21

My privacy feels invaded by the "active" light on my webcam turning on when I boot Ubuntu, and again when I login. It stays on for 3-4 seconds, then turns back off.

It's a Creative HD 1080p webcam that sits on top of the monitor, plugged in via USB.

Nick Charney Kaye
  • 652
  • 8
    Why don't you just unplug your webcam when it is not in use if you are worried that somebody is using it to spy on you? Or put some tape over the lens or something? –  Feb 22 '15 at 19:00
  • 10
    The thing really to be more worried about is if someone is spying on you using your built-in microphone (if you have one) because it does not have a little green light to tell you when it is on, thus you will never know if you are being listened to or not. –  Feb 22 '15 at 19:07
  • 1
    Can you please add some details about your system, What version of Ubuntu is it, who installed the system and how old is the install. – squareborg Feb 22 '15 at 19:49
  • 4
    How can you be sure that the light on the webcam indicates that it is sending the video stream somewhere? In my experience, it might just mean that the webcam is being initialized. You should check with the tech specs of the camera to see what the light may or may not indicate before assuming the worst case. – user1306322 Feb 22 '15 at 21:43
  • 1
    The LED is hard-wired to the image sensor's power and the sensor is only powered when the cam is actually capturing video, so there is definitely something to worry about. To confirm my theory you can try the cam on another (supposedly clean) machine and see if you can reproduce the behavior. –  Feb 23 '15 at 04:55
  • 1
    @AndréDaniel you are wrong. And please provide proof of a webcam being able to send images during a boot sequence. As far as I know this is IMPOSSIBLE. Don't feed unfounded paranoia please. – Rinzwind Feb 23 '15 at 08:01
  • 1
    @Rinzwind there is nothing complicated in making a script that records through the webcam and make it run as early as possible at boot, way before the desktop environment is loaded. –  Feb 23 '15 at 08:02
  • 1
    @AndréDaniel prove it; And please also provide a method in installing it on her system without he knowing about it. – Rinzwind Feb 23 '15 at 08:04
  • 1
    @Rinzwind prove it put this ffmpeg -f v4l2 -s 640x480 -i /dev/video0 /path/to/output.mpg in some init script or systemd service (if Ubuntu uses this) and enjoy; this can run early at boot and doesn't even depend on the desktop environment being loaded. Also the fact that the cam turns on two times is even more alarming; an eventual initialization routine would only be executed once when the USB stack enumerates the device, not two times. To me it looks like some program (without root privileges) runs each time the user logs in and takes a picture. –  Feb 23 '15 at 08:15
  • 1
    Wont work. ffmpeg is NOT Installed. even worse: ffmpeg is no longer a valid packages in Ubuntu. I am ending this conversation; anyone: feel free to drop into ubuntu chat (20+ rep needed). – Rinzwind Feb 23 '15 at 08:16
  • 3
    @Rinzwind the attacker would need access to the machine to do that, and if he has access then he can very well bring his own ffmpeg binary along. Anyway I proved my point, and I'm just saying that if my webcam ever lights up like that I'd suspect a compromise and won't be satisfied until I find the process that's activating the cam. Saying "it's normal" without any proof is too big of a risk. By proof I mean whether that cam has the same behavior on other machines. I'm not going to waste my time arguing, bye and have a nice day. –  Feb 23 '15 at 10:08
  • 2
    Thank you @AndréDaniel "Saying "it's normal" without any proof is too big of a risk." - The bottom line is, a motivated attacker certainly could manipulate the machine to photograph-and-transmit an image of the person sitting down to use it. Why anyone would launch such an attack is pure speculation, but the matter of importance to me is: How might a user investigate for themselves whether their machine was behaving maliciously, using the tools available in their Ubuntu installation? – Nick Charney Kaye Feb 23 '15 at 15:35
  • The answer I'm marking as officially correct is, "We can confirm this behavior occurs with a clean install." THAT SAID, I'm always keen to educate myself on exactly how to confirm on my machine that there are no un-clean processes interfering with the default ones. – Nick Charney Kaye Feb 23 '15 at 15:45
  • @nickckaye to check you can use lsof /dev/video0 while this happens (you have to time it right or make a script that runs it in a loop and logs to a file, and make that script run as early as possible at boot). –  Feb 23 '15 at 18:46

3 Answers3

19

What is watching me?

Nobody. Without any proof (I did google for it a little bit): I seriously doubt that a webcam can transmit a stream to the outside world before the desktop is active. It would be very complicated to make software to do that and it would require you to install it yourself.

And why does this happen?

It is the device being detected by the system. First when the USB system is started the camera gets powered up it will tell you by flashing the light. And the second time will be due to the program that is started during boot to use that webcam (that will probably be the program "cheese" or "skype") that checks if it can find a camera. That again triggers the light to flash.

If you want to get rid of the second one: disable the program to start at boot time and start it manually when you want to use the webcam. If it is indeed during login check "dash", "startup applications" and check for programs that can use webcams; if there is one you could disable it there.

If you want to get rid of the first one you probably need to unplug it before booting (that will also get rid of the second time). As soon as you plug it in it will flash when the webcam gets detected by the system.

Some independent topics related to this (and not per se Linux):

Use common sense. if it always flashes during boot and always at those two specific moments with every boot I would expect this to be normal behaviour of that webcam.

When you need to worry about it flashing is when it flashes during normal operation; When you are using your computer and not using the webcam. If it flashes then you should investigate this.

Dessa Simpson
  • 717
Rinzwind
  • 310,127
  • I have a Logitech usb web cam, at no point during boot,login, or connecting device does it light up, only when the camera is actively capturing does it light up. – squareborg Feb 22 '15 at 19:48
  • Have you tested? – squareborg Feb 22 '15 at 19:50
  • 1
    @Shutupsquare it could be worse; I once had one from MS that did not stop blinking -ever-. – Rinzwind Feb 22 '15 at 19:55
  • 2
    I LIKE that it blinks when probed. Say you had some super-advanced thing that skipped the whole v4l2 layer and just tried to grab the webcam memory directly. I'ld like it to blink... I wouldn't run about whining about it. – RobotHumans Feb 22 '15 at 19:56
  • 1
    @hbdgaf How could you tell if someone is watching you, or your OS is just probing what's on the other end of the USB bus? – squareborg Feb 22 '15 at 20:10
  • @Shutupsquare I would use common sense; during boot this webcam flashes at specific moment and always at those 2 specific moments. But if you want to make sure you unplug it. The light -not- flashing in itself is not proof that nobody is watching. Not every webcam does flash. Some webcams you can even disable the flashing remotely. – Rinzwind Feb 22 '15 at 20:14
  • Going to clean up my comments. – Rinzwind Feb 22 '15 at 20:16
  • @Rinzwind Sure I know that you can bypass the flash on some camera's ( this is to me a design flaw. ) the light should be a clear indication that the camera is actively capturing and should only be allowed to be switched off by a hw switch. – squareborg Feb 22 '15 at 20:21
  • 1
    This answer is wrong. I've never seen a webcam light up during initialization (the LED is hard-wired to the sensor's power, so it lights up only when the sensor is powered and captures video, it has nothing to do with the camera's microcontroller initializing). If the LED lights up it means a process is accessing it, whether it's malicious or not we don't know yet. –  Feb 23 '15 at 04:54
  • 2
    @AndréDaniel "I've never seen a webcam light up" I have. Nath has. Several ppl in Ubuntu Chat have. I provided 2 links that state it happens. Your just have not seen enough webcams. – Rinzwind Feb 23 '15 at 08:06
  • @Rinzwind do they also light up the same way when booting Windows ? It may not be malicious (and just some program accessing the cam's device node to check something) but I still stand on the fact that the cam is indeed capturing something and not just initializing. Whether those pictures are actually saved somewhere or not is a different story. –  Feb 23 '15 at 08:20
  • @AndréDaniel see the 2 links I provided (1 includes Windows). – Rinzwind Feb 25 '15 at 06:04
  • It could be a biometrix program, like fingerprint login, using webcam to verify facial features. That is if you have such biometrix aps installed! – Ken Mollerup Feb 25 '15 at 15:35
  • +1 @RobotHumans point keeps resonating for me; now I appreciate hardware that confirmation-blinks when probed on boot. – Nick Charney Kaye Jul 19 '16 at 03:50
  • Why does this have to happen with Ubuntu but not with Windows? This answer doesn't address that. – user453441 Jul 16 '22 at 18:21
  • @user453441 why do you assume it does not? It depends on the webcam, and there are webcams you can disable this, or need to enable it. Also see the links in the answer. Plus you got 1 thing wrong: we are not providing answers for windows :) – Rinzwind Jul 16 '22 at 18:52
  • @Rinzwind Windows 10 does not light up the Logitech c170 webcam on boot, whereas Ubuntu 20 does. I am not assuming that, I have tested it. I didn't ask about Windows, I asked why Ubuntu does it when Windows does not. Your comment is dismissive and not helpful. Finally, I know it is almost certainly nothing malicious, but there hasn't been any actual answer explaining what is truly happening and why, only speculation. – user453441 Jul 18 '22 at 05:00
5

I can confirm this happens on a clean install of Ubuntu and MINT. It doesn't matter which desktop you are using. Don't worry about it.

P.s I have a logitech webcam too. Nothing to do with branding here.

Nath
  • 51
0

Take a look in /dev/ folder, you will find a file which is /dev/video0. This is your webcam. In order to appear there, in the list of all devices, udev will need to initialize it somehow. That's why it blinks.. Then it's basically just hanging around there in the wait state until cheese or some other program needs to access it, which is when the light will become constantly on.

Same occurs every time I plug mine in - it blinks once. Why does it do on start up and shutdown ? Because the script for the service udev (which is in /etc/init.d/udev, by the way) runs on shutdown and startup, to bring devices up and down.

Sergiy Kolodyazhnyy
  • 107,880
  • What about my weird camera where the light remains on until the first usage, and only when that first usage actually finishes it turns off? How can I work around that, besides blacklisting uvcvideo? – Paul Stelian Oct 07 '18 at 10:33
  • 1
    @PaulStelian Well, you could "simulate" first usage - there's way to script taking a snapshot with webcam, so you could have a script that waits for webcam to appear in device list, take snapshot, and dispose of it. But that's just a workaround. I'd recommend asking a proper question on the site and maybe someone can help troubleshooting it. – Sergiy Kolodyazhnyy Oct 07 '18 at 10:43