6 ms·

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might ma

by aftbit 2y ago

>The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

varenc 2y ago
I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures one quick frame.
- MaxikCZ 2y ago
  A capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed
  - RA2lover 2y ago
    The trick is to keep using the camera until that capacitor is discharged. I'm pretty sure most cameras can run at voltages below a LED's forward voltage nowadays.
  - squarefoot 2y ago
    I don't think they would waste a high value capacitor just to keep a led lit for longer, also a led directly lit by a capacitor would be noticeable by slowly dimming when the capacitor discharges. It's more likely that the signal driving the led comes out of a monostable implemented in code: pin_on() drives the led on; pin_off() waits n secs then drives the led off.
    - deleted 2y ago
      [deleted]
    - altairprime 2y ago
      This is Apple, so that assertion isn’t guaranteed valid like it would be for non-enterprise HP or Lenovo. They absolutely would invest in a capacitor if that’s what it takes, as they are maximally focused on camera privacy concerns and have made a point of that in their security marketing over time; or else they wouldn’t be allowing hardware security engineers to brag about it, much less talk publicly about it, at all. EDIT: It’s not just a capacitor, it’s a full custom chip, that can’t be software-modified, that keeps the light on for 3 seconds. https://news.ycombinator.com/item?id=42260379 https://news.ycombinator.com/item?id=42260379
  - HeyLaughingBoy 2y ago
    Logic on an already existing ASIC is going to be cheaper than a capacitor.
    - MrDrMcCoy 2y ago
      This is counter-intuitive enough to warrant further explanation.
      - ale42 2y ago
        If you are designing an ASIC for the camera, you can include all the required logic gates to control the LED for a cost that is close to zero. It wouldn't impact the production cost of the ASIC, whereas a capacitor is an additional item in the BOM (and to be charged it requires current, more than the LED, so the driver in the IC must be bigger).
- throwaway984393 2y ago
  [dead]
- aftbit 2y ago
  See then it's not hardwired at all. It is equally vulnerable to a reflash. Apple just did hardware security (i.e. signed firmware) better and also are relying on security through obscurity (its not a publicly available part).
  - deleted 2y ago
    [deleted]
- axoltl 2y ago
  I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-architect how the LED is turned on. I was the security architect for the feature. A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.) On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds. This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board. tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. 0: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-brocker.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
  - Mistletoe 2y ago
    Thank you for doing this.
  - rubatuga 2y ago
    Thanks, this is the reason I browse Hacker News
  - PicardsFlute 2y ago
    Thanks for posting this interesting tidbit! I find this kind of knowledge absolutely fascinating!
  - ohhnoodont 2y ago
    There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?
ndiddy 2y ago
The context from the article the parent comment linked is that Mac webcams made prior to 2008 both had the camera LED controlled in firmware and didn't verify the camera firmware blob when it was downloaded into the camera's RAM. The quote you're replying to simply says that Apple solved these security issues by tying the LED to a hardware signal AND verifying the camera firmware blob. The result is still that there's no way to turn on the webcam without making the LED light up.
danielheath 2y ago
AFAIK iOS devices use a tiny firmware on the camera and a larger one on the secure enclave chip. If you successfully compromise the host OS and also the secure enclave firmware, that might be enough to let you turn on the camera (without vsync) and reconstruct the correct image via later analysis... but at that point you have committed tens of millions to the hack (so you'd better not overuse it or it'll get noticed & patched).
pclmulqdq 2y ago
Many complex chips have GPIO signals rather than hardwired outputs. That way you can select any [5-10] of [20-100] functions for each pin. As a result, things that you think should be hardwired are controlled by firmware.

by aftbit 2y ago

varenc 2y ago

I believe that it’s not literally hardwired in the sense that powering up the camera also powers up the camera LED, and instead this relies on logic in the hopefully un-flashable camera+LED firmware. Someone correct me if I’m wrong. You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame. I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures one quick frame.

MaxikCZ 2y ago
A capacitor can hold enough charge to power led for noticable amount of time even if powered for a brief moment, no logic needed
- RA2lover 2y ago
  The trick is to keep using the camera until that capacitor is discharged. I'm pretty sure most cameras can run at voltages below a LED's forward voltage nowadays.
- squarefoot 2y ago
  I don't think they would waste a high value capacitor just to keep a led lit for longer, also a led directly lit by a capacitor would be noticeable by slowly dimming when the capacitor discharges. It's more likely that the signal driving the led comes out of a monostable implemented in code: pin_on() drives the led on; pin_off() waits n secs then drives the led off.
  - deleted 2y ago
    [deleted]
  - altairprime 2y ago
    This is Apple, so that assertion isn’t guaranteed valid like it would be for non-enterprise HP or Lenovo. They absolutely would invest in a capacitor if that’s what it takes, as they are maximally focused on camera privacy concerns and have made a point of that in their security marketing over time; or else they wouldn’t be allowing hardware security engineers to brag about it, much less talk publicly about it, at all. EDIT: It’s not just a capacitor, it’s a full custom chip, that can’t be software-modified, that keeps the light on for 3 seconds. https://news.ycombinator.com/item?id=42260379 https://news.ycombinator.com/item?id=42260379
- HeyLaughingBoy 2y ago
  Logic on an already existing ASIC is going to be cheaper than a capacitor.
  - MrDrMcCoy 2y ago
    This is counter-intuitive enough to warrant further explanation.
    - ale42 2y ago
      If you are designing an ASIC for the camera, you can include all the required logic gates to control the LED for a cost that is close to zero. It wouldn't impact the production cost of the ASIC, whereas a capacitor is an additional item in the BOM (and to be charged it requires current, more than the LED, so the driver in the IC must be bigger).
throwaway984393 2y ago
[dead]
aftbit 2y ago
See then it's not hardwired at all. It is equally vulnerable to a reflash. Apple just did hardware security (i.e. signed firmware) better and also are relying on security through obscurity (its not a publicly available part).
- deleted 2y ago
  [deleted]
axoltl 2y ago
I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-architect how the LED is turned on. I was the security architect for the feature. A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.) On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds. This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board. tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. 0: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-brocker.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- Mistletoe 2y ago
  Thank you for doing this.
- rubatuga 2y ago
  Thanks, this is the reason I browse Hacker News
- PicardsFlute 2y ago
  Thanks for posting this interesting tidbit! I find this kind of knowledge absolutely fascinating!
- ohhnoodont 2y ago
  There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

ndiddy 2y ago

The context from the article the parent comment linked is that Mac webcams made prior to 2008 both had the camera LED controlled in firmware and didn't verify the camera firmware blob when it was downloaded into the camera's RAM. The quote you're replying to simply says that Apple solved these security issues by tying the LED to a hardware signal AND verifying the camera firmware blob. The result is still that there's no way to turn on the webcam without making the LED light up.

danielheath 2y ago

AFAIK iOS devices use a tiny firmware on the camera and a larger one on the secure enclave chip. If you successfully compromise the host OS and also the secure enclave firmware, that might be enough to let you turn on the camera (without vsync) and reconstruct the correct image via later analysis... but at that point you have committed tens of millions to the hack (so you'd better not overuse it or it'll get noticed & patched).

pclmulqdq 2y ago

Many complex chips have GPIO signals rather than hardwired outputs. That way you can select any [5-10] of [20-100] functions for each pin. As a result, things that you think should be hardwired are controlled by firmware.