Post #2438369

@jik@federate.social Yeah, does look to be IR based on the output. It just seems very unusual to provide the illusion of privacy with hardware right next to it. I haven't got a Windows version to test with but it equally there's a lot of privileged software that would be able to get to it just fine. From the legitimate sources, I doubt there's much specific logging if your SOC decided to bring it up remotely (nothing in directly in Elastic, Helix or Sophos comes to mind... Maybe Sysmon output). From the not so legitimate sources, LPE on windows is not treated particularly critically and are pretty common. eventvwr and razor keyboard driver installers both had longstanding "easy wins", to mention the myriad of opportunistic dll highjacking. The solution for all that would be for the privacy switch to actually just work as one would expect it too, even if it inconveniences windows hello.