Confounding that spying webcam: Low-tech tips for peace of mind

Webcameras and their possible misuse have been a hot topic lately, what with the alleged ‘laptop spycam‘ case currently ongoing against a high school in Philadelphia, US.

Now, by and large, webcams can be tremendously useful. They’re used in a huge variety of legitimate settings, from home security to cross-country family chats, from peak hour traffic monitoring to the porn industry (ahem).  In fact, webcams are only a concern if someone takes unauthorized control of one for their own ends.

Should I Be Worried?

Before looking into this though, firstly – is that even likely to happen to the average user? Do most people need to worry about a peeping-tom webcam?

Well, strictly speaking, if your computer is secure and uninfected, can’t be accessed remotely, and has some kind of physical protection (strong password, locked case, tied up with string) to prevent people from accessing it when unattended, then no, no worries – you’re good.

If your computer is not as secure as you’d like; if you don’t control the software installed on it; if you don’t know how to configure the settings on the programs installed – it’s still pretty unlikely, though there’s still a chance. Logically, it’s like the odds of being struck by lightning – possible, but improbable.

The trouble is, when it comes to privacy, ‘rational’ can have a hard time fighting ‘emotional’. Personally, there’s just something about the thought of someone spying on me through my own webcam that creeps the bejeesus out of me. It’s like finding an eyeball staring back at you through the keyhole of a cupboard door.

So, let’s say you’d like that small possibility to be even slighter. How exactly could some depraved perv..ahem, attacker get control of your webcam? Well, there are really only a few ways your webcam can be taken over:

Pre-installed software

The program used to control a webcam may include a remote admin feature allowing someone not physically present to control it (usually over the Internet). Remote admin functionality could also be added in a separate program.

If you aren’t permitted to modify the control program’s settings, or aren’t allowed to install/uninstall programs (more true of company-issued laptops than personal owners), or just don’t know how to do it, well…basically, someone else has control.  Hopefully, they’re not the sort to snoop.


For those with full control of their system, trojans are probably more relevant. These are malicious programs (usually disguised as a PDF or document file) that secretly install other programs onto a computer. For spying to be a concern, the installed program has to be a backdoor  – which is basically remote admin software, only nastier. Examples include Backdoor:W32/Hupigon, Backdoor:W32/PoisonIvy and Backdoor:W32/SDBot.MB.

Again, the chances of getting hit by a trojan carrying a backdoor payload boils down to juggling probabilities – if the computer has no AV protection, if it is connected to the Internet and/or if you transfer files to it without scanning them first, if an infected file is a trojan and if it has a backdoor as its payload…You get the idea. It’s happened before, as this reports shows, but how likely you are to get hit really depends on how secure you are.

Direct interference

Possibly the least likely, but definitely the creepiest is when someone literally sits down at your computer and switches on the webcam, or installs remote admin software, without you being aware of it.  This is basically stalking behavior, with a few cases reported; there have even been movies (most recently, Alone With Her) made on this premise.

Is it a possibility? Yes. Is it likely? There’s absolutely no figures or surveys on this, so all I can say is that unless you have reason to believe you’re being stalked, most likely not.

How to Secure Your Webcam

So, how to ensure you’re as safe as can be from being spied on? And let’s assume I don’t just say ‘get a good antivirus program’ (because that’d be a shameless plug), or the usual stuff about protecting your computer. What can you do? A lot, actually.

You could choose a webcam with security features. Most webcams today come with an LED light that switches on whenever the cam is transmitting. Or get a webcam with a lens cover (oddly these seem to have fallen out of fashion, are people more trusting these days?).

Then there’s this cute humanoid figure-like ‘anti-peeping‘ webcam, with arms that move automatically or manually to cover its ‘eye-lens’ – I haven’t been able to get my hands on this yet, so if someone has this already, let me know how it works out!

If you already have a webcam, you can go through the settings for its control program – if there’s a remote admin feature included and you’re not using it, make sure it’s disabled. You may need to check the documentation for the program to do this.

If you’re using a wireless webcam setup, make sure your wireless network is secured, so that noone can nick the webcam feed off  your own network. Maybe not with WEP though; the stronger WPA2 would be nice.

Some less techie things you  can do are:

1. Unplug it when not in use (if it’s an external web-cam).
2. Turn it to face a wall when not in use (doesn’t mute the mic, though).

And for some really no-brainer fixes….


webcam covered with tape

Or Post-It notes (some students in the spycam laptop case reportedly used this as well).

webcam covered with a Post-It note

Or Blu-tack (I haven’t tried this myself, but a commenter in a forum mentioned it might help with blocking microphone transmissions as well).

Heck, even a tea cosy would do.

When IT savvy fails, a MacGuyver solution might do the trick.

CC image credit: Itiro


More posts from this topic


What is a supercookie and why is it more important than you think?

Many techie terms in the headlines lately. Supercookies, supertrackers, HTTP headers and X-UIDH. If you just skim the news you will learn that this is some kind of new threat against our privacy. But what is it really? Let’s dig a bit deeper. We will discover that this is an issue of surprisingly big importance. Cookies are already familiar to most of us. These are small pieces of information that a web server can ask our browser to store. They are very useful for identifying users and managing sessions. They are designed with security and privacy in mind, and users can control how these cookies are used. In short, they are essential, they can be a privacy problem but we have tools to manage that threat. What’s said above is good for us ordinary folks, but not so good for advertisers. Users get more and more privacy-aware and execute their ability to opt out from too excessive tracking. The mobile device revolution has also changed the game. More and more of our Internet access is done through apps instead of the browser. This is like using a separate “browser” for all the services we use, and this makes it a lot harder to get an overall picture of our surfing habits. And that’s exactly what advertisers want, advertising is like a lottery with bad odds unless they know who’s watching the ad. A new generation of supercookies (* were developed to fight this trend. It is a piece of information that is inserted in your web traffic by your broadband provider. Its purpose is to identify the user from whom the traffic comes. And to generate revenue for the broadband provider by selling information about who you really are to the advertisers. These supercookies are typically used on mobile broadband connections where the subscription is personal, meaning that all traffic on it comes from a single person. So why are supercookies bad? They are inserted in the traffic without your consent and you have no way to opt out. They are not visible at all on your device so there is no way to control them by using browser settings or special tools. They are designed to support advertisers and generate revenue for the mobile broadband provider. Your need for privacy has not been a design goal. They are not domain-specific like ordinary cookies. They are broadcasted to any site you communicate with. They were designed to remain secret. They are hidden in an obscure part of the header information that very few web administrators need to touch. There are two ways to pay for Internet services, with money or by letting someone profile you for marketing purposes. This system combines both. You are utilized for marketing profit by someone you pay money to. But what can and should I do as an ordinary user? Despite the name, this kind of supercookies are technically totally different from ordinary cookies. The privacy challenges related with ordinary cookies are still there and need to be managed. Supercookies have not replaced them. Whatever you do to manage ordinary cookies, keep doing it. Supercookies are only used by some mobile broadband providers. Verizon and AT&T have been most in the headlines, but at least AT&T seems to be ramping down as a result of the bad press. Some other operators are affected as well. If you use a device with a mobile broadband connection, you can test if your provider inserts them. Go to this page while connected over the device’s own data connection, not WiFi. Check what comes after “Broadcast UID:”. This field should be empty. If not, then your broadband provider uses supercookies. Changing provider is one way to get rid of them. Another way is to use a VPN-service. This will encapsulate all your traffic in an encrypted connection, which is impossible to tamper with. We happen to have a great offering for you, F-secure Freedome. Needless to say, using Freedome on your mobile device is a good idea even if you are not affected by these supercookies. Check the site for more details. Last but not least. Even if you’re unaffected, as most of you probably are, this is a great reminder of how important net neutrality is. It means that any carrier that deliver your network traffic should do that only, and not manipulate it for their own profit. This kind of tampering is one evil trick, throttling to extort money from other businesses is another. We take neutrality and equal handling for granted on many other common resources in our society. The road network, the postal service, delivery of electricity, etc. Internet is already a backbone in society and will grow even more important in the future. Maintaining neutrality and fair rules in this network is of paramount importance for our future society.   Safe surfing, Micke   PS. The bad press has already made AT&T drop the supercookies, which is great. All others involved mobile broadband providers may have done the same by the time you are reading this. But this is still an excellent example of why net neutrality is important and need to be guaranteed by legislation.     (* This article uses the simplified term supercookie for the X-UIDH -based tracker values used by Verizon, AT&T and others in November 2014. Supercookie may in other contexts refer to other types of cookie-like objects. The common factor is that a supercookie is more persistent and harder to get rid of than an ordinary cookie.   Image by Jer Thorp  

Nov 18, 2014

5 ways to get ready to ask Mikko anything

It's like a press conference anyone can join from anywhere. And even if you don't have a question, you can upvote the ones you don't like and downvote the ones you do. President Obama did one. Snoop Dogg/Snoop Lion did one. An astronaut did one from outer space. And our Mikko Hypponen will sit down for his second Reddit AMA on December 2 at 9 AM ET. If you have something you've wanted to ask him about online security, great. If not, here are five resources that document some of Mikko's more than two decades in the security industry to prod you or prepare you. 1. Check out this 2004 profile of his work from Vanity Fair. 2. Watch his 3 talks that have been featured on [protected-iframe id="7579bbf790267cc081ac7d92d951262c-10874323-9129869" info="" width="640" height="360" frameborder="0" scrolling="no" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""] [protected-iframe id="fdf818f4afa2f7dcb179c5516c44918c-10874323-9129869" info="" width="640" height="360" frameborder="0" scrolling="no" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""] [protected-iframe id="54be2fe9bce28ae991becbe3d4291e56-10874323-9129869" info="" width="640" height="360" frameborder="0" scrolling="no" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""] 3. Check out his first AMA, which took place just after his first talk at TEDglobal was published. 4. Take a trip to Pakistan with Mikko to meet the creators of the first PC virus. [protected-iframe id="8c0605f62076aa901ed165dbd3f4fcd7-10874323-9129869" info="//" width="640" height="360"] 5. To get a sense of what he's been thinking about recently, watch his most recent talk at Black Hat "Governments as Malware Creators". [protected-iframe id="54b24406f022e81b15ad6dadf2adfc93-10874323-9129869" info="//" width="640" height="360"] BONUS: Make sure you follow him on Twitter to get a constant stream of insight about online security, privacy and classic arcade games. Cheers, Sandra

Nov 14, 2014

Shellshock only concerns server admins – WRONG

Yet another high-profile vulnerability in the headlines, Shellshock. This one could be a big issue. The crap could really hit the fan big time if someone creates a worm that infects servers, and that is possible. But the situation seems to be brighter for us ordinary users. The affected component is the Unix/Linux command shell Bash, which is only used by nerdy admins. It is present in Macs as well, but they seem to be unaffected. Linux-based Android does not use Bash and Windows is a totally different world. So we ordinary users can relax and forget about this one. We are not affected. Right? WRONG! Where is your cloud content stored? What kind of software is used to protect your login and password, credit card number, your mail correspondence, your social media updates and all other personal info you store in web-based systems? Exactly. A significant part of that may be on systems that are vulnerable to Shellshock, and that makes you vulnerable. The best protection against vulnerabilities on your own devices is to make sure the automatic update services are enabled and working. That is like outsourcing the worries to professionals, they will create and distribute fixes when vulnerabilities are found. But what about the servers? You have no way to affect how they are managed, and you don’t even know if the services you use are affected. Is there anything you can do? Yes, but only indirectly. This issue is an excellent reminder of some very basic security principles. We have repeated them over and over, but they deserve to be repeated once again now. You can’t control how your web service providers manage their servers, but you can choose which providers you trust. Prefer services that are managed professionally. Remember that you always can, and should, demand more from services you pay for. Never reuse your password on different services. This will not prevent intrusions, but it will limit the damage when someone breaks into the system. You may still be hurt by a Shellshock-based intrusion even if you do this, but the risk should be small and the damage limited. Anyway, you know you have done your part, and its bad luck if an incident hurts you despite that. Safe surfing, Micke   PS. The best way to evaluate a service provider’s security practices is to see how they deal with security incidents. It tells a lot about their attitude, which is crucial in all security work. An incident is bad, but a swift, accurate and open response is very good.   Addition on September 30th. Contrary to what's stated above, Mac computers seem to be affected and Apple has released a patch. It's of course important to keep your device patched, but this does not really affect the main point of this article. Your cloud content is valuable and part of that may be on vulnerable servers.  

Sep 26, 2014