Do not let the trivial webcam turn into security disasters

Last year, Mark Zuckerberg, has incidentally revealed the simple security measures he takes to secure his MacBook: webcam and mic covered with tape. In short time, the story was covered by many news outlets, drawing everyone’s attention to the security issues. Many asked themselves why he would do such a paranoid thing. Is Mark’s fear of being seen and listened justified? If we think about the possibilities of exploiting webcams, and the fact that there’s even the smallest chance of being watched or heard without our permission, then, Mark’s concerns are totally legit. Taking into consideration the level of success of its business, he has been probably the target of many cyber attacks attempts.
Just imagine yourself sitting home, having a glass of wine and working on your laptop in your pajamas when suddenly your webcam light starts to blink, recording every little thing you do. Or even worse, having an important work meeting with important clients and partners, discussing financial information and someone is using your webcam and microphone to record everything from your laptop. Sounds pretty scary, doesn’t it?

How can webcams and microphones be exploited?

Phishing

With accessible tools and phishing techniques, hackers can easily hijack webcams, without your knowledge. Gone are the days when hackers were just a small group of high skilled persons that had advanced technology knowledge. Today, becoming a hacker is much easier than you think. From curious teenagers, jealous partners, detectives or just noisy persons, many can easily become a hacker.
Phishing emails are one of the most used techniques. Tools like Meterpreter, with a built-in module for controlling the remote system’s webcam, allow hackers to control the webcam and capture snapshots with it, after getting the victim to click on a link to a malicious website, send a malicious Microsoft Office document or Adobe Acrobat file or more.
The good news is that an attacker can’t simply access any webcam at any time. They first have to scan a network for vulnerable operating systems to infect them with a Trojan. Once the Trojan root kit is installed on the victim’s computer, hackers gain physical access to the computer, gaining its control and spying on its webcam.

RATs

Software like RAT’s (Remote Administration Tools), are usually being used in corporate environments to help configure and track machines remotely, but malicious individuals can use them for other purposes. Once a RAT has been installed, a hacker can sell to anyone access to its compromised webcam to secretly watch or record everything. DarkComet, Black Shades, are just some examples of RAT tools that have been used in webcam hacks. But our purpose here is not to offer an exhaustive list of methods or tools used to exploit webcams, microphones or other computer ports. We want to make you aware of what to stay out of – e.g. phishing e-mails – and, most importantly, what other measures you can take to avoid being the victim of webcam and microphone spying.

Webcam and microphone security

Most solutions you can use are not specifically designed for webcam and microphone security, but rather for computer and data security in general. Therefore, any technical solution has to be accompanied by a certain user behavior or best practices when it comes to working with certain applications or technologies.

• Keep your antivirus updated – for the sake of your company information security and employees’ data privacy, make sure the antivirus is up to date to catch all forms of malware that can be used to get access to webcams and microphones
• Avoid clicking on suspicious links in e-mails, websites, or apps – pay attention to the links you receive in e-mails; it’s easy to see if they are harmless by hovering with the mouse on top of them and see the URL, if it corresponds with the sender’s domain. Here we described more in detail how phishing looks.
• Do not connect to unsecured WiFi – they are available everywhere, from restaurants, train stations, hotels, airports, to town squares, and malls. People’s constant need to be Internet-connected has blinded many of them in the face of the risks, making them vulnerable to attacks that take different forms.
• Keep software and operating systems up to date – to be sure you have the latest patches with fixes for vulnerabilities and avoid attackers to penetrate your system and take control of it.
• Pay attention to your camera LED – this is a simple way to tell if the camera is on, even though you didn’t activate it; however, you shouldn’t rely too much on this, because many hackers have figured out how to control that too.
• Update cameras’ firmware – regular updates installed from the manufacturer’s website eliminate weak spots that can be exploited
• Use slide covers – they come with many computers by default and they are more traditional solutions, but they seem to do the trick for individuals like Mark Zuckerberg, the FBI Director, James Comey, and according to James, all government offices in US use a lid to cover web cameras.

We are living complicated times, with technology deeply integrated into our lives, making them easier, more interesting and, unfortunately, more vulnerable. If we fail to understand the risks, we will surely fail also in fighting them. Webcams, microphones, wearables, etc. are some of the most trivial devices or gadgets we use and, at the same time, able to invade our most private aspects of our lives. Therefore, the effort to respect the above security measures is small compared to the implications of a possible hack. Just think about that when you have your next video call.