8 ms·
Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
- Someone1234 8y agoIn Apple's computers the web cam light cannot be disabled, because the web cam is controlled by a co-processor as demoed here. In the newer Pros with Touchbar Apple uses their own chip for this same function. On a lot of PC webcams, you can run the camera without the light or visa versa[0]. [0] https://blog.erratasec.com/2013/12/how-to-disable-webcam-light-on-windows.html https://blog.erratasec.com/2013/12/how-to-disable-webcam-lig...
- Rebelgecko 8y agoPrevious hacks of the iSight cam involved rewriting the firmware of that separate microcontroller. IIRC there was also a delay at one point, so that it was possible to take a picture really fast before the LED turned on.
- saagarjha 8y agoOf course, the T-series processors were not a thing back then…
- Udo_Schmitz 8y agoConcerned only pre-2009 models or earlier, needed physical access as well. AFAICR.
- jsjohnst 8y agoCorrect, since 2009 roughly, the sensor power was tied into the LED, so if the sensor had enough power to register an image, the LED would have to be on. Apple modified the circuitry specifically because of the old exploit.
- kabdib 8y agoI'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if you X-ray'd the board. I'm guessing that a similarly stealthy receiver would be noticeable due to required external discrete components (e.g., amplifiers, filter networks). Plonking down a whole chip for "secret wifi" is likely overkill.
- jws 8y ago…something that didn't look too much like an antenna… The Raspberry Pi Zero W has a perfectly serviceable antenna which is simply a cavity formed between layers of copper and two tiny capacitors which look about like grains of salt. You can read more at https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna-design/ https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna... They are designed by some very clever Swedes. http://www.proant.se/en/news.htm http://www.proant.se/en/news.htm That second page shows the Raspberry Pi 3B+ whose antenna looks to be just a trace with the aforementioned grains of salt on it.
- monochromatic 8y agoAntenna design is total black magic. Intuition is useless here.
- mmagin 8y agoNo it's not, it just seems that way to the vast majority of us who haven't developed the proper intuition.
- wallflower 8y agoOf course, there is the GA evolved antenna. https://en.wikipedia.org/wiki/Evolved_antenna https://en.wikipedia.org/wiki/Evolved_antenna
- amagumori 8y agouhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".
- cozzyd 8y agoDon't you see, they used Kali Linux which contains the specialized lspci hacker tool.
- woadwarrior01 8y agoI don't know if you're being sarcastic, but there's nothing specialized or Kali Linux specific about lspci. Every linux distro I've seen comes with the lspci (also, lsusb, lsmem). system_profiler on OSX is probably the closest to all of these and more, rolled into one command line tool.
- angry_octet 8y agoIt is definitely sarcasm.
- dsmithatx 8y agoNot sure why you were down voted. The test only showed removing the chip disabled the camera. The chip BCM15700A2 is a WLAN/Bluetooth chip used on Intel 8260 cards and lots of Dell laptops. There is a Linux kernel driver written for this chip used for 802.11a wireless.
- simcop2387 8y agoGot a source for that? I can't find any references to the 15700A2 being on intel 8260 cards.
- dogma1138 8y ago
- userbinator 8y agoWe’re not sure exactly what the technicians did to remove the chip – heat gun, maybe? – but it came off cleanly and you wouldn’t notice it was missing unless you were specifically looking for it on the board. Almost certainly, or more precisely, a "hot air rework station". For someone with experience, it only takes a few minutes to remove and replace BGAs with one.
- monochromatic 8y agoAnd on top of that, it’s just about the only way it can be done non-destructively.
- eigenloss 8y agoAs far as hardware hacking goes, this is tremendously unimpressive work. They didn't even check for PCB antennas, which would have been trivial. It would probably take six months, minimum, of real work to actually airgap a Macbook (with any level of confidence in its security).
- 8bitsrule 8y agoThis story made me realize: I haven't seen the phrase "tin-foil hat" used much in the past couple of years. Huh. Which reminded me of a quote: "For a while you wondered whether the fools were pretending to be fools as some kind of deception, or whether there was a real efficient service somewhere else. Later in my fiction, I invented one. But alas the reality was the mediocrity." — Le Carre
- cozzyd 8y agoThe NSA can see through tin now. You must upgrade to superconducting hats.
- thepangolino 8y agoShhhh. Don't tell them. http://web.archive.org/web/20100708230258/http://people.csail.mit.edu/rahimi/helmet/ http://web.archive.org/web/20100708230258/http://people.csai...
- lucb1e 8y ago> certain frequencies are in fact greatly amplified [by the helmets] Oh, interesting! > These amplified frequencies coincide with radio bands reserved for government use I mean, if you take all of the common RF spectrum and look at what is reserved for civilian use, the vast majority is not freely usable. I'm not surprised it's within licensed spectrum. > the use of helmets may in fact enhance the government's invasive abilities Right. > We speculate that the government may in fact have started the helmet craze for this reason. Riiiiight. This went from fun project to three levels of conspiracy theory real fast. And looking at the contents (instead of the summary/abstract) more critically, they investigated >=10kHz waves. The brain waves that I know of are in the range of 1-150Hz: https://en.wikipedia.org/wiki/Neural_oscillation https://en.wikipedia.org/wiki/Neural_oscillation ... actually, this page is a joke, right? The more I read on the page, no way that this is serious.
- rhaps0dy 8y ago
- walrus01 8y agoIf you really need an air gapped computer, wouldn't it make a whole lot more sense to build a desktop with some variety of ATX form factor motherboard that you can examine in detail to confirm that it has zero wireless functionality? A Macbook Air, which is pretty much designed as a wifi-dependent network terminal, would be way down my list of hardware I would choose if I had to build an airgap lab environment.
- tonyedgecombe 8y agoPresumably because they wanted something portable?
- bo1024 8y agoI would start with a Librem laptop as this is exactly the point of them. Hopefully all you'd have to do is verify the killswitch works as advertised. disclaimer: typing on one now.
- mjlee 8y ago> This sounded reasonable, so I ventured to the streets of New York City to seek the help of some professionals! If the author of the article is here - I'd suggest turning to Louis Rossmann of YouTube fame: https://www.rossmanngroup.com/ https://www.rossmanngroup.com/ https://www.youtube.com/user/rossmanngroup https://www.youtube.com/user/rossmanngroup He has the equipment and skill to repair a logic board, and may have some valuable insights about failure modes of common chips on MacBooks.
- Operyl 8y agoMan, oh man can he ever be cynical though. At some point,l I have to believe it’s because he’s playing for the camera. Or, at least, I hope so. I’ve seen him get extremely stressed out over the silliest things.
- hhh 8y agoI've never had a negative interaction with Louis personally, nor has anyone I've known. A friend birthed a repair store from his videos, and Louis' personality is very bright. His comments on the style of videos that Linus Tech Tips puts out compared to his own were hilarious. I really enjoy Louis' videos. His decision of swapping from edited video to raw streams mostly as well is quite nice. Seeing his channel grow, and every trait that he has grow with that has been an interesting process. Maybe this is because I am quite cynical as well, but I have no idea. In 2 years he has grown from 40k subs to 442k, so he's doing something right. I think everyone can get stressed over silly things.
- ryanlol 8y agohttps://www.youtube.com/watch?v=tw3-j_RaX74 https://www.youtube.com/watch?v=tw3-j_RaX74 This guy doesn't seem very bright, but perhaps that was the joke?
- y04nn 8y agoIf you do some search you can find logic boards PCB layouts and electronic schematics on internet. Here is a link: https://www.apple-schematic.se/ https://www.apple-schematic.se/ Edit: And to look at the PCB files I recommend https://openboardview.org/ https://openboardview.org/
- deleted 8y ago[deleted]
- carlospwk 8y agoCan I just say how beautiful and usable this minimal styling and design on the website is?
- madengr 8y agoI suppose looking for the antenna is rocket science.
- javierjops 8y agoMac book Air https://photostockeditor.com/blog/15/premium-pack-laptop-at-night-photos https://photostockeditor.com/blog/15/premium-pack-laptop-at-...