5 ms·

>However, they clearly CAN, and while they almost certainly don't on any massive scale, if they by their overlord or a security hack, did on a targeted basis li

>However, they clearly CAN, and while they almost certainly don't on any massive scale, if they by their overlord or a security hack, did on a targeted basis listen, record and send conversations on, that would be very possible, and very harmful for whoever was targeted. Besides the fact that they have better antennas, this is true for pretty much any device with a microphone and a processor with audio processing capability, no? My laptop has a microphone and video. Surely Microsoft could just start recording with the with right windows update? My Avaya VOIP phone has speaker phone, could do the same.

masklinn 7y ago
> My laptop has a microphone and video. Surely Microsoft could just start recording with the with right windows update? It's a commonly mentioned issue, and a somewhat regular occurrence with various malware or "security solutions". That's why a number of laptops have either visual indicators or shutters (though mostly for the cameras, sadly hot mics are rarely a consideration), and a rare few have physical disconnection switches (again mostly for cameras).
- pampelondan 7y ago
  I saw one gizmo for mic the other day https://shop.googlemerchandisestore.com/Google+Redesign/Accessories/Google+See+no+hear+no+set https://shop.googlemerchandisestore.com/Google+Redesign/Acce... haven't tried it though, anyone has any experience? Does it really muffle the sound enough?
  - snovv_crash 7y ago
    I think the idea there is that it physically disconnects the mic, since the laptop instead tries to use the headphone mic (which in this case isn't connected). Not sure if it would actually work, it would be easy to 3d-print one to test.
    - rebuilder 7y ago
      If you connect a plug to the audio jack, sure, the laptop probably defaults to using that jack for input and output. But you can still choose to use the built-in mic, right? So it's not physically disconnecting anything, just triggering a software disconnect.
      - masklinn 7y ago
        AFAIK you're correct. Though it's possible most spying software just uses the default mic and doesn't have the capabilities to switch the input device?
        to11mtm 7y ago
        Not a Mac user, and the last time I played with sound stuff in nix was almost 15 years ago... But I feel like switching input (or even collecting multiple sound inputs) on a nix OS is not much more convoluted than dealing with the sound stack in general. But that's probably also related to how the driver itself interfaces with the audio device...
- tprynn 7y ago
  Macbooks since 2018 physically disable microphones and webcams when the lid is closed: https://www.businessinsider.com/apple-macbook-air-and-2018-macbook-pro-disconnect-microphone-when-lid-is-closed-2018-11 https://www.businessinsider.com/apple-macbook-air-and-2018-m...
  - netsharc 7y ago
    How does a chip "physically disconnects" a device?
    - tprynn 7y ago
      Presumably power is disconnected by the T2 chip. Different from mechanical disconnect via a physical switch, but equivalently effective if you trust the T2 chip. (And if you don’t ... well, you can’t use the MacBook securely at all.)
      - morpheuskafka 7y ago
        You had better not trust the T2 chip, because it is vulnerable to the checkm8 exploit and the checkra1n folks have already demonstrated total compromise. The encryption functionality isn't affected if you have FileVault on, because your password is not stored anywhere on the device, but everything else, from basic SMC functions like mic/cam/fans/touchbar to secure boot to verifying the microcode and ME firmware before loading are totally useless now. AFAIK, the T2 is always powered on even when the main CPU is off, so this could have ultra-long-term persistence.
        yborg 7y ago
        Reference?
        walterbell 7y ago
        https://www.idownloadblog.com/2020/03/10/luca-todesco-teases-checkra1n-hacks-on-a-t2-equipped-macbook-pros-touch-bar/ https://www.idownloadblog.com/2020/03/10/luca-todesco-teases...
- eth0up 7y ago
  Perhaps within the hazy, inextricable mists of jack, pulse and alsa, there's an answer. I remember feeling qualified for a job at NSA after getting midi and my mic to work (effectively) on my Arch (Mint, Ubuntu, Debian, etc) laptops years ago. It was a feat. I can see: Hacker1: we've got root. Hacker2: yeah, but how the fuck do we get audio to work? Hacker1: modify grub to default to windows partition and reboot, or maybe install Virtual Box and run windows. Probably not possible otherwise. Hacker2: No, waaay too slow, they're on an ATT gateway. Find a softer target.
im3w1l 7y ago
> Surely Microsoft could just start recording with the with right windows update? Yes, that's why automatic updates was seen with a lot of skepticism at first. And the reason automatic updates are winning is because everything is so full of holes that disabling automatic updates is even less secure than enabling it.
Silhouette 7y ago
Surely Microsoft could just start recording with the with right windows update? Yes, they could. I get some scepticism when I say my businesses have declined to move to Windows 10, mostly because we don't trust the security and privacy aspects. However, we deal with personal data, and we also deal with various types of information that are protected by statute and/or contract. It would be very obviously against the spirit and quite possibly against the letter of several different laws for us to knowingly store and use that kind of data on a system that sends information we can't control up to the mothership and/or that could be updated without us agreeing to it. Indeed, there are multiple ongoing investigations into Windows 10 because of exactly those kinds of concerns across the EU right now. It's a good thing that non-technical people who do take privacy seriously, such as lawyers, are starting to notice the glaring problem with these modern technologies and advise against using them. With a bit of luck, we'll then get statutory regulation requiring disclosure in advance of exactly what these devices are doing and the security and privacy implications including when they don't work properly or if they get compromised. Again, there had been much discussion in Europe recently, at least up until the world was more concerned with another kind of virus over the past few weeks, of requiring much stronger standards for security in IoT devices, and those sorts of laws really can't arrive soon enough. Mandating controls to physically isolate all cameras, microphones, transmitters and receivers at the hardware level might not be a bad idea, either.

masklinn 7y ago

> My laptop has a microphone and video. Surely Microsoft could just start recording with the with right windows update? It's a commonly mentioned issue, and a somewhat regular occurrence with various malware or "security solutions". That's why a number of laptops have either visual indicators or shutters (though mostly for the cameras, sadly hot mics are rarely a consideration), and a rare few have physical disconnection switches (again mostly for cameras).

pampelondan 7y ago
I saw one gizmo for mic the other day https://shop.googlemerchandisestore.com/Google+Redesign/Accessories/Google+See+no+hear+no+set https://shop.googlemerchandisestore.com/Google+Redesign/Acce... haven't tried it though, anyone has any experience? Does it really muffle the sound enough?
- snovv_crash 7y ago
  I think the idea there is that it physically disconnects the mic, since the laptop instead tries to use the headphone mic (which in this case isn't connected). Not sure if it would actually work, it would be easy to 3d-print one to test.
  - rebuilder 7y ago
    If you connect a plug to the audio jack, sure, the laptop probably defaults to using that jack for input and output. But you can still choose to use the built-in mic, right? So it's not physically disconnecting anything, just triggering a software disconnect.
    - masklinn 7y ago
      AFAIK you're correct. Though it's possible most spying software just uses the default mic and doesn't have the capabilities to switch the input device?
      - to11mtm 7y ago
        Not a Mac user, and the last time I played with sound stuff in nix was almost 15 years ago... But I feel like switching input (or even collecting multiple sound inputs) on a nix OS is not much more convoluted than dealing with the sound stack in general. But that's probably also related to how the driver itself interfaces with the audio device...
tprynn 7y ago
Macbooks since 2018 physically disable microphones and webcams when the lid is closed: https://www.businessinsider.com/apple-macbook-air-and-2018-macbook-pro-disconnect-microphone-when-lid-is-closed-2018-11 https://www.businessinsider.com/apple-macbook-air-and-2018-m...
- netsharc 7y ago
  How does a chip "physically disconnects" a device?
  - tprynn 7y ago
    Presumably power is disconnected by the T2 chip. Different from mechanical disconnect via a physical switch, but equivalently effective if you trust the T2 chip. (And if you don’t ... well, you can’t use the MacBook securely at all.)
    - morpheuskafka 7y ago
      You had better not trust the T2 chip, because it is vulnerable to the checkm8 exploit and the checkra1n folks have already demonstrated total compromise. The encryption functionality isn't affected if you have FileVault on, because your password is not stored anywhere on the device, but everything else, from basic SMC functions like mic/cam/fans/touchbar to secure boot to verifying the microcode and ME firmware before loading are totally useless now. AFAIK, the T2 is always powered on even when the main CPU is off, so this could have ultra-long-term persistence.
      - yborg 7y ago
        Reference?
        walterbell 7y ago
        https://www.idownloadblog.com/2020/03/10/luca-todesco-teases-checkra1n-hacks-on-a-t2-equipped-macbook-pros-touch-bar/ https://www.idownloadblog.com/2020/03/10/luca-todesco-teases...
eth0up 7y ago
Perhaps within the hazy, inextricable mists of jack, pulse and alsa, there's an answer. I remember feeling qualified for a job at NSA after getting midi and my mic to work (effectively) on my Arch (Mint, Ubuntu, Debian, etc) laptops years ago. It was a feat. I can see: Hacker1: we've got root. Hacker2: yeah, but how the fuck do we get audio to work? Hacker1: modify grub to default to windows partition and reboot, or maybe install Virtual Box and run windows. Probably not possible otherwise. Hacker2: No, waaay too slow, they're on an ATT gateway. Find a softer target.

im3w1l 7y ago

> Surely Microsoft could just start recording with the with right windows update? Yes, that's why automatic updates was seen with a lot of skepticism at first. And the reason automatic updates are winning is because everything is so full of holes that disabling automatic updates is even less secure than enabling it.

Silhouette 7y ago

Surely Microsoft could just start recording with the with right windows update? Yes, they could. I get some scepticism when I say my businesses have declined to move to Windows 10, mostly because we don't trust the security and privacy aspects. However, we deal with personal data, and we also deal with various types of information that are protected by statute and/or contract. It would be very obviously against the spirit and quite possibly against the letter of several different laws for us to knowingly store and use that kind of data on a system that sends information we can't control up to the mothership and/or that could be updated without us agreeing to it. Indeed, there are multiple ongoing investigations into Windows 10 because of exactly those kinds of concerns across the EU right now. It's a good thing that non-technical people who do take privacy seriously, such as lawyers, are starting to notice the glaring problem with these modern technologies and advise against using them. With a bit of luck, we'll then get statutory regulation requiring disclosure in advance of exactly what these devices are doing and the security and privacy implications including when they don't work properly or if they get compromised. Again, there had been much discussion in Europe recently, at least up until the world was more concerned with another kind of virus over the past few weeks, of requiring much stronger standards for security in IoT devices, and those sorts of laws really can't arrive soon enough. Mandating controls to physically isolate all cameras, microphones, transmitters and receivers at the hardware level might not be a bad idea, either.