I always thought people who covered their laptop cameras were delusional conspiracy theorists at best, or delusional narcissists at worst. Side-eyeing my friends and coworkers who'd shrewdly covered their webcams with stickers and bits of tape, I prided myself on having never quite reached the level of self-involvement where I thought some Russian hacker actually wanted to infiltrate my damn MacBook and watch me sadly scroll through fucking Into The Gloss for hours on end, while lying in bed in that weird upright horizontal position that inevitably ends in you accidentally dropping the entire computer on your own face.
But I am here to announce that, upon further research, I have changed my mind. I admit that, on this singular topic, I was wrong. Literally everybody should be covering their webcam while they browse. Ideally, we should be throwing all of our devices into the ocean. But at the very least, we should educate ourselves on webcam hacking.
Because it is real! It is happening. Say it with me: 1984.
IT COULD HAPPEN TO YOU
Webcam hacking is a totally real and everyday phenomenon, according to this recent research paper released by Washington DC-based cybersecurity think tank Institute for Critical Infrastructure Technology (ICIT). The research posits that, "Virtually every computer, smartphone, and internet-enabled mobile device has a camera and microphone that can be used by malicious threat actors to surveil and spy on the user. Using malware such as NanoCore RAT and Nuclear RAT 2.0, Cyber Criminals, Script Kiddies, and Nation State APTs can compromise devices and remotely monitor the activities of unsuspecting users and organisations."
The paper's lead author James Scott tells me that anyone is vulnerable. "Compromising webcams is pretty easy for even an unsophisticated hacker, so the motives and category of attacker vary some. Deplorable script kiddies may monitor children, teenagers, or certain adults. Cybercriminals might precision target specific people or groups of people for more financially motivated schemes. Geopolitically motivated adversaries might target government personnel in the hopes of capturing valuable data or audio," he says.
"Most average users, including journalists, CEOs, and other users, are of the opinion that covering webcams is extravagant or unnecessary because they do not realise how easy these attacks are to conduct or how vulnerable they are to unknown remote threat actors. Some who are aware of the threat continue not to act because they believe that they are not a valuable target when in fact, every target is valuable to some attacker."
NO REALLY THOUGH
Okay, so a bunch of IT experts writing a detailed analysis of what they consider one of the most underreported and prescient cybersecurity issues on the planet isn't enough for you to stick a Post It note over the webcam you literally never use? I've got some horror stories to inspire your walk towards the stationary cupboard.
In 2014, teen model and beauty pageant winner Cassidy Wolf discovered that hackers had been watching her via a laptop camera for more than a year.
"He was able to trace the keystrokes on my keyboard so he could learn my passwords and see what sites I was going to, and, creepiest of all, he was able to access my webcam 24/7," Cassidy later explained in an article for Teen Vogue. I used to keep my computer open on the floor of my bedroom to play music while I was studying, changing, going back and forth from the shower—he saw all of that." In 2014, Motherboard reported on a streaming website that allowed users to access private footage from hundreds of thousands of private webcams, in an effort to "expose" poor web security and create awareness about the importance of changing your password. In 2015, a Toronto woman was anonymously sent photos of herself and her boyfriend watching Netflix. There was nothing police could do about it.
But most webcam hacking doesn't get reported on, because most people have no idea they're being hacked—until the point they're asked to pay large sums of money in order to avoid footage of them enjoying a quiet, private moment on a mid-tier porn site being broadcast for the world to see on Facebook Live.
IT'S NOT JUST YOUR WEBCAM
You know what a webcam is. Look upwards, yeah? That little round circle. Real cute. Use it for Skyping your Gran, that sort of thing. Oh, what's that? You're…you're reading this article on your phone? Your smart phone with literally two cameras and no VPN or security installed whatsoever? Interesting!
For cybersecurity activists, vulnerable smartphone cameras are just as much of a problem as webcams—in fact, they're probably an even bigger issue. "Phone cameras are at as much if not more risk than PC webcams because most users do not implement fundamental security—such as antimalware, firewalls, VPNs—on their mobile devices and because so many mobile applications have permission to access the webcam. Each application could be poisoned with malware at download or later compromised," Scott explains.
So what can be done? Covering up your selfie cam with tape doesn't seem like the most practical solution. "Mobile users should download reputable anti-malware applications onto their devices. They should monitor which applications they download and they should question why certain applications request permissions to access the webcam, microphone, or other mobile assets," says Scott.
"Finally, users should cover their device cameras with convenient removable and reusable webcam covers that do not damage lens or leave behind an adhesive residue. Much of the inconvenience is mitigated when the cover can simply be slide out of and into place to facilitate mobile use."
THIS SHIT IS GOING TO GET WORSE, NOT BETTER
Manufacturers of laptops and phones have literally zero motivation to make their cameras less hackable. And until they do, you're going to have to get real familiar with those reusable covers.
"The threat is definitely increasing and will continue to do so until consumers act and until manufacturers are compelled to incorporate security-by-design throughout the lifecycle of their devices," says Scott.
"Consider that a few years ago, cell phones only had one camera, not two. Families did not have gaming consoles that recorded their every activity. In the future, more personal devices are going to actively record user activities, so consumers must begin to seriously think about how that could impact their lives and whether they want to take action to prevent remote monitoring from cyber-adversaries."
I did the Googling for you—cheap, reusable camera covers are available right about here.
Follow Kat on Twitter