remote webcam control

I just finished up reading The Art of Deception and he (Mitnick) spoke of software that remotely controls web cams and microphones.

I found this interesting because it would be a pretty easy way to monitor our computer rooms with out wireless technology. (don't trust wireless yet)
Don't worry, I'm an admin of the site we want to monitor and we've spoke with management about it too.

I have searched a bit and can't find too much on this software. All I can find it places to buy the cameras. I don't know too much about webcams yet... have to do some reading.

What I wanted to know:

Is the software he (Mitnick) speaks of a virus/trojan or a legitimate program?

I haven't heard of viruses/trojans with this ability.

I'm unsure where to look for the software.

I'm not so much concerned with microphones as with the web cams.

If anyone uses webcams for monitoring purposes, I'd be interested in hearing how you set them up too and for what you monitor. I have a couple of ideas, but still interested.

I'm also interested in how to secure these web cams.

Thanks for your help in advace!!

Ive seen webcams wit intergrated GNU-linux webserver/ controll servers inside.. all they need is power and a UTP cable..

I think I've seen them here, http://www.thinkgeek.com/computing/input/netcams/ but they are not cheap ;)

In theory, if you have a tojan installed on the pc which control the webcam you'll be able to receive informations and to send orders to it (as for any driver). But I have never heard of such abilities in current trojans. To construct it you would need a lot of knowledge about programming, drivers, and comunications.
In fact you may have to change the code of your trojan for each different webcam (I'm not sure, but I assume their is not only one universal webcam system). Or it could become a big generic program wasting all the ressources determining the configuration, the protocols...

Several years ago, when there were quite a lot of unprotected silicon graphics boxes on the internet, it was fairly commonplace for hackers to break in, and leave a process running which publishes pictures from the camera (standard on many SGIs for many years) on the internet, for their buddies to look at.

Being paranoid, I leave my SGI's camera almost permanently shut, even though I hardly ever turn the box on (it doesn't have wake-on-lan but does have a wakeup timer)

I have no idea exactly what they did, but I imagine it was just a cron job that runs some shell commands.

I would think a more serious risk would be mal-ware capable of audio recording, as people often leave mics attached to PCs (some have them builti-in, like laptops, some macs etc) without any hardware switch.

Serious things could be discovered by stealth recording from someone's mic.

Thanks for the info AO peoples! :)

I have been doing a little more reading on this and it seems that there are several options out there, but they all require you to use either wireless, buy new cameras and pay for expensive software.

Forget that... I'll just continue my rounds. :) I did find some cameras that had a "sensor" built into it, so that if someone was to walk into a room or withing a specific range, it would start recording. This will do. It won't provide me with remote monitoring capabilities, but I can see if and who is accessing certain rooms and storage rooms.

BTW: Apparently there is virus/trojan cabable of activating the web camera and microphone.
I'm have read that it takes snapshots, but not about continuous playback.

What else would it be? None other than the infamous Sub Seven. This "feature" is built into only some versions.

DISCLAIMER:
I am in no way suggesting people download this trojan and use it. There is quite a bit of info about this trojan on this site listed below and I don't want people to think that I'm trying to help out the skiddies. The following link is not a skiddie site but a well known security site. It is more of a "what is" document rather than a "how to" document. It does not contain links to the trojan itself. In fact the following link has links to programs that remove said trojan from an infected pc.

Read about it here.

I def. don't want to be installing trojans on my network!! My antivirus wouldn't like that very much... not to mention the HUGE risks that come with it. In fact one would have to be a complete idiot to intall one of these on his/her own network unless it is in a controlled environment "test lab" that doesn't access the internet.

Thanks again for the input and suggestions!

Well how about a generic (cheap) webcam or old capture-card with a portable VCR camara connected..

and something like this to capture the image / video and allert you !!

this great tool can send an email / sms message when it detects otion...

although this is not remote controll..



But for the remote controll part, a JAVA application running on your webcam enhanced homepage to controll the camera via a coule of motors (from an old RC car) should do the trick..

I'm sure I've seen that somewhere, but my google can't find it..