A look at one of Lower Merion School District's evil spying laptops
An anonymous source let me use one of the Lower Merion School District laptops earlier tonight. My mission: to determine if the web cam could be turned on or off manually, or if I could access logfiles verifying whether the webcam was used or not.
I didn't bother taking any pics of the web cam itself, since the student smartly covered it with tape, and I didn't feel like getting my face on LMSD's naughty little camera.
Note that there appears to be no way to actually control the webcam from the machine itself. That means that if someone were to turn on the camera itself, it could not be turned off by the student. That's scary. (Anybody know of another way to control the camera? Let me know!)
On a related note, there is a microphone in the laptop. This can be turned all the way down:
However, if the machine can be accessed remotely by the school district, since the microphone is controlled by software, there is no guarantee that it could not be turned back on. And unlike the web cam, there is no LED that goes on when the microphone is in use. Also scary.
My next task was to try and view the log files on that machine. Unfortunately, the application for viewing them was locked down:
The "Terminal" application was also locked down. My source indicated to me that it used to be accessible, until students figured out how to use the command line to get around the restrictions. (anyone with UNIX knowledge would not be surprised by this)
My final attempt was to try and boot the machine from a DVD so I could mount the filesystem and the hard disk and view the logs that way. Unfortunately,
In conclusion, there is no way to turn off the webcam, nor any way to be certain that the microphone is not recording. This is a serious privacy risk and I cannot recommend the use of the laptops at this time.
For a future article, if I can get my hands on an LMSD laptop for several hours or more, I intend to fire up a packet sniffer and see just what hosts the laptop talks to, and create some nullroutes for those hosts that can be set up on any Linksys or Cisco router. Stay tuned!
Doug works as a software engineer for hire by day, and does system administration for a hobby, including that of the SAC website. Visit him on LinkedIn at http://www.linkedin.com/in/dmuth.
[Edit: Fixed remark about Extensible Firmware Interface. Thanks, Jeff!]