14 ms·
>2013: iSeeYou: Disabling the MacBook Webcam Indicator LED https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/
by NovemberWhiskey 6y ago
>2013: iSeeYou: Disabling the MacBook Webcam Indicator LED https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569
... applies only to older Mac notebooks from like 2008 period which are long since obsolete according to Apple's announced support policy.
>2016: Your Mac’s Camera Can Be Hacked https://www.intego.com/mac-security-blog/your-macs-camera-ca.. https://www.intego.com/mac-security-blog/your-macs-camera-ca....
... refers specifically the exploit above.
>2016: Former NSA employee: This hack gains access to your Mac's webcam https://www.cnet.com/news/mac-webcam-hack-ex-nsa-employee/ https://www.cnet.com/news/mac-webcam-hack-ex-nsa-employee/
... is an attack that depends on the camera already being in use by another application and therefore has nothing to do with the camera indicator.
- dvfjsdhgfv 6y agoThe problem is in the design: by not providing a hardware switch, all we have is trust. As we can see from the past, unfortunatly it's not enough.
- GuiA 6y agoI had a laptop with a physical switch for WiFi/Bluetooth in 2006 or so (with a matching orange/blue light that would turn up when you toggled it). The problem was that this was actually all done by a software driver - when I booted into Linux with the laptop I was surprised to find that the bluetooth/wifi modules were on regardless of the switch's position. At the end of the day, unless you have a really nice microscope, solid understanding of electrical engineering, and a few tens of thousands of hours ahead of you, you have to trust whoever you're buying the hardware from that it will do what they say it will. No amount of hardware efforts can solve the fundamental human trust problem.
- dvfjsdhgfv 6y agoI had another laptop with a hardware switch and a corresponding LED, and it worked exactly as it should - the hardware was completely inaccessible under Linux. So yes, it can be done and it's not rocket science.
- GuiA 6y agoYes, what you describe is trivial - and it would be similarly trivial to design a module that appears to respect the switch (regardless of Linux/Windows) and yet records things surreptitiously, only to offload it at a later date. Remember the amount of effort VW was willing to expand to cheat emissions testing.
- jimnotgym 6y agoThat's why I like the old Thinkpad with the physical cover and the LED
- basch 6y agoIt would be pretty impressive for someone to get the camera to work through a physical cover.
- brlewis 6y agoIt would be mildly impressive if a manufacturer made a fake cover with a switch to detect when it's "closed" and make the main camera stream filtered to look like the cover is real, while having a 2nd back-door unfiltered stream. Of course this could be detected by someone who took the unit apart.
- int_19h 6y agoOn Thinkpads, the cover has a prominent red dot painted on it, that ends up in the location where camera lens would normally be. And, of course, you can visibly see the edge of the cover move as you slide it. So I don't know how you'd fake that.
- gmantg 6y agoJust pick a material that's opaque only in visible spectrum.
- Angeo34 6y ago>tens of thousand of hours >electrical engineering Yea gluing a piece of tape is a piece of art even Marx wasn't able to.
- GuiA 6y agoThe question isn't whether you can add a cover to the product after the fact, it's whether you can trust a switch on a product to do what the manufacturer says it does.
- im3w1l-alt 6y agoIt's like the halting problem. It's hard to decide whether a given switch works in the general case. But it's possible to design an obviously correct breaker. Edit: the gnarly thing might be ensuring it doesn't harvest power through data wires or store power in covert capacitors or batteries.
- grogenaut 6y agoAt this time we specifically bought computers with modules for radios that we could pull. Toshiba was happy to supply this to us.
- SAI_Peregrinus 6y agoI have a Lenovo Thinkpad T480. Its webcam switch is a slider that covers the webcam lens. You don't need a fancy microscope, or a solid understanding of EE, or tens of thousands of hours. You need the ability to see the slider cover the lens. Takes all of half a second and at least 1 eye.
- drdaeman 6y agoPlot twist: the slider material could be opaque in the visible spectrum but transparent in IR. /s
- valuearb 6y agoAnd the hackers still win, cause no one remembers to slide it shut after a call, and they can hack the led so there is no physical indicator when they are watching.
- macintux 6y agoI honestly can't remember the last time I used my camera during a company meeting, and I've been working remotely since March. So, there's definitely value to a built-in cover; in my case it would stay shut permanently.
- valuearb 6y agoA piece of tape does that without the security theatre of a cover.
- SAI_Peregrinus 6y agoI prefer aluminum foil under the tape that's over the lens so it can be flipped up out of the way easily but still block the view. But the cover does the same thing and doesn't take the effort of putting in a piece of tape.
- stjohnswarts 6y agoYeah but it's just as easy to put some black tape over most laptop cameras. Evidently apple decided to not consider that option
- NovemberWhiskey 6y agoBut you just moved the goal-posts from a discussion about whether the implementation was faulty (and Apple was misleading their product owners) to one about whether the design compromises are right. Apple claims that the LED comes on when the camera is active, which it claims helps protect your privacy. That seems to be true, and certainly no-one seems to have any contradictory examples that are not 12+ years old. I can argue that when one uses a sliding cover, one can easily forget to reset it after a video chat. The design is bad. The right solution is simply not to have a camera. It's just a different design compromise.
- causality0 6y agoThe question is whether this is a firmware implementation that's just waiting for a 0-day or if the +V for the CMOS sensor is literally wired to the LED. If the latter I'd like to see a picture of it.
- ISL 6y agoSomeone out there can buy a broken MacBook off eBay and score some YouTube notoriety to do this very investigation. Bonus points for using a Sawzall to get started.
- zndr 6y agoIt isn't the led is physically slaved to the power of the camera, the previous version was firmware fixed and was hacked, hence the change.
- axoltl 6y agoHi! I was the security architect for this feature on recent Macs. The LED is wired to the camera PMIC and is powered by the voltage rail that powers the camera. The PMIC will always remain on if the system has power. Macs newer than 4 or so years also have a feature that forces the LED to stay lit for at least 3 seconds after it has been turned on to prevent the single-frame-grab attack.
- dasudasu 6y ago
- zulln 6y agoI thought the LED is now connected to the camera by hardware? You cannot disable it by firmware while the camera is on.
- kelnos 6y agoI don't see how that fixes the problem; if you don't trust Apple to build in hardware safeguards around the camera indicator light, why would you trust them with a hardware switch?
- sli 6y agoA hardware switch should in theory be more easily verifiable than a software one through physical testing. Running tests on PCB traces to verify that a switch indeed works is probably a whole lot easier in general practice than decapping chips or decompiling and analyzing low level firmware or low level OS components.
- ryandrake 6y agoBut are you going to run those tests on PCB traces on your own hardware? If not, then you have to trust that your hardware is identical to whatever hardware was torn-down and tested. I suppose this is good enough unless your threat model includes someone swapping your computer enroute to you with a modified one.
- mekkkkkk 6y agoBut even then, are you sure the computer whose PCB you tested hasn't been swapped or modified since then? That Chinese operatives didn't splinter cell it while you were out grocery shopping?
- milesvp 6y agoJust so you know, switches in something as complicated as a laptop have a good chance at being connected to a processor , with firmware being the thing that determines what the switch does. So you still need trust, even with a physical switch. Source: write firmware for a living, and write drivers for physical switches.
- philwelch 6y agoIt doesn’t need to be a switch. My current work laptop is an HP. It has a little plastic camera cover that slides back and forth to cover the camera.
- DoofusOfDeath 6y agoThat's a good point. I'm guessing that people calling for a "hardware switch" implicitly mean one that cannot be overridden by firmware. I.e., a traditional switch inline on the circuit(s) connecting the camera / microphone to the rest of the system.
- saagarjha 6y agoOn MacBooks Apple says their microphone disconnect is "done in hardware alone", so it might be that closing the lid disconnects something physically.
- amelius 6y agoIt should be implemented with the same robustness as if the user's life depended on it. As an analogy, you wouldn't implement a car brake by running it through some firmware. Instead, you'd preferably make a direct physical connection between the pedal and the actual brake.
- tehjoker 6y agoThere's another angle, which is that even if the wiring works and forms an iron clad promise the camera is not working, not having camera covers trains the population to be okay with having cameras pointed at them all the time, even in their most personal and private spaces.
- dathinab 6y agoDoesn't matter. For many people the trust in integrated laptop cameras has been thoroughly eroded especially in case of Macs. (From my experience by interacting with people not having much tech experience, limited to Germany, maybe also limited to the social cycle(s) I interacted with.) The paradox thing is that the same people who often don't trust webcams in Apple Laptops or Apple All-In-One PCs do not bother or even think about weather or not the camera in their iPhone could spy on them or weather or not they microphone in webcams could still spy one them...
- dividedbyzero 6y agoMaybe that's misguided and naive, but I pretty much trust my phone to protect me from bad actors taking over the camera; I'll have to trust the apps I use that have camera access to not spy on me, but those are few. Until relatively recently, any userspace app on my computer could freely access the camera and microphone, including background processes and malware, so that feels a lot riskier. There seems to be a permission for this that must be granted in the newer macOS versions, but I assume there might be ways around that.
- pletnes 6y agoMy thoughts exactly. On my phone, I have to trust Apple. On my laptop, I have to trust everyone who wrote code I downloaded. That’s two quite different crowds.
- misterhtmlcss 6y agoThen you haven't seen all the malware and spyware on phone apps that have been approved by Apple and Google right? I don't trust anyone regarding my tech as far as I can throw them. I could have a System 76 machine with latest xyz hacker proof Linux distro and I'd still assume all was heard and listened to through that device. Just makes no sense to trust any mass production device.
- warent 6y agoThis might be true for yourself as a technical savvy person. Camera covers are particularly important to people who are self-aware enough to realize they don't have the tech skills to keep bad actors from gaining access to their camera
- alunchbox 6y agoThere's a reason Zukerberg's laptop has its mic and camera tapped up. It doesn't matter what device you use unless there's a physical switch to disconnect it'll never be safe. Software can ALWAYS have zero days, just because it hasn't been exploited yet doesn't mean it can't be.
- the-pigeon 6y agoBut can't you specifically wire the indicator light to always be lit if the camera has power? I don't see Apple claiming they've done that but a correct design would make the indicator light work that way and be related to software at all. Meaning you could only disable the indicator light by physically modifying the device.
- ohazi 6y agoThis is the only correct design, yet almost nobody does this. One of the challenges is verifying that this was done correctly. You may be able to verify a design like this once with a teardown, but it's impractical to verify your particular device, and next to impossible to re-verify this every time you leave your laptop unattended.
- foota 6y agoMy threat model doesn't involve someone disassembling my laptop and rewiring it, at that point they might as well just plant a bug.
- inopinatus 6y agoThis isn’t speculation. Opening up hardware to modify the internals is something that covert agencies do, and it’s naive to think that the purpose is equivalent to a simple bug. As someone who posts to Hacker News you are by almost any definition a potential information source or APT vector.
- 6y ago
- flowersjeff 6y agoNice try there Mr.CIA (wink-wink)...
- Wowfunhappy 6y agoIt's connected to the damn circuit! You can't power up the webcam without powering up the light any more than you can make the camera see through a piece of electrical tape.
- robotcookies 6y agoThere could still be a circuit in the light that could pass the current without lighting up. Or even if there was no such thing, it could be added in the future after everyone was shamed into believing you are a fool for putting tape over your camera. There are probably other ways. Stop trying to shame people just because you haven't thought of a way to bypass this.
- 1123581321 6y agoNeither of those things is the case. You can’t power the camera circuit without passing through the low power light. We can rely on the diligent work of security researchers to attempt bypasses and do teardowns for us, so the risk of Apple compromising an older model only exists for people who buy immediately on release. The support document also suggests a paper-thin cover, so it’s not attempting to shame anyone.
- rurp 6y agoIs your point that because these issues have been fixed there will never be a new camera exploit in the future? I don't see how what you're saying supports that. If your point is simply that Apple has resolved camera vulnerabilities in the past, that's nice, but doesn't exactly give me much peace of mind about future vulnerabilities.
- ehsankia 6y agoNo, the point is that old light indicators were done in software (and were open to exploits), whereas newer indicators have all since moved to being wired right in the hardware. The power of the webcam lights up the indicator.
- GekkePrutser 6y agoBut most of this 'hardware' is still software. Firmware inside the webcam itself, which could also be hacked. Most webcams do report themselves to the OS while inactive, so they are actually communicating with the system (and thus powered)
- Diesel555 6y agoIf the sensor is physically getting power, the light is too, unless the wire is broken. They are on the same circuit. It is not a firmware thing, its basics circuits Physics 101. The light could be burnt out, yes. The wire could break sure. But it can't be hacked (minus pulse modulation, not giving the light enough time to light up). But if you power up the camera, and something isn't physically broke... the light comes on. I know the privacy incident has already happened, separate argument. I think people are missing the hardwired point. This discussion should be focusing on the fact that if the camera has powered on, and we see it, it's already too late.
- dingoegret 6y ago>applies only to older Mac notebooks from like 2008 Point being that the indicator light can be hacked and isn't too be blindly trusted.
- jachee 6y agoNo longer. The power lead for the camera requires electricity to pass through (and, thus illuminate) the indicator LED. Can't hack that without extensive physical access to the machine.
- pishpash 6y agoDoesn't inspire any confidence that the indicator is subject to bugs. It can happen again.
- avodonosov 6y agoit was hacked in the past - that's the point of the above comment No guarantee it can't be hacked again.
- nojito 6y agoThere is a guarantee because there’s no way to bypass the wiring to the light to power the camera.
- edoceo 6y agoIndicator of use doesn't block a hack, just let you know it happened.
- cdnpal 6y agoThat's not what Mark Zuckerberg, the CEO of Facebook says: https://www.irishtimes.com/polopoly_fs/1.2742701.1470151986!/image/image.jpg_gen/derivatives/box_620_330/image.jpg https://www.irishtimes.com/polopoly_fs/1.2742701.1470151986!...
- IvyMike 6y agoLet me genuinely ask: why do you believe this? Because Apple said so? I simply don't have this level of trust. Because someone disassembled their MacBook and reverse engineered things? And that person is trustworthy and competent? That is better, but even if it was true for the MacBook they reverse engineered, suppliers make tweaks to parts all the time. Can I be sure that my MacBook still has the exact same camera? Because you opened up your MacBook to confirm? Maybe then you can trust it.
- saagarjha 6y agoI don't see how Apple could do anything for you in that case.
- roenxi 6y agoI expect you are probably correct, but it doesn't really matter. If you don't want to be filmed, the correct engineering approach is not to have a camera pointed at you 24/7. It is a bit like the gun rule of not pointing a gun at things you don't want to shoot - sure, the trigger should be enough of a control, but accidents happen. If you spend your entire life with a camera pointed at your face, your face (and activity) will be accidentality filmed by that camera sooner or later. Indicator or otherwise. The indicator light is a good idea but I'm still spiritually on the side of the tape people.
- neltnerb 6y agoIndeed, I'm a little surprised Apple didn't follow the Thinkpad approach of simply having a sliding piece with an aperture that extremely obviously blocks the camera. Surely Apple can't seriously think their users would be confused by this and complain... I don't think my desktop computer's webcam is likely to get hacked either but I'm still going to unplug it when I'm not using it. Complex systems are hard to secure.
- hn_throwaway_99 6y agoI can see Jony Ive's head exploding: "Sullying my perfect, smooth, invented-new-aluminum-machining-technology-to-make-it-possible masterpiece with some latch?! Why don't you go work for Dell."
- wl 6y agoThe original iSight camera had a leaf shutter. It's not a foreign concept to them.
- saagarjha 6y agoThe original iSight had a hundred times more depth and also happened to be an external camera. Bringing it up here is irrelevant.
- bigwavedave 6y ago
- rozap 6y agoOh this is very welcome and good news that computer exploits have been solved.
- agf 6y agoI have personally turned on the camera without the indicator light coming on on a 2012 Macbook Pro 15" with double-digit percent success rate, meaning someone with more time / expertise could probably do it consistently. I have been unable to do it on newer 15" pros or other models (Air / pro 13").