Warning! This piece contains spoilers for the new Veronica Mars movie.
As a member of that small cult of viewers who thought high school detective show Veronica Mars was better than Buffy, I’m happy to see the Kickstarter-backed movie sequel come to fruition, bringing us back to the world of Kristen Bell’s snarky, disaffected high school detective (now post-J.D.). As your friendly Bitwise columnist, I’m even happier to report that, just as the original show was sharp on technology, the movie also knows its stuff, putting a clever webcam hack at the center of its twisty plot.
The movie revolves around the murder of one of Veronica’s old classmates, Carrie Bishop (Andrea Estella), who went on to become a singer and celebrity under the nom de pop Bonnie DeVille. All fingers point to Bonnie’s boyfriend, Logan Echolls (Jason Dohring), as the culprit, and as Logan’s loyal ex-girlfriend, Veronica returns to crack the case. One of the key leads is a sex tape of Carrie and Logan, mysteriously recorded by Carrie’s tablet camera—footage that was recorded without Carrie’s knowledge. Veronica’s hacker friend Mac (Tina Majorino) says that in order to pull off this kind of tablet-based spying, “someone would have to modify a wireless model.” Turns out that bottom-feeding PI Vinnie Van Lowe (played with perfect sleaze by Ken Marino) did just that, giving away tablets preloaded with spy software at the MTV Music Awards, where Bonnie, née Carrie, was in attendance. Vinnie reaped the rewards not just from Carrie’s sex tape but from the private antics of James Franco, who walked off with six of the tablets; Vinnie markets his booty to TMZ and makes a mint. “I’m the reason people know that Anne Hathaway has a vagina,” he brags.
This is all perfectly plausible. Vinnie is distributing Samsung Galaxy tablets running Android, which has a very active modding community. Once you “root” a device, by replacing the factory-installed firmware with a modified firmware, you give the modder control over everything—even the parts normally locked down by the manufacturer and provider. Given that the devices were on wireless, Vinnie just had to hack the tablets to persistently record video and upload it to some server or another that he could access.
In the same way that malware can control your computer, delete your files, and track your keystrokes, mistakenly installed virulent software can just as easily control your webcam. Here’s the tale of a 14-year-old doing it. And a 19-year-old. You may think your webcam is only looking at you when its LED light is on, but that can be bypassed, too. It’s more difficult on a tablet than on a PC because of those manufacturer restrictions, but Vinnie’s goal is different: Rather than just going after anyone careless enough to click on the wrong link, he wants specific celebrity targets. And rather than waiting around for celebrities to click on malware links and digging for them in a huge haystack, he targets them directly with prehacked devices. Clever.
For those would-be victims who knew where to look, the corrupted devices would show some indications of the hack. The bandwidth required to upload the video would slow down the network; the space required to capture so much video might need additional flash memory; the battery would definitely drain much faster. But the targeted celebrities, like James Franco, don’t seem to possess much technical savvy.
To the best of my knowledge, the story technologically closest to Vinnie’s plot—and perhaps an inspiration for it—is a 2010 high school scandal that reads exactly like an old episode of Veronica Mars. Harriton High School, near Philadelphia, issued laptops to its students with webcams that could secretly monitor them. A student filed a civil lawsuit after Vice Principal Lindy Matsko told him that he had “engaged in improper behavior in his home, and cited as evidence a photograph from the Webcam.” The dim Matsko, who could have been a character in Veronica Mars, sent the webcam shot to prove her point. Security guru Bruce Schneier cited security consultant Stryde’s technical investigation, which concluded that the school effectively had “a massive, highly effective digital panopticon.” Students had raised questions but were shooed away; according to LinkedIn, Matsko still has her job. Where’s Veronica Mars when you need her?
While distributing the devices makes it absurdly easy to spy on their recipients, pristine devices are still quite hackable, contrary to what Mac implies. The New York Times reported in 2011 that German authorities were using people’s webcams against them. And thanks to Edward Snowden, we now know the U.K.’s equivalent of the NSA, the GCHQ, was analyzing bulk webcam images through its Optic Nerve program. Just this week, Glenn Greenwald’s news outlet the Intercept published an exposé on the vast gallery of the NSA’s malware, including GUMFISH, which “can covertly take over a computer’s webcam and snap photographs,” and CAPTIVATEDAUDIENCE, which takes over the microphone to record conversations. So if Vinnie gets sick of the corrupt Hollywood world, he has a bright future as a spook.
But these kinds of hacks are trickier and less flexible than simply modifying the original device—you can’t always depend on the target accidentally clicking a malware link. So Veronica Mars went for a neater, though less popular, alternative. My compliments to creator-writer-director Rob Thomas and co-writer Diane Ruggiero for thinking things through and not going over the top like House of Cards did with the Deep Web. They kept the tech details lean, mean, and efficient, while still being convincing.
So yes indeed, it’s all real. Some security experts recommend physically covering up your webcam when you’re not using it, but that’s just a placebo. If someone really wants to track you through your computer and you aren’t absolutely sure you’re secure, you probably aren’t. Veronica Mars gained much of its tension from pitting a teenager against forces that weren’t fantastic but uncomfortably close to the real and scary adult world. The movie’s commitment to technical realism makes the stakes feel that much more palpable.