6 ms·

Are video captures actually possible? I could imagine video capture as part of a RAT, but what scares me is the idea of video capture that doesn't turn on the c

by Mizza 10y ago

Are video captures actually possible? I could imagine video capture as part of a RAT, but what scares me is the idea of video capture that doesn't turn on the camera activity light. Are there any examples of that?

stephenr 10y ago
I don't know that it's possible on recent Apple hardware. I remember reading somewhere that the green LED is triggered by the camera power line, or something along those lines.
- cptskippy 10y ago
  That's how it should be however that's not how it is for all web cameras. I don't know specifics about Apple.
  - nitrogen 10y ago
    Note to anyone developing a new webcam: if you want to be able to flash your LED to indicate something to the user, add another color, and keep the main LED tied to the power line (ideally with a hardware-implemented delayed shutoff on the power so a single-frame grab lights the LED for a long time).
jobu 10y ago
It was definitely possible a couple years back - https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569 We describe how to disable the LED on a class of Apple internal iSight webcams used in some versions of MacBook laptops and iMac desktops. This enables video to be captured without any visual indication to the user and can be accomplished entirely in user space by an unprivileged (non- root) application.
- landr0id 10y ago
  > It was definitely possible a couple years back Yeah, a few years back studying MacBooks from 2008.
  - strictnein 10y ago
    Have they been updated since then?
    - landr0id 10y ago
      Assuming this is a serious question, yes, the camera and MacBooks both have changed a lot since 2008. This is probably why they did the study on 2008 MacBooks as opposed to later models. They wouldn't get the results they wanted otherwise.
deleted 10y ago
[deleted]
semi-extrinsic 10y ago
IDK about current gen Apple hardware, but it was possible to do so on a 2008 MacBook, at least (academic paper and PoC app): https://jscholarship.library.jhu.edu/bitstream/handle/1774.2/36569/camera.pdf?sequence=1 https://jscholarship.library.jhu.edu/bitstream/handle/1774.2... Interestingly, on my battered, el cheapo Asus 12" netbook (2011 Intel Atom), this problem is solved very well: the on/off webcam switch physically blocks the webcam lens in the off state.
stephenr 10y ago
The article only includes the word "Video" once in the summary, but then mentioned screen captures every 30 seconds. I'm guessing that is what the summary is referring to when it says "video capture", because there is no other reference to video or camera.
- initram 10y ago
  The list of source files include avfsession.mm which is likely a C++ wrapper around AVCaptureSession[0], Cocoa's audio and video capture class. [0]https://developer.apple.com/library/ios/documentation/AVFoundation/Reference/AVCaptureSession_Class/index.html#//apple_ref/occ/cl/AVCaptureSession https://developer.apple.com/library/ios/documentation/AVFoun...
  - stephenr 10y ago
    The article itself makes no other mention to capturing video from the camera. Is it possible that they use that class purely to capture audio?
njloof 10y ago
Be safe and do as Mark Zuckerberg does -- stick a Post-It™ over the camera lens.
wepple 10y ago
I'm going to dig into this and find out, I've wanted to know for ages. If the LED == LED_TORCH, then it looks like it may be possible: https://github.com/patjak/bcwc_pcie/blob/8cc44d67f3c924f30a895dd44b9065ed04b4ed0b/fthd_isp.h https://github.com/patjak/bcwc_pcie/blob/8cc44d67f3c924f30a8... Either way, I'm planning on buying some spare parts to actually test and possibly PoC this.
rurban 10y ago
Apparently this malware doesn't take webcam screenshots (as law inforcement illegally does). It just takes screenshots, possibly to match keystrokes to the window, to be able to match password entries to the application or url. And then exploit that furtheron. I wonder why it takes audio captures though? Just for the thrill? Or is it the government?

by Mizza 10y ago

stephenr 10y ago

I don't know that it's possible on recent Apple hardware. I remember reading somewhere that the green LED is triggered by the camera power line, or something along those lines.

cptskippy 10y ago
That's how it should be however that's not how it is for all web cameras. I don't know specifics about Apple.
- nitrogen 10y ago
  Note to anyone developing a new webcam: if you want to be able to flash your LED to indicate something to the user, add another color, and keep the main LED tied to the power line (ideally with a hardware-implemented delayed shutoff on the power so a single-frame grab lights the LED for a long time).

jobu 10y ago

It was definitely possible a couple years back - https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569 We describe how to disable the LED on a class of Apple internal iSight webcams used in some versions of MacBook laptops and iMac desktops. This enables video to be captured without any visual indication to the user and can be accomplished entirely in user space by an unprivileged (non- root) application.

landr0id 10y ago
> It was definitely possible a couple years back Yeah, a few years back studying MacBooks from 2008.
- strictnein 10y ago
  Have they been updated since then?
  - landr0id 10y ago
    Assuming this is a serious question, yes, the camera and MacBooks both have changed a lot since 2008. This is probably why they did the study on 2008 MacBooks as opposed to later models. They wouldn't get the results they wanted otherwise.

deleted 10y ago

[deleted]

semi-extrinsic 10y ago

IDK about current gen Apple hardware, but it was possible to do so on a 2008 MacBook, at least (academic paper and PoC app): https://jscholarship.library.jhu.edu/bitstream/handle/1774.2/36569/camera.pdf?sequence=1 https://jscholarship.library.jhu.edu/bitstream/handle/1774.2... Interestingly, on my battered, el cheapo Asus 12" netbook (2011 Intel Atom), this problem is solved very well: the on/off webcam switch physically blocks the webcam lens in the off state.

stephenr 10y ago

The article only includes the word "Video" once in the summary, but then mentioned screen captures every 30 seconds. I'm guessing that is what the summary is referring to when it says "video capture", because there is no other reference to video or camera.

initram 10y ago
The list of source files include avfsession.mm which is likely a C++ wrapper around AVCaptureSession[0], Cocoa's audio and video capture class. [0]https://developer.apple.com/library/ios/documentation/AVFoundation/Reference/AVCaptureSession_Class/index.html#//apple_ref/occ/cl/AVCaptureSession https://developer.apple.com/library/ios/documentation/AVFoun...
- stephenr 10y ago
  The article itself makes no other mention to capturing video from the camera. Is it possible that they use that class purely to capture audio?

njloof 10y ago

Be safe and do as Mark Zuckerberg does -- stick a Post-It™ over the camera lens.

wepple 10y ago

I'm going to dig into this and find out, I've wanted to know for ages. If the LED == LED_TORCH, then it looks like it may be possible: https://github.com/patjak/bcwc_pcie/blob/8cc44d67f3c924f30a895dd44b9065ed04b4ed0b/fthd_isp.h https://github.com/patjak/bcwc_pcie/blob/8cc44d67f3c924f30a8... Either way, I'm planning on buying some spare parts to actually test and possibly PoC this.

rurban 10y ago

Apparently this malware doesn't take webcam screenshots (as law inforcement illegally does). It just takes screenshots, possibly to match keystrokes to the window, to be able to match password entries to the application or url. And then exploit that furtheron. I wonder why it takes audio captures though? Just for the thrill? Or is it the government?