10 ms·

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tie

by 542458 2y ago

They are hardwired on Macbooks. From Daring Fireball, quoting an email from an Apple engineer. > All cameras after [2008] were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. […] > So, no, I don’t believe that malware could be installed to enable the camera without lighting the LED. My concern would be a situation where a frame is captured so the LED is lit only for a very brief period of time. https://daringfireball.net/2019/02/on_covering_webcams https://daringfireball.net/2019/02/on_covering_webcams

aftbit 2y ago
>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.
- varenc 2y ago
  I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures one quick frame.
  - MaxikCZ 2y ago
    A capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed
    - RA2lover 2y ago
      The trick is to keep using the camera until that capacitor is discharged. I'm pretty sure most cameras can run at voltages below a LED's forward voltage nowadays.
    - squarefoot 2y ago
      I don't think they would waste a high value capacitor just to keep a led lit for longer, also a led directly lit by a capacitor would be noticeable by slowly dimming when the capacitor discharges. It's more likely that the signal driving the led comes out of a monostable implemented in code: pin_on() drives the led on; pin_off() waits n secs then drives the led off.
      - deleted 2y ago
        [deleted]
      - altairprime 2y ago
        This is Apple, so that assertion isn’t guaranteed valid like it would be for non-enterprise HP or Lenovo. They absolutely would invest in a capacitor if that’s what it takes, as they are maximally focused on camera privacy concerns and have made a point of that in their security marketing over time; or else they wouldn’t be allowing hardware security engineers to brag about it, much less talk publicly about it, at all. EDIT: It’s not just a capacitor, it’s a full custom chip, that can’t be software-modified, that keeps the light on for 3 seconds. https://news.ycombinator.com/item?id=42260379 https://news.ycombinator.com/item?id=42260379
    - HeyLaughingBoy 2y ago
      Logic on an already existing ASIC is going to be cheaper than a capacitor.
      - MrDrMcCoy 2y ago
        This is counter-intuitive enough to warrant further explanation.
  - throwaway984393 2y ago
    [dead]
  - aftbit 2y ago
    See then it's not hardwired at all. It is equally vulnerable to a reflash. Apple just did hardware security (i.e. signed firmware) better and also are relying on security through obscurity (its not a publicly available part).
    - deleted 2y ago
      [deleted]
  - axoltl 2y ago
    I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-architect how the LED is turned on. I was the security architect for the feature. A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.) On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds. This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board. tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. 0: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-brocker.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
    - Mistletoe 2y ago
      Thank you for doing this.
    - rubatuga 2y ago
      Thanks, this is the reason I browse Hacker News
    - PicardsFlute 2y ago
      Thanks for posting this interesting tidbit! I find this kind of knowledge absolutely fascinating!
    - ohhnoodont 2y ago
      There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?
- ndiddy 2y ago
  The context from the article the parent comment linked is that Mac webcams made prior to 2008 both had the camera LED controlled in firmware and didn't verify the camera firmware blob when it was downloaded into the camera's RAM. The quote you're replying to simply says that Apple solved these security issues by tying the LED to a hardware signal AND verifying the camera firmware blob. The result is still that there's no way to turn on the webcam without making the LED light up.
- danielheath 2y ago
  AFAIK iOS devices use a tiny firmware on the camera and a larger one on the secure enclave chip. If you successfully compromise the host OS and also the secure enclave firmware, that might be enough to let you turn on the camera (without vsync) and reconstruct the correct image via later analysis... but at that point you have committed tens of millions to the hack (so you'd better not overuse it or it'll get noticed & patched).
- pclmulqdq 2y ago
  Many complex chips have GPIO signals rather than hardwired outputs. That way you can select any [5-10] of [20-100] functions for each pin. As a result, things that you think should be hardwired are controlled by firmware.
wseqyrku 2y ago
Yeah, the camera needs a physical lid.
jonplackett 2y ago
I wonder how quickly it turns on/off as per Gruber’s worry - if you just record a single frame would it even be visible if looking right at it?
- Tempest1981 2y ago
  Below, axoltl writes: > no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. https://news.ycombinator.com/item?id=42260379 https://news.ycombinator.com/item?id=42260379
  - jonplackett 2y ago
    That is quite clever! Thanks
accrual 2y ago
> My concern would be a situation where a frame is captured so the LED is lit only for a very brief period of time. Maybe enable a pre-charged capacitor to the LED whenever the circuit is activated? A "minimum duty cycle" for the LED might help solve this.
makeitdouble 2y ago
While Apple made a laudable effort in this design, sadly it requires thoughtful care and design at every iteration. Typically the iPhone team couldn't pull it off and the only official claim is for macbooks. I think it's simpler to assume that most devices can be hacked and the LED indicator isn't infailable than to always keep in mind which device lines are supposed to be safe and which ones aren't.
- microtonal 2y ago
  Apparently it was purely in software on iPhone/iPad. However, starting with the iPhone 16 and M4 iPad Pro, the LED indicator is rendered by a separate secure exclave: https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip-has-a-useful-security-feature-that-debuted-on-apples-m4-chip https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip... https://mastodon.social/@_inside/112552696723119626 https://mastodon.social/@_inside/112552696723119626
  - saagarjha 2y ago
    That is purely in software.
nine_k 2y ago
That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would incur a few cents more in BOM, and quite a bit more in being paranoid, well, I mean, customer-centric.
- jdblair 2y ago
  or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!
  - SiVal 2y ago
    Would a bit of Post-It Note (for minimal adhesion) damage the screen coating if left on most of the time? Would even that much thickness stress the screen when opened and closed thousands of times? Is there a better (self-service) material?
    - pcblues 2y ago
      Plastic slide covers that stick on are pretty cheap if your laptop doesn't already have one. I also think that the open microphone issue is a greater problem, especially with the current ability of speech-to-text, but what you utter may not be as important as being seen "doing a Toobin" during an online meeting. YMMV :) (I won't expand that acronym!)
    - cuu508 2y ago
      > Would a bit of Post-It Note (for minimal adhesion) damage the screen coating if left on most of the time? Possible, I have one IPS monitor with a spot on screen where the color is pale. I had a post-it note there and I guess something bad happened when I tore it off.
      - 2y ago
dkga 2y ago
Do you know if the same occurs in iPhones? That was always my assumption, but seeing a Mac-only response makes me wonder if it is addressing a Mac/only question or if it’s applicable only to Macs.
izacus 2y ago
Yep, and Apple changed that after some schools were spying on their students through software that could enable cameras on MacBooks without the light: https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...
- TheKarateKid 2y ago
  I've also read of exploits which found ways to burn out the Macbook LED light by somehow messing with the power being supplied to the webcam without damaging the camera. Thus afterward, the LED light no longer powers on when in use but the camera still works.
- saagarjha 2y ago
  Your Wikipedia article disagrees with the claim that it could disable the light.
Anna3321AQ 2y ago
[dead]

by 542458 2y ago

aftbit 2y ago

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

varenc 2y ago
I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures one quick frame.
- MaxikCZ 2y ago
  A capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed
  - RA2lover 2y ago
    The trick is to keep using the camera until that capacitor is discharged. I'm pretty sure most cameras can run at voltages below a LED's forward voltage nowadays.
  - squarefoot 2y ago
    I don't think they would waste a high value capacitor just to keep a led lit for longer, also a led directly lit by a capacitor would be noticeable by slowly dimming when the capacitor discharges. It's more likely that the signal driving the led comes out of a monostable implemented in code: pin_on() drives the led on; pin_off() waits n secs then drives the led off.
    - deleted 2y ago
      [deleted]
    - altairprime 2y ago
      This is Apple, so that assertion isn’t guaranteed valid like it would be for non-enterprise HP or Lenovo. They absolutely would invest in a capacitor if that’s what it takes, as they are maximally focused on camera privacy concerns and have made a point of that in their security marketing over time; or else they wouldn’t be allowing hardware security engineers to brag about it, much less talk publicly about it, at all. EDIT: It’s not just a capacitor, it’s a full custom chip, that can’t be software-modified, that keeps the light on for 3 seconds. https://news.ycombinator.com/item?id=42260379 https://news.ycombinator.com/item?id=42260379
  - HeyLaughingBoy 2y ago
    Logic on an already existing ASIC is going to be cheaper than a capacitor.
    - MrDrMcCoy 2y ago
      This is counter-intuitive enough to warrant further explanation.
- throwaway984393 2y ago
  [dead]
- aftbit 2y ago
  See then it's not hardwired at all. It is equally vulnerable to a reflash. Apple just did hardware security (i.e. signed firmware) better and also are relying on security through obscurity (its not a publicly available part).
  - deleted 2y ago
    [deleted]
- axoltl 2y ago
  I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-architect how the LED is turned on. I was the security architect for the feature. A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.) On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds. This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board. tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. 0: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-brocker.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
  - Mistletoe 2y ago
    Thank you for doing this.
  - rubatuga 2y ago
    Thanks, this is the reason I browse Hacker News
  - PicardsFlute 2y ago
    Thanks for posting this interesting tidbit! I find this kind of knowledge absolutely fascinating!
  - ohhnoodont 2y ago
    There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?
ndiddy 2y ago
The context from the article the parent comment linked is that Mac webcams made prior to 2008 both had the camera LED controlled in firmware and didn't verify the camera firmware blob when it was downloaded into the camera's RAM. The quote you're replying to simply says that Apple solved these security issues by tying the LED to a hardware signal AND verifying the camera firmware blob. The result is still that there's no way to turn on the webcam without making the LED light up.
danielheath 2y ago
AFAIK iOS devices use a tiny firmware on the camera and a larger one on the secure enclave chip. If you successfully compromise the host OS and also the secure enclave firmware, that might be enough to let you turn on the camera (without vsync) and reconstruct the correct image via later analysis... but at that point you have committed tens of millions to the hack (so you'd better not overuse it or it'll get noticed & patched).
pclmulqdq 2y ago
Many complex chips have GPIO signals rather than hardwired outputs. That way you can select any [5-10] of [20-100] functions for each pin. As a result, things that you think should be hardwired are controlled by firmware.

wseqyrku 2y ago

Yeah, the camera needs a physical lid.

jonplackett 2y ago

I wonder how quickly it turns on/off as per Gruber’s worry - if you just record a single frame would it even be visible if looking right at it?

Tempest1981 2y ago
Below, axoltl writes: > no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. https://news.ycombinator.com/item?id=42260379 https://news.ycombinator.com/item?id=42260379
- jonplackett 2y ago
  That is quite clever! Thanks

accrual 2y ago

> My concern would be a situation where a frame is captured so the LED is lit only for a very brief period of time. Maybe enable a pre-charged capacitor to the LED whenever the circuit is activated? A "minimum duty cycle" for the LED might help solve this.

makeitdouble 2y ago

While Apple made a laudable effort in this design, sadly it requires thoughtful care and design at every iteration. Typically the iPhone team couldn't pull it off and the only official claim is for macbooks. I think it's simpler to assume that most devices can be hacked and the LED indicator isn't infailable than to always keep in mind which device lines are supposed to be safe and which ones aren't.

microtonal 2y ago
Apparently it was purely in software on iPhone/iPad. However, starting with the iPhone 16 and M4 iPad Pro, the LED indicator is rendered by a separate secure exclave: https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip-has-a-useful-security-feature-that-debuted-on-apples-m4-chip https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip... https://mastodon.social/@_inside/112552696723119626 https://mastodon.social/@_inside/112552696723119626
- saagarjha 2y ago
  That is purely in software.

nine_k 2y ago

That's backwards. The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way. The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice. Doing that, of course, would incur a few cents more in BOM, and quite a bit more in being paranoid, well, I mean, customer-centric.

jdblair 2y ago
or, you can have a physical switch, like the Framework. that also hits your BOM but its not complex!
- SiVal 2y ago
  Would a bit of Post-It Note (for minimal adhesion) damage the screen coating if left on most of the time? Would even that much thickness stress the screen when opened and closed thousands of times? Is there a better (self-service) material?
  - pcblues 2y ago
    Plastic slide covers that stick on are pretty cheap if your laptop doesn't already have one. I also think that the open microphone issue is a greater problem, especially with the current ability of speech-to-text, but what you utter may not be as important as being seen "doing a Toobin" during an online meeting. YMMV :) (I won't expand that acronym!)
  - cuu508 2y ago
    > Would a bit of Post-It Note (for minimal adhesion) damage the screen coating if left on most of the time? Possible, I have one IPS monitor with a spot on screen where the color is pale. I had a post-it note there and I guess something bad happened when I tore it off.
    - 2y ago

dkga 2y ago

Do you know if the same occurs in iPhones? That was always my assumption, but seeing a Mac-only response makes me wonder if it is addressing a Mac/only question or if it’s applicable only to Macs.

izacus 2y ago

Yep, and Apple changed that after some schools were spying on their students through software that could enable cameras on MacBooks without the light: https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...

TheKarateKid 2y ago
I've also read of exploits which found ways to burn out the Macbook LED light by somehow messing with the power being supplied to the webcam without damaging the camera. Thus afterward, the LED light no longer powers on when in use but the camera still works.
saagarjha 2y ago
Your Wikipedia article disagrees with the claim that it could disable the light.

Anna3321AQ 2y ago

[dead]