller. This pin is mapped to address 0x80 in the XDATA memory space of the controller's 8051-based CPU. By modifying the firmware to change the value at this address, the LED can be switched on or off.
Research Methodology
Andrey Konovalov used USB fuzzing to discover this vulnerability.
USB fuzzing is a technique used to find security flaws in software or hardware that communicate via USB. It works by sending a large number of invalid or unexpected USB requests to the target device and observing its behaviour.
Konovalov built a custom setup to reflash the webcam's firmware over USB and to prevent permanently damaging the webcam during the fuzzing process.
Tools
Andrey discovered this vulnerability while fuzzing the webcam's USB interface. He developed a set of tools that allow for:
- Reading and writing the SROM part of the firmware of a Ricoh R5U8710-based webcam over USB.
- Patching the SROM image to add the universal implant.
- Fetching the contents of the IRAM, XDATA, or CODE memory space over USB.
- Turning the webcam LED on or off.
You can find all the tools in his GitHub repository.
Implications for Other Laptops
The same approach used to control the LED on the ThinkPad X230 is potentially applicable to other laptops. Many laptop manufacturers use USB to connect webcams internally and allow reflashing the firmware. If the LED is not directly tied to the camera sensor's power but instead controlled through firmware, it could be susceptible to similar manipulation.
Konovalov suggests that OEMs tie the webcam LED to the power on sensor of the camera to mitigate this vulnerability
Recommendations for Laptop Users
While reflashing the webcam firmware is a complex process, the potential for malware exploiting this vulnerability is real.
Here are some recommendations for laptop users:
- Physical Webcam Covers: Consider using a physical webcam cover when the camera is not in use. This provides a simple and effective way to block the camera lens.
- Disable built-in Webcam: If you're not using Camera, it is better to disable the webcam completely.
- Awareness of LED Behaviour: Be attentive to any unusual behaviour of the webcam LED. If the LED does not illuminate when the camera should be active, it might be an indication of compromise.
- Keep Software Updated: Ensure your operating system and security software are up to date to mitigate potential vulnerabilities.
This research shows that even seemingly innocuous features like webcam LEDs can be exploited for malicious purposes. Users should be aware of the potential for privacy breaches and take appropriate measures to protect themselves.
