Covering webcam can get peace, not security

You can’t stop hacker from getting access to system’s cam ■

Webcams, over years, have presented a security liability for years and it continues to do so, yet many of us don’t cover them up. Should we?

Last week, WSJ’s Joanna Stern posted a piece in the Personal Tech column that pondered an interesting question related to the cameras that are now embedded into modern laptops — “How secure are these tiny eyes into our private lives?”

He wrote, “The bad news is, it was possible for Mr Heid (a certified ethical hacker and chief research and development officer at Security Scorecard) to get into my Windows 10 laptop’s webcam and, from there, my entire home network. He also eventually cracked my MacBook Air.”

“The good news is that both operating systems were initially able to thwart the hacker. It took me performing some intentionally careless things for him to ‘succeed’.”

This is where the narrative starts to fall apart. In fact, the hoops that Stern had to go through to allow the “hacker” access to a Windows 10 machine were quite detailed. Stern even goes as far as admitting to having “played along” with Heid’s requests. It’s only a few steps short of a hacker asking the victim to mail them the laptop, making sure to write the login password on a postit note, he wrote. Well, short of taking a screwdriver and wrenching the camera out of the laptop’s bezel, won’t be able to prevent a hacker gaining access to the system’s camera when someone so compliant is at the wheel.

If someone is willing to download this, install that, and disable the other, it’s like the hacker is sitting at the keyboard, and pretty much has free reign over the system.

For enterprises that hand out laptops to all and sundry, this is where educating users about risks, about not ignoring warnings, and maybe not being so compliant when dealing with random folks remotely who ask them to disable stuff pays off dividends.

Maybe there is also a case for having laptops that don’t have cameras installed, and to use detachable USB cameras where needed. But that only removes one attack surface. There’s nothing stopping the hacker from just asking the oh-so amenable user to just email them the information they want.

The piece does go on to make some sensible recommendations in relation to password usage — which can be distilled down to “don’t reuse passwords, and change ones that have been compromised” — which helps to accomplish a lot more than covering a webcam camera does.

If covering your webcam camera makes you feel better, go for it.