On and off for two weeks, spurred by quirky stories about cracked MacBook screens, I tried to answer a simple question: Should everyone cover their webcam when it’s not in use, so you can’t be spied on?
Here’s the short answer: You should, when feasible, cover or disconnect your webcam when it’s not in use. Why? The slightly longer TL;DR version:
- Security professionals use webcam covers.
- Webcam hacks have happened many times before, to cameras that supposedly couldn’t be activated without an indicator light showing.
- The solution can be as simple as a little piece of tape.
- If someone discovered a webcam vulnerability for MacBooks or other devices, you might not hear about it for a long time, while bad actors sell and make use of it, and Apple works at its own pace to patch it.1
- Even if you think the view from your laptop or monitor is boring and benign, webcam access can be used to elevate a hacker’s access or facilitate other kinds of attacks through social engineering.
- Even if the indicator light turns on when your webcam is accessed, you might not notice it, if it only periodically turns on for a few seconds at a time.
Besides those rational arguments, think of it this way: when you physically cover your webcam, you’re never left wondering if your video will turn on right away when you enter a Zoom call, uncertain of your hair or what’s behind you.
Why are we talking about webcam covers right now?
We got pulled into this weighty topic when images of MacBook screens cracked by cheap covers started showing up. The screens were cracking because people had webcam covers adhered to their MacBook displays. When closed with enough force, the screens are damaged. Apple states this is because “the clearance between the display and keyboard is designed to very tight tolerances” (which is annoyingly true). Apple also says that, as an alternative to a camera cover, you can rely on their indicator light and app-by-app camera security settings.
We’ve received requests from a couple media folks to take apart a MacBook display, trace the circuits inside, and firmly prove or disprove Apple’s official don’t-need-one stance on webcam covers. We are not going to do that. For one thing, circuit-level schematics for the newest MacBooks are not floating around; we checked with a couple board repair technicians, and they don’t have them either. Secondly, chasing signals around the traces on a multi-level board is challenging, and not likely to turn up any big “A-ha!” revelations. Third, the webcam’s security could be based on its deep integration with its T2 chip; that’s another layer into which we have no entrance.
We think you can give Apple’s always-lit-up-indicator promises the same value as any hardware manufacturer claim: it’s unbreakable until someone breaks it.
How people can get to your webcam
The idea that someone could look through, or record, your webcam without your knowledge is not an internet myth. Remote Access Trojans (RAT) have been circulating online for at least two decades. Communities of hackers use them to spy on and extort women; a former Miss Teen USA was once a victim. Among Edward Snowden’s revelations and leaks was the knowledge that intelligence agencies had developed means of monitoring computer webcams without any notification to the user. This surveillance capability is confirmed in anti-terrorism investigation documents.
Apple’s webcams, previously labeled “iSight,” were once compromised in exactly this worst-case way. While Apple claimed that iSight cameras could not turn on without the indicator light, the hardware-level controls for the camera were controlled by system-level firmware, which could be rewritten with malicious software. You can read more about “iSeeYou” at Johns Hopkins University.
It’s worth noting that Apple’s vulnerabilities, the peak of RAT-based invasions, and Snowden’s claims all date to 2013. It’s also worth noting that remote-access hacks are still around, that surveillance agencies still utilize little-known software exploits, and that camera firmware is many lines of code, written by fallible humans.
Finally, a less obvious way that someone can gain access to your webcam without your knowledge is if you disable its indicator light yourself, intentionally or accidentally. USB webcams, like Logitech’s popular line, sometimes contain options to turn off indicator lights. One of the stated purposes is so the owner can then use the camera for long-take video or surveillance. It makes sense, but it also adds another layer of software that can mess with your webcam, should the wrong person get access.
Why it’s not paranoid to cover a camera constantly pointed at you
I bundled up all these conflicting findings and ideas and brought them to an interview with Jean-Phillipe Taggart, Senior Security Researcher at internet security firm Malwarebytes. I started off by just dropping onto his therapist’s couch and telling him everything bothering me.
Isn’t a webcam cover or tape a kind of security theater, because if someone’s got that kind of access to my system, I’ve got much bigger problems? Are webcam covers another false sense of control pushed on workers by enterprise vendors? Or should we just trust Apple and other companies when they say, if the camera is on, the light is on, because being found out to be lying about that would ruin their reputation?
After listening to a person he’d just met on a video call unwind his self-doubt for 3 minutes, Taggart responded. “I use a webcam cover,” he said, “or sometimes tape.”
Taggart used to work in IT and security for other corporations. He’s seen the ways in which systems can be owned entirely without the user knowing. One time he disabled a suspicious application on a system brought in for service, only to have a messaging app pop up with a question from an interloper: “Why are you doing this?” Another time he ran nearly every security tool he knew of on a system, finding nothing. He eventually discovered a fake video driver (ATI, on a laptop with onboard NVIDIA graphics) that provided high-level access to the system.
Taggart, in other words, does not believe that people will always notice when something is wrong.
With a cover, or tape, “I don’t have to worry, I just disable it. Now I’m not operating under a false sense of security,” he said. “That guarantees me that, no matter what, somebody’s not going to film me and my girlfriend laying down and watching Netflix.”
Even better than Mac-breaking covers or tape, Taggart says, are built-in tools for restricting access to recording. Most modern ThinkPads and HP EliteBooks have webcam shutters built into their display bezels. Some laptops have physical switches that cut the power to webcams, microphones, or wireless signals.
Mark Zuckerberg once covered his webcam and headphone jack with tape. Former FBI director James Comey is a tape fan. Taggart noted that at least one notable penetration tester he knows uses tape on their webcam. “I’ll tolerate being called a tinfoil hat for having tape on my laptop, for the security of knowing it works,” he said.
I’m sold. What kind of tape or cover, though?
This is a good question. If you don’t have a physical webcam cover or shut-off switch built into your laptop, you’ve got a few options. I asked our tech writing team for input.
Higher-quality electrical tape or masking tape are good places to start. Electrical tape’s upside is that it can be stuck, re-stuck, and removed many times over a long period. Ask me, a person who has worked with a lot of ancient wiring in his house’s walls. The downside of electrical tape is that, when it gets hot, its adhesive gets quite gummy. This will be more of an issue with some laptops (and climates) than others, but generally, the webcam mount near the top of a display is not a location that gets too hot.
If you have good masking tape at home, you can avoid getting adhesive on your camera lens cover by hole-punching some paper to slide over the camera. You could even fold one of the tape edges over for a convenient peel-tab. “Probably getting too elaborate,” wrote one techwriter, forgetting where they worked for a moment.
Washi tape is another go-to webcam cover. It’s thin but hard to break, it’s not too expensive, and, best of all, you can probably find the perfect washi tape to match your color scheme, personality, or feelings about web meetings. Parts Testing Assistant Lead Megan Costello uses washi tape on her (admittedly older) MacBook with no problems. Pictured below are the roll of tape still left after seven years of cover-ups, and the view from inside Megan’s MacBook when the tape is in place.
If you wanted to buy or use a stick-on webcam cover for your laptop, be sure to check the requirements of Apple or other manufacturers. Apple wants covers of 0.1mm or less; many popular models we saw on Amazon advertised being thinner than 0.1 inches, which is not the same thing at all.
If you’re using a USB webcam at a desktop computer, your solution is probably right in front of you: unplug the webcam when it’s not in use. If the plug is hard to reach, consider adding a USB extender cable. It’s worth it.
1 Thank you to William Entriken for pointing out this logical pitfall with vulnerabilities. ↩
13 comentarios
The article never addresses its own question: “Isn’t a webcam cover or tape a kind of security theater, because if someone’s got that kind of access to my system, I’ve got much bigger problems?”
None of these exploits can do anything unless you’ve already been infected by malware. If you’re at that point, then you’re vulnerable to a whole lot more than someone capturing video from your camera. Stealing financial records, recording keystrokes and ransomware are all a lot more disastrous and a piece of tape isn’t going to do a thing about them.
shamino - Contestar
@shamino - No, that’s not entirely correct. Hackers can hack into your system in many ways. Even government agencies take advantage of the ability to hack into tablets, phones, webcams, and laptops without any warning, or any way to even know it’s been done. They can also access your mic, so it’s always good practice to cover your cam, and if you can cover your mic, do that too.
Eric Patterson - Contestar
@Eric Patterson : I run all my MacBooks in clamshell mode, and when I want a webcam, I plug in my iPhone. Are u saying hackers have figured out how to hack that? The hack would have to be able to switch cameras on the Mac, and that's something that even Microsoft can't figure out how to do using Skype… so ur telling me that hackers can do this with no other access to my Macs than an internet connection? I'm afraid I'm calling bull on this one…
herojig - Contestar
I use the sticky part of a Post It note on all my MacBooks.
ghostdancertwoone - Contestar
All this seems so complicated. Post-It Notes for the win!
Tiffany - Contestar