2

How to know if my laptop microphone is recording during the day?

Is there any program for ubuntu to check if my laptop microphone is recording automatically by any application during the day?

marloypo
  • 5
  • 5
amin
  • 121
  • 1
  • 2
  • 1
    You may also find good expertise for the second part of the question at Ask Ubuntu. Or Software Requests. – Fiksdal May 25 '16 at 21:01
  • This question was asked concerning a hacker remotely activating the mic on a laptop. It is more relevant here than at ask ubuntu. – Yokai May 25 '16 at 22:55
  • I would disagree to disagree here. – Yokai May 26 '16 at 01:13
  • 2
    @drewbenn There is a difference. Remember how last year someone figured out how to record audio/video on Macbook Pros and deactivate the indicator light such that the user would not notice? This was a low-level hack behaving differently than your normal application would. – Potaito May 26 '16 at 09:12
  • 1
    @amin I have the feeling that the only reliable way to solve this would be at Kernel level. But since there are attacks and exploits resulting in full root access, it is safe to assume that any solution might be unsafe. So if you are really concerned and the risks are high, consider cutting the internal microphone wires and using an external microphone when necessary. – Potaito May 26 '16 at 09:15
  • @potAito That is the very thing I suggested in my answer post lol. – Yokai May 27 '16 at 00:37

1 Answers1

-1

If I am assuming correctly, you are asking because you have a concern about remote access to your laptop microphone by a hacker yes? If this is the case, and if you are using linux, you should be easily be able to tell if your microphone is activated using the netstat, ps, and lspci commands.

lspci will give you the hardware profile of your microphone. ps will show you the processes running. netstat will show you you current connections, what ports they are running on, and the name of the service/process/protocol using it.

You will want to see if any process or incoming connection are using VOIP protocol. Then disable your mic and then check to see if the VOIP connection is still active. If so, close that VOIP port and check once more.

If all else fails, you always have the option of physically uninstalling your internal mic and using a usb mic/headset if you are that paranoid about it.

An example of your lspci output could look something like this:

00:1c.0 PCI bridge: Intel Corporation 5 Series/3400 Series Chipset PCI Express Root Port 1 (rev 06)

An example of your netstat output could look like this:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 192.168.1.144:56685     104.16.105.204:http         TIME_WAIT  
tcp        0      0 192.168.1.144:40857     edge-star-mini-sh:https ESTABLISHED
tcp        0      0 192.168.1.144:41160     81.17.30.48:https       ESTABLISHED
tcp        0      0 192.168.1.144:56267     stackoverflow.com:https ESTABLISHED
tcp        0      0 192.168.1.144:49811     104.16.115.182:http     ESTABLISHED
tcp        0      0 192.168.1.144:56887     yv-in-f95.1e100.ne:http TIME_WAIT  
tcp        0      0 192.168.1.144:49806     104.16.115.182:http     TIME_WAIT  
tcp        0      0 192.168.1.144:56281     stackoverflow.com:https ESTABLISHED
tcp        0      0 192.168.1.144:36785     195-154-9-161.rev:https ESTABLISHED
tcp        0      0 192.168.1.144:56686     104.16.105.204:http     TIME_WAIT  
tcp        0      0 192.168.1.144:36098     104.16.111.18:https     TIME_WAIT  
tcp        0      0 192.168.1.144:39585     edge-star-shv-01-:https ESTABLISHED
tcp6       1      0 ip6-localhost:39979     ip6-localhost:ipp       CLOSE_WAIT

And finally an example of your "ps" output could look like this:

root@anonymous:~# ps -v
  PID TTY      STAT   TIME  MAJFL   TRS   DRS   RSS %MEM COMMAND
 1249 tty4     Ss+    0:00      0    25 18322   964  0.0 /sbin/getty -8 38400 tty4
 1252 tty5     Ss+    0:00      0    25 18322   956  0.0 /sbin/getty -8 38400 tty5
 1261 tty2     Ss+    0:00      0    25 18322   964  0.0 /sbin/getty -8 38400 tty2
 1262 tty3     Ss+    0:00      0    25 18322   956  0.0 /sbin/getty -8 38400 tty3
 1266 tty6     Ss+    0:00      0    25 18322   952  0.0 /sbin/getty -8 38400 tty6
 2222 tty1     Ss+    0:00      0    25 18322   952  0.0 /sbin/getty -8 38400 tty1
 2253 tty7     Ssl+  39:09      9  2218 293637 49284  0.6 /usr/bin/X -core :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolis
 3172 pts/0    S      0:00      0   140 92211  2832  0.0 sudo su -
 3173 pts/0    S      0:00      0    30 91509  2428  0.0 su -
 3181 pts/0    S      0:00      0   955 25568  5144  0.0 -su
 25559 pts/0    R+     0:00      0    84 12459   892  0.0 ps -v

Using these command with specific syntax can also be used to show if an application on your machine is using your microphone as well.

Yokai
  • 795
  • 4
  • 7
  • I don't see any reason recorded data can't be sent over another protocol. – Alexander O'Mara May 26 '16 at 00:17
  • 2
    For example you will not see if the mic is used by the browser this way. Or simply by a normal recording application and the recorded data will be uploaded later as a file. And with lspci you might be able get get information about the audio device but not specifically about the mic. – Steffen Ullrich May 26 '16 at 05:24
  • There will have to be specific software that will activate the mic. A mic cannot run on a machine if there is no driver or software app to support the device. By observing whether or not the device is active and observing if the audio driver is active, one can determine whether or not the mic is active. The options I gave are basic linux usage but they have the syntax to determine if recording is occurring. – Yokai May 27 '16 at 00:39
  • If you have used these commands before, you will know I did not post the full output. – Yokai May 27 '16 at 00:40