About a week ago, New York Times cybersecurity writer Nicole Perlroth posted this gem of an article, where she suggests in total seriousness that, in the interest of good online security practice, we should all be covering up our webcams with masking tape:
Within weeks, I set up unique, complex passwords for every Web site, enabled two-step authentication for my e-mail accounts, and even covered up my computer’s Web camera with a piece of masking tape — a precaution that invited ridicule from friends and co-workers who suggested it was time to get my head checked.
But recent episodes offered vindication. I removed the webcam tape — after a friend convinced me that it was a little much — only to see its light turn green a few days later, suggesting someone was in my computer and watching.
This is the first time I’ve seen a reputable source of information like the New York Times (coming from a purported cybersecurity writer, no less) advocate putting tape on your webcam to prevent webcam spying. (If she actually, legitimately had been spied upon through her webcam, then the fix isn’t to put tape on the webcam – the fix is to get the whole computer cleaned of malware.) I thought most readers would immediately dismiss this recommendation, but apparently they didn’t. In an update, Perlroth writes:
Finally, many readers (and even my editor) said that after hearing about my own harrowing experience with my computer’s webcam, they too were now covering their webcam’s lens with masking tape.
This is, categorically, absolutely, and unequivocally, a stupid thing to do. It’s the computering equivalent of sticking your head in the sand.
There are several good reasons why it’s such a stupid thing to do. Firstly, it’s because you might, y’know, actually want to use your webcam for Skype, or Google Hangouts, or Facebook video chat, or Facetime, or whatever. It will get annoying very quickly to have to constantly apply and remove bits of tape from your webcam. (My roommate suggests that if you insist on covering up your webcam, it’s probably a better idea to use a sticky note instead, which is easier to attach and remove as necessary.)
Secondly, your webcam should not be your main concern when it comes to “being hacked” – nor is it a priority for the vast majority of malicious parties. Think about it – what does the attacker gain from staring at a grainy video of your face while you write a paper or check your email? Unless you have some creepy stalker who is trying to spy on you via webcam (in which case taping up your webcam is really not the best way to solve that problem either – calling the police is), there are very few reasons for a malicious party to want to spy on you via webcam. Your face is probably already publicly available somewhere – more likely than not on Facebook. Even if it isn’t very hard to hack a webcam, malicious parties could be out there exploiting SQL injections and cross-site scripting and phishing and pharming and doing all sorts of other nasty things that have more chance of returning a profit. If a script kiddie can exploit your webcam, he can exploit other things too – and the chances are that he’ll be more interested in money than staring at your face, attractive though that may be.
If your webcam indicator light turns itself on when you don’t expect it to, it’s probably just because you left something running or opened an application that wants to use the webcam. You might have forgotten to close the Skype options window and lost it behind all your other windows, for example, or you might have left your Google video chat settings open, or you might be using an app like Flutter that uses the webcam, and so on. Don’t freak out.
Most importantly, if your webcam is still turning itself on and you’re certain it isn’t any of the above possibilities, that’s a pretty good indication that something’s gone horribly wrong. You’ve clicked on some malicious web link that gave someone data or permissions or access they shouldn’t have, or your firewall or antivirus or antimalware or something has catastrophically failed. Whether you’ve made the mistake of downloading something sketchy or you just don’t have adequate security software installed, someone already having access to your webcam means that it shouldn’t be too difficult to gain access to other parts of your computer – including more valuable things like passwords and private data.
Now, if this does happen to you, wouldn’t you want to know about it? Most attackers wouldn’t be nearly as nice – they’d just break in and try to cover up their tracks as cleanly as possible, so as to steal your data without you even noticing. Turning on your webcam and displaying an indicator light is a pretty good way to blow said attacker’s cover, so if your webcam has indeed been hacked, you might as well be thankful that you at least have some warning that something’s seriously wrong with your computer. It’s a lot more immediately noticeable than, say, a covert keylogger installation or a silent background service that sends files to the attacker.
There is absolutely no good reason to cover up your webcam with tape – and if you happen to have tape over your webcam right now, take it off. If your webcam starts turning itself on and off and you’ve double checked that it’s not just you doing it by accident, you might want to entertain the possibility that there’s a serious intrusion into your computer, which you should get fixed as soon as possible. And, if it turns out to be relevant, you should probably also obtain a restraining order against your stalker.