"Lights Out: Covertly turning off the ThinkPad webcam LED indicator"

No ratings

Presented at POC 2024 by

Andrey Konovalov

Are you one of the people who cover the laptop webcam with a sticker to avoid being secretly recorded? Even though the LED indicator supposedly shows whether the camera is actually active. As it turns out, your fear of being recorded without an indication is well-grounded! This talk shows how malicious software can turn off the LED indicator of the webcam module used in a few classic ThinkPad laptops while keeping the camera recording. Demonstrating this required finding a way to reprogram the camera's 8051-based controller's EEPROM firmware over USB, leaking and reverse engineering the controller's Boot ROM, and infecting the camera's firmware to add custom USB commands for controlling the LED indicator.