12 ms·
Unauthorized access to cameras in Safari on macOS and iOS
- ahupp 7y agoI'm not sure what the conventions are these days, but the $75k bounty seems reasonable for the severity of the problem (even if large compared to others I've seen). What's the record bounty size so far?
- ht85 7y agoWhile I'm glad they didn't give one of those insulting 10k payouts, I'm actually surprised this one wasn't higher. This isn't a complete remote takeover but accessing a live feed of an unsuspecting person just by them opening a URL seems like a really big deal for a company that is all about privacy.
- zvrba 7y agoOn laptops, there's usually a light that turns on when the camera is active. I (like to) believe that this light is controlled by the camera's firmware, i.e., it can't be manipulated by software? Can someone knowledgable confirm this?
- shakna 7y ago> I (like to) believe that this light is controlled by the camera's firmware, i.e., it can't be manipulated by software? Hit and miss. If it can be controlled by the camera's firmware, then it can be controlled by software. All it takes is a bug in the firmware, which is unlikely to ever be updated. Some camera lights are controlled by the firmware, others are wired onto the data line, so the moment data is going either way, they light up. However, defeating the light even in the directly wired case is possible, and has been done many times. If you fire up the camera, take a photo, and turn off quickly enough, the light won't be perceived by the victim. (I believe the FBI and the NSA both had tools that did this that became public knowledge a number of years ago).
- gumby 7y ago> All it takes is a bug in the firmware, which is unlikely to ever be updated. FWIW, Apple system (OS) updates frequently include firmware updates, not only for the FEP/boot code but other devices as well, especially for security issues. Apple has been pretty good about this. Not addressing the rest of your comment, just this one point. PS: don’t know why the phones don’t have a similar indicator for “front camera on” and “speaker mode on”. BOM cost I suppose.
- lloda 7y agoThe hardware could easily be designed so that whenever the light is turned on, it cannot be turned off for a second or w/e. Seems like an obvious solution.
- moooo99 7y agoiirc some laptops do this. As soon as there is data transmitted from the camera, the light will turn on. Another solution would be the sliding camera cover some manufacturers have, but that doesn't really help with the built in microphone.
- eknkc 7y agoIt is. However there was an exploit on older macbooks where an attacker managed to flash the firmware, disabling the led. I believe recent macs are much hardened on both hardware and software. Still a possibility.
- Dobbs 7y agoI was under the distinct understanding that on modern macbooks it was hardwired in. If the camera receives power, then the light is on. If the camera doesn't have power then the light is off. edit: seems I'm wrong from googling
- simonh 7y agoOn modern Macs since some time before 2016 there is a hardwired line from the sensor to the LED that is not vulnerable to a firmware hack[0]. However, if an app just takes still photos the light could be on for a very brief period of time. [0]https://daringfireball.net/2019/02/on_covering_webcams https://daringfireball.net/2019/02/on_covering_webcams
- danieldk 7y agoAlso, the Mic is disconnected in hardware when you close the lid: https://support.apple.com/guide/security/hardware-microphone-disconnect-mac-ipad-secbbd20b00b/web https://support.apple.com/guide/security/hardware-microphone...
- speedgoose 7y agoThe light isn't really a good solution anyway. "We observed that, on average, fewer than half of our participants (45%) noticed the existing indicator during computer-based tasks. When seated in front of the computer performing a paper-based task, only 5% noticed the indicator." - Somebody's Watching Me?: Assessing the Effectiveness of Webcam Indicator Lights - https://dl.acm.org/doi/abs/10.1145/2702123.2702164 https://dl.acm.org/doi/abs/10.1145/2702123.2702164
- WilTimSon 7y agoCould those stats be improved with a different type of light/higher intensity? A sound notification wouldn't be practical, I suppose, but that is also easier to notice than a tiny green dot on the top of the screen.
- neilalexander 7y agoIf the LED blinked for 5-10 seconds before turning steady then it might be more readily noticed.
- reaperducer 7y agoOr, if on a phone, the flash could strobe for a certain amount of time.
- ForHackernews 7y agoRecent Thinkpads have a physical plastic cover that slides to obscure the camera.
- oefrha 7y agoIn addition to the hardware light, I also use Micro Snitch (from the maker of Little Snitch) which provides on-screen notification whenever the camera/microphone is activated/active. https://obdev.at/products/microsnitch/index.html https://obdev.at/products/microsnitch/index.html
- Etheryte 7y agoOversight (by Objective-See) is another great alternative, covers the same use-case with block and allow notifications. https://objective-see.com/products/oversight.html https://objective-see.com/products/oversight.html
- nathancahill 7y agoClever name. Love both products.
- deleted 7y ago[deleted]
- corentin88 7y agoAlways thought a security issue like this one was about to appear someday. Kudos to the bug hunter.
- rasta78 7y agoI found 75k for such a severe security issue a low figure, on apple security bounty page the max pay for such exploit is 500k. https://developer.apple.com/security-bounty/ https://developer.apple.com/security-bounty/
- mulmen 7y agoIt’s a bug in Safari, not in the webcam so that may be why?
- save_ferris 7y agoThat could be, but it’s still far too low. I imagine that a Black Mirror type of scandal involving this exploit could do many millions if not billions in damage to Apple’s finances. Not to mention what such an exploit might fetch on the black market.
- elldoubleyew 7y agoI firmly believe that a government intelligence operation would be willing to pay far more than 75k for this.
- saagarjha 7y agoBug bounty payouts are not meant to match what you can get on the black market.
- mulmen 7y agoThat seems like a major flaw in bug bounties then. What else could they be competing with?
- saagarjha 7y agoThere's more to the black market than just money: you often need to deal with unscrupulous individuals (possibly a couple of levels removed) and risk going to jail. The bounty incentivizes researchers to research and disclose, not disincentive people who were going to sell them anyways (who will pay whatever it costs to get these anyways).
- mulmen 7y agoThis is why I have a piece of tape over my webcam. I really don’t need a webcam on my MacBook at all. Kinda like I don’t need a microphone on my TV. Why are these not optional on devices? How do we know this is really what consumers want? It feels like a lesson from the “you can have any color as long as it’s black” school of consumer choice.
- timwis 7y agoBut what about the microphone?
- mulmen 7y agoI don’t have an easy (non-destructive) fix for that one and I actually do voice chats with my laptop. I’d feel better about a real hardware switch for both or a separate device. Sadly that doesn’t seem to be an option.
- Cthulhu_ 7y agoThere's external microphones with an on/off switch; of course, if you can't tell Mac to never use the builtin microphone it's probably neither here nor there.
- mulmen 7y agoWell the benefit of an external device is I can unplug it and put it in a drawer :) The problem is I can’t confidently defeat the builtin devices. I would be more comfortable if they just didn’t exist.
- kylec 7y agoAnd what about all your data? (photos, emails, texts, browsing history, passwords, etc) If an attacker has compromised my computer to such an extent that they’s be able to record me, I’d be more worried about access to my private data than I am about being photographed through the webcam.
- thyme_tea 7y agoThis exploit works by imitating a website which has camera/microphone priviliges, correct? So could you prevent it by revoking all of said priviliges for all websites in Safari's settings?
- om2 7y agoOn a vulnerable version you could do that. For clarity, the bugs that led to this have been fixed in the latest Safari version on all platforms.
- oefrha 7y agoIt seems URI/authority/domain parsing for authorization purposes is highly risky and leaves a lot to be desired. Another recent high-impact URI parsing bug in Google’s core library that led to Google-wide domain check bypass: https://news.ycombinator.com/item?id=22527842 https://news.ycombinator.com/item?id=22527842
- floatingatoll 7y agoA much better technical explanation than this ‘landing page’ edition is here: https://www.ryanpickren.com/webcam-hacking https://www.ryanpickren.com/webcam-hacking This is amazing work. You’ll never see XFO the same way again. It says that Safari 13.0.4 (macOS) and earlier is required to reproduce; Safari 13.1 was released last week, so if you’re allowing macOS to stay up to date, you’re okay there. I didn’t see a clear answer for iOS, but if they published, it has likely been fixed in iOS as well (or else they’d miss out on a $75k bounty).
- emmelaich 7y agoFWIW, Zoom clearly has your microphone on when muted .. because it alerts you that you are muted when it detects noise.
- LoSboccacc 7y agosame has the Google meet web page, i'd be more concerned if a web page mute button could change my is sound hardware settings
- diebeforei485 7y agoZoom can't mute your mic entirely, only macOS can do that. What it does is not transmit your voice.
- floatingatoll 7y agoThis occurs when you've joined the call with computer audio. I was super glad to see that popup when it started appearing a while ago. I don't work for Zoom, but here's how you can manage Zoom vs. microphone stuff in more detail than just Mute: If your Preferences > Audio > "Join audio by computer" setting is enabled, then it'll do so automatically. While in a call, if you want to disconnect the microphone rather than mute it, hit the dropdown menu to the right of the Mute button and choose "Leave computer audio" at the bottom.
- wil421 7y agoMicrosoft Teams does the same thing.
- diebeforei485 7y agoExcellent work.
- stock_toaster 7y agoI currently use oversight[1] to monitor mic and camera access and permissions. It wouldn't protect against a kernel-mode (or rootkit) level exploit, but provides _some_ coverage at least (at least that is what I tell myself). [1]: https://objective-see.com/products/oversight.html https://objective-see.com/products/oversight.html
- danieldk 7y agoThere is also Micro Snitch from the makers of Little Snitch: https://obdev.at/products/microsnitch/index.html https://obdev.at/products/microsnitch/index.html
- 7777fps 7y agoIs it me or does "webcam hacking" really undersell the bug here? From the write up at https://www.ryanpickren.com/webcam-hacking https://www.ryanpickren.com/webcam-hacking , the bug chain appears to allow script execution in "arbitrary" domain context, which at first glance seems much bigger than just webcam extraction. Sticking up someone's face is attention grabbing compared to what could be done with that kind of power. Is it because of the first bug in the chain that only the media-permissions was affected by the context confusion? For example being able to extract cookies or local storage from other contexts would be a much bigger deal (local storage is sometimes used to store XSRF protection keys or other credentials), so I assume that wasn't at all affected? Did any other parts of safari use the same broken context awareness as the media permissions or do we know that it was it isolated to media permissions?
- dannyw 7y agoThere’s only one way to find out: downgrade your Safari and call document.cookie using the PoC codes.
- 7777fps 7y agoI don't have any Mac devices or emulators or I would give it a try.
- lilyball 7y agoThis appears to only control the media permissions. I'm reading through the long writeup now and it talks about how this is something other than the site origin, instead it's running its own URL parser with custom logic against all pages in order to map them to website permissions.
- nihonium 7y agoGood work! People talk about how a webcam cover is essential on laptops but I think iOS side of this exploit is even more crucial. Very few people use camera covers for phones, cause they are ugly and new phones have FaceID etc which makes impossible to use a camera cover daily. More importantly, we take our phones to places more private, like bathrooms. Now that iOS Safari support front facing camera stream, I think this discovery worth more than $75K
- 101404 7y agoEvery computer controlled camera and microphone should come with an actual mechanical switch that cuts power.
- jefftk 7y agoI wonder whether any of this code predates the Blink-WebKit fork, and if so whether any of this applies to Chrome/Edge/Brave/etc. I'm guessing no since they're not mentioning it, but a lot of this sounds like deep old stuff.
- aquir 7y agoop deserves the $75k! Good work!
- nayuki 7y agoA somewhat related concurrent news item: https://news.ycombinator.com/item?id=22767843 https://news.ycombinator.com/item?id=22767843 "Hardware Microphone Disconnect in Mac and iPad"
- tolmasky 7y agoIt says here he was awarded $75,000, instead of the $150,000 listed on the Apple page for this type of exploit. Later on, Apple specifies: > Reports that include a basic proof of concept instead of a working exploit are eligible to receive no more than 50% of the maximum payout amount. Can someone explain to me what would have counted as a “working exploit” here vs. simple proof of concept? They can’t mean actually finding it in the wild right? The OP’s example seems working enough to me, and this looks like a really bad bug.
- tw04 7y ago$75,000. One-click remote partial access to sensitive data. $150,000. One-click remote broad access to sensitive data. Only having access to the camera is partial access. It's not full access to the system - I'd agree with that.
- tolmasky 7y agoGoing along with other comments on this thread, if it's the case that you have access to anything that domain has access to, and the webcam is just a flashy way of demonstrating this, I would certainly consider it broad access. I would assume this is the case since the problem appears to be in URI parsing, not webcam code. Of course, if the bug was reported as a webcam issue then I suppose it could be maybe argued that it's fine that they paid for it as such.
- tw04 7y agoI'm not saying I agree or disagree with what Apple gave him, I'm just stating that's why. His proof of concept wasn't god-mode, it was access to the webcam. If he wants the extra $75k, and the exploit allows full access, I'd imagine he'd be incentivized to show full access.
- dodobirdlord 7y agoIt gives access code only to things that the user has given a domain access to, which is not something the attacker can influence.
- david_w 7y agoEveryone should stop writing webpages which require javascript. Javascript is a security nightmare responsible for the overhelming majority of web-based CVEs . Javscript's contributes mostly fluff to the vast majority of webpages. What's worse, some pages check for it and deliver a totally blank page if it's not enabled, just to punish the non-compliant. Even worse than all of the above is the fact that Javscript is the vehicle through which users are IDed and tracked. It's the reason why telling your browser to dump-cookie at the end of a session is ineffective. Javascript is popular because people who own websites demand it be enabled. They demand that so they can fingerprint you- no other REAL reason for Javascript's popularity. Every single person on this particular forum eithers knows or can clearly see what I am saying is true, but their jobs depend on them selling their Javascript skills and that's the reason this post, as you read it, is fading to gray as its downvoted. Javscript is the instrumentality of the surveillence state. That's 98% of its utility. All webpages should have a non-Javascript, "here's the info" version available and the fact they don't is a scandal and we are the culprits.
- notRobot 7y agoI have to agree with you. The vast majority of websites on the internet don't need JS for any functionality, and it's only used for ads, tracking, etc.
- kube-system 7y agoTools don't exist for their own sake. They exist to solve problems. In the world before javascript, we still had interactive applications on the internet, we just built them with different tools, which were usually worse than the security model of javascript. If we got rid of javascript, we wouldn't get rid of interactive applications, we'd just build them a different way again. Also, you can definitely be fingerprinted without javascript. The web is a huge stack of technologies, and most of them can be fingerprinted, all the way down to at least layer 4. (...and layer 2 if you're not on a network you control)
- zlsa 7y agoJavaScript is not necessary on the majority of pages it's used on, but to say everybody should stop using it on the web is absurd. JS makes Google Docs, Slack, and a thousand other applications possible; without it, they'd need to be native applications instead (which, while needing to be manually installed, almost always don't have the level of sandboxing that browsers normally provide.)
- Razengan 7y agoAt this point, if you’re not going to stop reinventing every single wheel to make websites turn into apps, might as well treat every website like an standalone, fully-sandboxed app with its own set of permissions just like every other native app.