Matt OrganFeb 6

A friendly reminder to never trust manufacturers privacy protections.

I was recently attempting to get an external camera functioning, so I started polling various video devices sequentially to find out where it appeared and stumbled across a previously unknown (to me at least) camera device, right next to the regular camera that is not affected by the intentional privacy flap or "camera active" LED that comes built in.

I had always assumed this was just a light sensor and didn't think any further about it.

The bandwidth seems to drop dramatically when the other camera is activated by opening the privacy flap, causing more flickering.
This was visible IRL and wasn't just an artifact of recording it on my phone.
I deliberately put my finger over each camera one at a time to confirm the sources being projected.

A friend of mine suggested this may be related to Windows Hello functionality at a guess but still seems weird to not be affected by the privacy flap when its clearly capable of recording video.

dmidecode tells me this is a LENOVO Yoga 9 2-in-1 14ILL10 (P/N:83LC)

Command I used for anyone to replicate the finding. (I was on bog standard Kali, but I'm sure you'll figure out your device names if they change under other distros):
vlc v4l2:///dev/video0 -vv --v4l2-width=320 --v4l2-height=240 & vlc v4l2:///dev/video2 -vv --v4l2-width=320 --v4l2-height=240

#Cyber #Security #Infosec #Lenovo #Privacy #Hacking

Show threadJonathan Kamens 86 47Feb 6
@Slater450413 Pretty sure that's an IR camera which is indeed used for facial recognition login. Covering it up with the flap would disable facial recognition, which is presumably why they don't cover it, but I definitely hear your privacy concerns.
One would expect the OS not to give unprivileged processes access to that video stream, and maybe that's how it works on Windows, but apparently not on Linux.
Show threadDave RahardjaFeb 6

@jik @Slater450413 The fact that the image is black and white suggests to me that yes, it’s an IR camera for facial recognition.

I think the presence of a privacy flap is the real problem here, because it gives the illusion of privacy. If the flap wasn’t there to begin with, this wouldn’t be an issue.

Show threadCake & Pudding 🌱Feb 6

@drahardja @jik @Slater450413

Exactly. The false sense of privacy is the main issue here. We all know an exclusive "windows-kernel level resource" will not stay exclusive for long if it's useful…

Show threadLaberpferd

@iwoakura @drahardja @jik @Slater450413
exactly what i say all the decades, if hardware is there then it WILL be used

Its only a hack, or a silent update away until someone has access to the camera, while you dont even knowing you are watched by someone

Feb 9 at 4:42pmWeb