Possible malware in USB camera module with anon controller(no serial,manufacturer,data sheets)

Feedback
1

Would you be concerned while reading the following?
This is a USB camera module that, supposedly, has an IMX179 sensor, but it’s been shipped with a microcontroller that’s been “darkened out” (the identification/information has been removed from the IC, making the search for a datasheet impossible).
To me, there’s a keylogger. What do you think just by reading at the log? Is it normal for the system to recognize it as a keyboard and STILL show video/pictures in “cheese” ???
Please, help me understand if that’s wrong or if I’m getting tin-foil paranoid here.
I sincerely thank you for any advice.

  1. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) config/udev: Adding input device USB Camera: USB Camera (/dev/input/event16)|
  2. |—|—|—|
  3. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) USB Camera: USB Camera: Applying InputClass libinput keyboard catchall|
  4. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) USB Camera: USB Camera: Applying InputClass system-keyboard|
  5. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) Using input driver ‘libinput’ for ‘USB Camera: USB Camera’|
  6. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) systemd-logind: got fd for /dev/input/event16 13:80 fd 55 paused 0|
  7. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) USB Camera: USB Camera: always reports core events|
  8. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) Option Device /dev/input/event16|
  9. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) Option _source server/udev|
  10. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) event16 - USB Camera: USB Camera: is tagged by udev as: Keyboard|
  11. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) event16 - USB Camera: USB Camera: device is a keyboard|
  12. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) event16 - USB Camera: USB Camera: device removed|
  13. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) Option config_info udev:/sys/devices/pci0000:00/0000:00:15.0/usb1/1-1/1-1.4/1-1.4:1.0/input/input23/event16|
  14. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) XINPUT: Adding extended input device USB Camera: USB Camera (type: KEYBOARD, id 15)|
  15. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) Option xkb_layout it,us|
  16. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(**) Option xkb_variant winkeys,|
  17. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) event16 - USB Camera: USB Camera: is tagged by udev as: Keyboard|
  18. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) event16 - USB Camera: USB Camera: device is a keyboard|
  19. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(EE) Error compiling keymap (server-0) executing ‘/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 The XKEYBOARD keymap compiler (xkbcomp) reports: -emp > -eml Errors from xkbcomp are not fatal to the X server /tmp/server-0.xkm’|
  20. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(EE) XKB: Couldn’t compile keymap|
  21. |8/17/21 9:16 PM|user@1001.service|Couldn’t upload new XKB keyboard description|
  22. |8/17/21 9:16 PM|systemd|vte-spawn-c2f299de-5ec4-499a-abf4-41f3efa9edce.scope: Succeeded.|
  23. |8/17/21 9:16 PM|dbus-daemon|[session uid=1001 pid=670] Activating service name=‘org.gnome.Cheese’ requested by ‘:1.67’ (uid=1001 pid=956 comm=gnome-panel )|
  24. |8/17/21 9:16 PM|dbus-daemon|[session uid=1001 pid=670] Successfully activated service ‘org.gnome.Cheese’|
  25. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) modeset(0): EDID vendor CMN, prod id 5316|
  26. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) modeset(0): Printing DDC gathered Modelines:|
  27. |8/17/21 9:16 PM|/usr/libexec/gdm-x-session|(II) modeset(0): Modeline 1366x768x0.0 76.42 1366 1434 1479 1592 768 772 779 800 -hsync -vsync (48.0 kHz eP)|
  28. |8/17/21 9:20 PM|/usr/libexec/gdm-x-session|(II) config/udev: removing device USB Camera: USB Camera|
  29. |8/17/21 9:20 PM|/usr/libexec/gdm-x-session|(**) Option fd 55|
  30. |8/17/21 9:20 PM|/usr/libexec/gdm-x-session|(II) event16 - USB Camera: USB Camera: device removed|
  31. |8/17/21 9:20 PM|/usr/libexec/gdm-x-session|(II) UnloadModule: libinput|
  32. |8/17/21 9:20 PM|/usr/libexec/gdm-x-session|(II) systemd-logind: releasing fd for 13:80|
2

As far as I am aware, I don’t think that devices registering as keyboards can access the key events from other, real keyboards, so I wouldn’t be worried about that. If you didn’t install any manufacturer software, then the device wouldn’t have any way to transmit keys anyways unless there’s a suspicious character physically near you. It shows up as a keyboard because it’s probably being picked up by the generic kernel USB Video Class driver which assumes that your camera might have buttons and thus creates an input device.

3

Welcome in the community. Did you join yesterday merely to answer this, the very first day?
That’s adding on top of the paranoia… :joy:
Jokes aside, if that’s the case, why would they censor the IC…? Isn’t that what a malevolent actor would do to avoid a rewrite of the firmware and/or firmware updates?
Also, this module has an odd behavior. Doesn’t show up/work when attached to the USB3 port on my computer, BUT, if I plug a USB3 hub in that same exact port, it shows up and works.
On top of that, it was sold without ground connections and the picture was garbled, shaky, noisy, basically crap. Seems like something sold “apparently broken” on purpose, to have it sent back by unaware individuals after being plugged in at least one time.
I fixed the ground connection and didn’t care too much in the beginning, even though I was already in alert because of the missing information on the ICs, but then it got suspicious when I saw that info in the logs.
Thanks for your opinion/suggestions. Much appreciated. I don’t trust this module anymore though. I’ll send it to professionals for a proper forensic analysis.

4

if there’s multimedia key on the camera, then it’s normal.

5

log
log1366×768 197 KB

cameramodule
cameramodule1920×2560 250 KB

It looks like there’s none.
There are two ICs. One looks like a bios of some sort, the other, most likely, is the microcontroller with USB switch.
But the controller is “censored”. I can search around for clues about its true nature, yet, you should convene with me if I say that I cannot trust it as it is now, as the mere fact that it’s been “hidden” doesn’t bring a lot of confidence.
And it’s not just censored: they entirety of the surface on top has been etched away.
By comparing the soldering on the IC and the rest of the board, I can say that’s been reworked with a high degree of confidence.
Even more absurd is the fact that it doesn’t work when directly connected in the USB3 port on my computer but it does when I plug the camera along with a USB3 HUB in the same exact port…