Elektrine lite

← Feed

@Slater450413@infosec.exchange

Post #552441

2026-02-06 04:53 UTC

A friendly reminder to never trust manufacturers privacy protections. I was recently attempting to get an external camera functioning, so I started polling various video devices sequentially to find out where it appeared and stumbled across a previously unknown (to me at least) camera device, right next to the regular camera that is not affected by the intentional privacy flap or "camera active" LED that comes built in. I had always assumed this was just a light sensor and didn't think any further about it. The bandwidth seems to drop dramatically when the other camera is activated by opening the privacy flap, causing more flickering. This was visible IRL and wasn't just an artifact of recording it on my phone. I deliberately put my finger over each camera one at a time to confirm the sources being projected. A friend of mine suggested this may be related to Windows Hello functionality at a guess but still seems weird to not be affected by the privacy flap when its clearly capable of recording video. dmidecode tells me this is a LENOVO Yoga 9 2-in-1 14ILL10 (P/N:83LC) Command I used for anyone to replicate the finding. (I was on bog standard Kali, but I'm sure you'll figure out your device names if they change under other distros): vlc v4l2:///dev/video0 -vv --v4l2-width=320 --v4l2-height=240 & vlc v4l2:///dev/video2 -vv --v4l2-width=320 --v4l2-height=240 #Cyber #Security #Infosec #Lenovo #Privacy #Hacking

Replies (17)

  • @jik@federate.social Yeah, does look to be IR based on the output. It just seems very unusual to provide the illusion of privacy with hardware right next to it. I haven't got a Windows version to test with but it equally there's a lot of privileged software that would be able to get to it just fine. From the legitimate sources, I doubt there's much specific logging if your SOC decided to bring it up remotely (nothing in directly in Elastic, Helix or Sophos comes to mind... Maybe Sysmon output). From the not so legitimate sources, LPE on windows is not treated particularly critically and are pretty common. eventvwr and razor keyboard driver installers both had longstanding "easy wins", to mention the myriad of opportunistic dll highjacking. The solution for all that would be for the privacy switch to actually just work as one would expect it too, even if it inconveniences windows hello.

    Open ##2438369

  • A few people have pointed out the security separation being a point of difference in Windows but I do wonder if that actually exists or if is it just assumed? The hardware itself just presents as a regular camera with a regular generic driver, nothing special about it. The login screen context is certainly segregated context (has been Win2k, I think) but does anyone elevate to enroll their face under their own user context? I've never used Windows Hello, so my knowledge is quite dated but I don't belive fingerprint scanners do, which would be a similar mechanism where an abstract identity token from an arbitrary hardware device is created and stored without the need to elevate. Presumably you still need to authenticate to prove "you are you" when enrolling new methods but just no privilege escalation to use the hardware device for the capture itself.

    Open ##2438370

  • Well that was an unexpected twist. Dammit Physics! I decided to put some regular black electrical tape over the camera to block it whilst keeping a neat finish. Turns out IR passes straight through electrical tape 😂 I did consider whether its because of the adjacent backlight and so I tried blocking that too, however most of the rooms I sit in have enough ambient IR to not matter. I'm considering something more "glass like" since that seems to reflect IR much better but the seems a pain. Anyone else have a better solution they've found? Its probably at the point for me that its "good to know but can't be bothered" but there's just so many interesting and unexpected outcomes I felt compelled to satisfy my curiosity and share. #Cyber #Security #Infosec #Lenovo #Privacy #Hacking

    Open ##2438371

  • @jik@federate.social 2026-02-06 06:28

    @Slater450413@infosec.exchange Pretty sure that's an IR camera which is indeed used for facial recognition login. Covering it up with the flap would disable facial recognition, which is presumably why they don't cover it, but I definitely hear your privacy concerns. One would expect the OS not to give unprivileged processes access to that video stream, and maybe that's how it works on Windows, but apparently not on Linux.

    Open ##2438372

  • @troler@mastodon.online 2026-02-06 09:03

    @Slater450413@infosec.exchange My laptop doesn't even have one. So false security sense of security!

    Open ##2438375

  • @jaseg@chaos.social 2026-02-06 09:13

    @Slater450413@infosec.exchange that’s common to most modern business-y windows laptops. That’s an IR cam that windows uses for with a presence detection. It’s not supposed to be visible to applications on windows, and because of that privilege separation it makes sense to not have it covered by the shutter. Otherwise you’d have to open the regular cam that’s accessible to unprivileged applications as well every time to log in using face recognition.

    Open ##2438376

  • @ludrol@mastodon.social 2026-02-06 10:23

    @kkarhan@infosec.space @Slater450413@infosec.exchange @purism@social.librem.one I tried to find info about lidar but I don't see anything, only about infrared. I would be interested in turning a webcam into deapth camera if it would be even possible.

    Open ##2438382

  • @ranlvor@queerchen.de 2026-02-06 09:49

    @Slater450413@infosec.exchange I just tested it on the Lenovo T15 Gen 2. On this laptop the privacy-shutter blocks the IR-cam, too. And the IR-cam enables the little cam-is-on-LED, too. (And the privacy shutter blocks the little cam-is-on-LED, too which I dislike.)

    Open ##2438384

  • @tsherrygeo@m.ai6yr.org 2026-02-06 10:08

    @Slater450413@infosec.exchange a couple interesting articles about the IR technology. https://apnews.com/photo-essay/chinese-surveillance-silicon-valley-tech-photo-essay-2da6d9ae5c29d973955e761fa42f7798 https://apnews.com/article/2025-invisible-infrared-surveillance-technology-extraordinary-photo

    Open ##2438386

  • @exec@furry.engineer 2026-02-06 10:13

    @Slater450413@infosec.exchange That's the regular IR camera on modern (especially business) laptops. Used for authentication, eg. windows hello Weird that the cover is not affecting the IR camera part on the Yoga, it does cover it on the Thinkpad L14 G5. I didn't need VLC to open it, it works with the KDE built-in camera app "Kamoso".

    Open ##2438387

  • @agowa338@chaos.social 2026-02-06 10:18

    @Slater450413@infosec.exchange That's the IR camera used for things like Windows Hello to allow you to sign in without entering a password. Also the reason it is not affected by the privacy thingy is because on windows you're not able to poll the video from it. It doesn't show up as a camera device there if I recall correctly. On e.g. linux though...

    Open ##2438390

  • @dgrabla@mastodon.social 2026-02-06 10:26

    @Slater450413@infosec.exchange IR camera

    Open ##2438391

  • @mattesilver@101010.pl 2026-02-06 10:52

    @Slater450413@infosec.exchange product manager at lenovo: seems a legit compromise between security and convenience

    Open ##2438392

  • @crashlogger@mastodon.eus 2026-02-06 10:53

    @Slater450413@infosec.exchange My T490 does the exact same thing! I ended up painting the lens with a marker to cover it up. There was something different, howeve: I haven't managed to turn the IR illuminator on so I have never managed to get anything resembling a real image out of it. Just a bit of my silhouette

    Open ##2438394

  • @Slater450413@infosec.exchange With Lenovo, one can't help but to immediately wonder if this is deliberate for CCP reasons.

    Open ##2438395

  • @mike805@noc.social 2026-02-06 18:29

    @Slater450413@infosec.exchange I have one of those on my new ThinkPad. Yes it is an identity camera. It is IR only and a pulsed IR LED lights up your face when it activates. It shows up as one of the /dev/video devices in Linux.

    Open ##2438396

  • @jak2k@mastodontech.de 2026-02-08 16:14

    @Slater450413@infosec.exchange I just tried this out on my X1 Extreme 2nd gen. The IR camera is the same as the normal one on it. But there is another hole. It cold be some kind of IR led but i couldn't trigger it.

    Open ##2438397