BERLIN – Security researchers have uncovered a critical flaw in Linux-based Lenovo webcams that enables attackers to deploy a BadUSB payload remotely, transforming the camera into a keystroke injector, a phishing hub, or – in one unsettling proof-of-concept — a karaoke machine.
The root of the problem lies in a neglected firmware update channel that accepts unsigned instructions without verification. Once compromised, the webcam can masquerade as a USB keyboard, execute malicious commands, or, as demonstrated at last week’s DEF CON, belt out an off-key rendition of “Sweet Caroline” mid-video call.
While the novelty of a hijacked webcam crooning Neil Diamond might elicit laughter, experts warn the exploit’s true potential is far more dangerous. Attackers could harvest login credentials, propagate malware, or deploy ransomware – all while hiding their activity in what one researcher described as “a soundtrack of pure menace.” Lenovo has acknowledged the vulnerability, pledging a firmware fix and advising users to disconnect cameras when not in use and, ideally, “avoid singing into them until further notice.”
Cybersecurity consultant Dr. Imke Bauer called the discovery “a textbook case of attack-surface creep,” noting that “if it has firmware, someone will eventually teach it to sing – or steal your data. Sometimes both.” She likened the karaoke demo to “a breach you can hear coming.”
Until the patch is released, Linux webcam owners are urged to apply interim mitigations, monitor for suspicious USB activity, and resist fulfilling song requests during work meetings – especially from unknown participants humming the opening bars.