Quick! Name your favorite animal. (I seem to favor the crocodile.) How about your least favorite animal? For my oldest son, the answer is dogs. My neighbor is petrified of spiders. My daughter dislikes stinkbugs. However, no one in the family has a more distinct dislike for a species than my wife’s hatred for rodents, specifically mice. Maybe it’s their appearance: furry, fast(!) critters with two identifiable incisors; perhaps it is their elastic ability to fit through tiny spaces, or maybe it is just that they’re everywhere (they inhabit every continent except Antarctica). Whatever it is, rodents be warned! We make every effort in preventing your presence in our house and you are not welcome here!

Whether it’s an animal, a movie, or a _________ (fill in your pet-peeve), we all have certain hot-button things in life that bother us. This is also true for me when it comes system/device features, and the one that is my least favorite is the web camera. I fully understand that for many the webcam is an essential feature that provides additional opportunities including the ability to face-time with friends and loved ones. Webcams make corporate remote video conferencing possible, and from an entertainment perspective have allowed the capturing and publishing of amusing home videos. However, as a security professional, I also understand the grave dangers webcams pose.

According to our most recently released Thirtyseven4 statistics, on average, our Thirtyseven4 solutions detected over 180 million pieces of malware over the last three months: that’s over 2 million detections daily! Of those millions of malware detections, nearly 40 percent fell under the malware classification Trojan. A Trojan is a form of malware that hides its true intent from the unexpecting victim. For example, an unknowing user may receive an email that was spoofed to appear as if it was sent from a Google employee, but that contains a Trojan file attached that masquerades itself as a Google Chrome Update to an unsuspecting user. While Trojans are developed and released to perform many malicious tasks: one common type of Trojan is a Remote Access Trojan (or RAT —  are you correlating how the dislike for rodents runs in the family?). Once installed, a RAT allows an attacker complete control of the system it is installed on, and just one of the many compromising functions that can be performed would be webcam spying. And like its mammal counterpart, a RAT can stealthily hide for weeks, months or even years unnoticed until eventually the damage has been done.

While webcam spying software can be purposely installed on a system (think a parent or ex-boyfriend/girlfriend), most of the time they get installed mistakenly by users tricked into clicking a link or opening an attachment within an email. They can also be bundled together with other freeware or by visiting a compromised website. Regardless of how the spying software gets installed the damage can be irreversible. It would also be important to make note that this isn’t just an issue on Microsoft Windows systems but also problematic on Mac OSX systems and an exponentially growing problem on mobile devices.

With the inherent risks that webcams pose, it would be wise to educate ourselves on how to prevent a RAT compromise from occurring. I have included some tips and recommendations to help with webcam safety.

1. Use common sense (and dignity!) when within the scope of your webcam. Seems easy enough but it may be the hardest tip of them all for some users. For example, if you are acting or behaving in such a way in front of the webcam where you wouldn’t be comfortable with your parents or children or the whole world seeing: I urge you (in your own best interest!) to consider your actions and/or words.
2. Think about the location of your webcam. If you must use a web camera, it probably would not be prudent to have it placed in your bedroom or pointing towards a bathroom. Also, be careful that the background area isn’t exposing your location to potential online stalkers.
3. Don’t open attachments from unknown sources or click on links embedded in emails or on social media sites. I mentioned this point a lot but there is good reason. Despite many of the criminal advancements’ attackers use to proliferate malware, the use of spam email is still the #1 source for malware infections including spying software. (People keep clicking on them to open them!)
4. Install strong anti-virus and security software and keep it up-to-date. Most antivirus/antimalware scanners are developed to actively detect and proactively prevent RATs and other forms of malware from penetrating a system.
5. Keep your OS and other 3rd party software applications up-to-date.
6. Download apps only from trusted sites (i.e. Google Play, Apple Store). However, even when downloading from these locations be sure to read through the reviews and verify the publisher of the app. Did you know? There is a growing trend of fake or malicious apps made available for download through Google Play.
7. If you are using an external web camera, unplug it when it is not in use. Simply disabling is not enough, especially if someone has gained remote access to your system.
8. Disable your built-in webcam when not in use/Cover It! As a reminder, if your system is compromised, your webcam can be re-enabled remotely. See all the points above. Best practice would be to place a piece of electrical tape (or something similar) over the camera.

Cameras seem to be the new focal point and hacker-playground for cybercriminals. You may not want to know this, but webcam security on PCs and phones is only the tip of the security-iceberg with cameras. Stay tuned in coming months when we will delve into the risks associated with the use of cameras on home security systems and GoPro cameras.