9 ms·

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivi

by axoltl 2y ago

I happen to have some first-hand knowledge around the subject! In 2014 someone did a talk[0] on disabling the camera on some older Macbooks. It was fairly trivial, basically just reflashing the firmware that controlled the LED. I worked on the security team at Apple at the time and in response to this I attempted to do the same for more modern Macbooks. I won't go into the results but the decision was made to re-architect how the LED is turned on. I was the security architect for the feature. A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.) On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds. This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board. tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. 0: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-brocker.pdf https://www.usenix.org/system/files/conference/usenixsecurit...

Mistletoe 2y ago
Thank you for doing this.
rubatuga 2y ago
Thanks, this is the reason I browse Hacker News
PicardsFlute 2y ago
Thanks for posting this interesting tidbit! I find this kind of knowledge absolutely fascinating!
ohhnoodont 2y ago
There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?
- sneak 2y ago
  They are, but people aren’t scared of those because they can’t see them staring at them.
- Nursie 2y ago
  Depends what your threat model is? Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc. If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine. So sure, maybe people ought to be more concerned about microphones as well, rather than instead.
  - hunter-gatherer 2y ago
    I'm not arguing a point here, but I'm curious what the actual number of instances exist where someone is naked or in some other extortionate way (accidently of course) potentially exposed from the position of their webcam. I too would be much more concerned about my microphone, where I know one had conversations that in front of or next to my machine that I wouldn't want "out there". In terms of where my camera is, I woukd imagine they would catch me picking my nose every so often but that's about it.
    - rocqua 2y ago
      People watch porn on their laptops. Even just your orgasm face would be embarrassing for most people.
  - joeblubaugh 2y ago
    > Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. This isn't true at all, even for private citizens. Your friends, parents, children, and colleagues are all likely to care.
II2II 2y ago
> and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. I may be the oddball here, but that 3 second duration does not comfort me. The only time I would notice it is if I am sitting in front of the computer. While someone snapping a photo of me while working is disconcerting, it is not the end of the world. Someone snapping photos while I am away from the screen is more troublesome. (Or it would be if my computer was facing an open space, which it doesn't.)
- jstanley 2y ago
  OK, but then what? Leave the LED on for 24 hours after you've captured a single frame? At that point the LED isn't really indicating camera usage because you'll just get used to seeing it on all the time whether the camera is in use or not.
  - II2II 2y ago
    A ranfom thought, that probably won't cover all cases: a second LED or a colour LED. One LED/colour indicates the camera is active, the second can be on for a longer period of time (and perhaps dim as time goes on). I prefer the second LED option since it is better for us colourblind folks, though I suspect there would be more resistance to the idea. And, of course, covers are an option.
- tehjoker 2y ago
  It's strange that none of these companies will include a closable cover for the camera. I got one aftermarket. It is very reassuring since no hacking or accidental misclicks on my part can move the cover.
  - sunnybeetroot 2y ago
    I had a closable cover and someone shut my laptop with enough force that the cover caused the screen to break. Be careful when closing.
    - 2y ago
jorvi 2y ago
I assume you're not longer working on it, but why not just wire it so that: - The LED is in parallel, but with the sensor voltage supply, not the chip - Camera sensor idle voltage = low voltage for the LED (be it with stepping if needed) - Camera sensor active voltage = high voltage for the LED (again, stepping if needed) - little capacitor that holds enough charge to run the LED for ~3 seconds after camera goes back to idle voltage. Good luck hacking that :)
- axoltl 2y ago
  That's basically how this works, but manufacturing electronics at a massive scale requires some more flexibility. For example, capacitors have a pretty large tolerance (sometimes +/- 20%) and LEDs have quite a bit of variety in what voltages they'll work at. So for some people the LEDs might last 3 seconds, for some they might last 5s. Using a capacitor also means the LEDs will fade slowly instead of just turning off sharply. If the LEDs come from a different supplier one day, who is going to make sure they're still within the spec for staying on for 3 seconds? (And yes, I have long since parted ways with Apple) Edit: And to add on: That capacitor needs time to charge so now the LED doesn't actually come on when the sensor comes on, it's slightly delayed!
  - jorvi 2y ago
    Thank you for the clarifications. Armchair (well, workbench) engineering strikes again haha!
- shiroiushi 2y ago
  You can't drive an LED that way in production electronics: you need to use an LED driver circuit of some kind to ensure the LED has constant current, and also to protect against failure modes. Also, a capacitor large enough to power a daylight-visible LED for 3 seconds is not as "little" as you're thinking; there's likely not enough space in a laptop lid for one of those. A driver circuit would be smaller and thinner. Agreed, however, that the LED should be controlled by the camera sensor idle vs. active voltage.
int_19h 2y ago
Thank you for your work on this! I wish some other large companies took privacy that seriously.
KennyBlanken 2y ago
I've seen a million people parroting "oh now apple fixed it!" and not a single person who has actually verified/proved it. Go on, show my any third party security researcher who has verified this claim via examining the actual hardware. You'll pardon us all if we don't really believe you, because a)there's no way for any of us to verify this and b)Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware.
- trogdor 2y ago
  > Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware. Source?
- axoltl 2y ago
  I'd love for a third party to verify the claim! I'm just giving you an overview of the work that went into making this a thing, knowing full well you have absolutely no reason to trust me. The LED being "hard-wired" is a tricky statement to make, and I actually wasn't aware Apple has publicly ever made a statement to that effect. What I can say is that relying on the dedicated LED or "sensor array active" signal some camera sensors provide, while technically hard-wired in the sense there is no firmware driving it, is not foolproof.

by axoltl 2y ago

Mistletoe 2y ago

Thank you for doing this.

rubatuga 2y ago

Thanks, this is the reason I browse Hacker News

PicardsFlute 2y ago

Thanks for posting this interesting tidbit! I find this kind of knowledge absolutely fascinating!

ohhnoodont 2y ago

There seems to be widespread anxiety regarding cameras, but hardly anyone ever talks about microphones. Are conversations not much more privileged information than potentially seeing someone in their underwear?

sneak 2y ago
They are, but people aren’t scared of those because they can’t see them staring at them.
Nursie 2y ago
Depends what your threat model is? Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc. If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine. So sure, maybe people ought to be more concerned about microphones as well, rather than instead.
- hunter-gatherer 2y ago
  I'm not arguing a point here, but I'm curious what the actual number of instances exist where someone is naked or in some other extortionate way (accidently of course) potentially exposed from the position of their webcam. I too would be much more concerned about my microphone, where I know one had conversations that in front of or next to my machine that I wouldn't want "out there". In terms of where my camera is, I woukd imagine they would catch me picking my nose every so often but that's about it.
  - rocqua 2y ago
    People watch porn on their laptops. Even just your orgasm face would be embarrassing for most people.
- joeblubaugh 2y ago
  > Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. This isn't true at all, even for private citizens. Your friends, parents, children, and colleagues are all likely to care.

II2II 2y ago

> and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured. I may be the oddball here, but that 3 second duration does not comfort me. The only time I would notice it is if I am sitting in front of the computer. While someone snapping a photo of me while working is disconcerting, it is not the end of the world. Someone snapping photos while I am away from the screen is more troublesome. (Or it would be if my computer was facing an open space, which it doesn't.)

jstanley 2y ago
OK, but then what? Leave the LED on for 24 hours after you've captured a single frame? At that point the LED isn't really indicating camera usage because you'll just get used to seeing it on all the time whether the camera is in use or not.
- II2II 2y ago
  A ranfom thought, that probably won't cover all cases: a second LED or a colour LED. One LED/colour indicates the camera is active, the second can be on for a longer period of time (and perhaps dim as time goes on). I prefer the second LED option since it is better for us colourblind folks, though I suspect there would be more resistance to the idea. And, of course, covers are an option.
tehjoker 2y ago
It's strange that none of these companies will include a closable cover for the camera. I got one aftermarket. It is very reassuring since no hacking or accidental misclicks on my part can move the cover.
- sunnybeetroot 2y ago
  I had a closable cover and someone shut my laptop with enough force that the cover caused the screen to break. Be careful when closing.
  - 2y ago

jorvi 2y ago

I assume you're not longer working on it, but why not just wire it so that: - The LED is in parallel, but with the sensor voltage supply, not the chip - Camera sensor idle voltage = low voltage for the LED (be it with stepping if needed) - Camera sensor active voltage = high voltage for the LED (again, stepping if needed) - little capacitor that holds enough charge to run the LED for ~3 seconds after camera goes back to idle voltage. Good luck hacking that :)

axoltl 2y ago
That's basically how this works, but manufacturing electronics at a massive scale requires some more flexibility. For example, capacitors have a pretty large tolerance (sometimes +/- 20%) and LEDs have quite a bit of variety in what voltages they'll work at. So for some people the LEDs might last 3 seconds, for some they might last 5s. Using a capacitor also means the LEDs will fade slowly instead of just turning off sharply. If the LEDs come from a different supplier one day, who is going to make sure they're still within the spec for staying on for 3 seconds? (And yes, I have long since parted ways with Apple) Edit: And to add on: That capacitor needs time to charge so now the LED doesn't actually come on when the sensor comes on, it's slightly delayed!
- jorvi 2y ago
  Thank you for the clarifications. Armchair (well, workbench) engineering strikes again haha!
shiroiushi 2y ago
You can't drive an LED that way in production electronics: you need to use an LED driver circuit of some kind to ensure the LED has constant current, and also to protect against failure modes. Also, a capacitor large enough to power a daylight-visible LED for 3 seconds is not as "little" as you're thinking; there's likely not enough space in a laptop lid for one of those. A driver circuit would be smaller and thinner. Agreed, however, that the LED should be controlled by the camera sensor idle vs. active voltage.

int_19h 2y ago

Thank you for your work on this! I wish some other large companies took privacy that seriously.

KennyBlanken 2y ago

I've seen a million people parroting "oh now apple fixed it!" and not a single person who has actually verified/proved it. Go on, show my any third party security researcher who has verified this claim via examining the actual hardware. You'll pardon us all if we don't really believe you, because a)there's no way for any of us to verify this and b)Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware.

trogdor 2y ago
> Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware. Source?
axoltl 2y ago
I'd love for a third party to verify the claim! I'm just giving you an overview of the work that went into making this a thing, knowing full well you have absolutely no reason to trust me. The LED being "hard-wired" is a tricky statement to make, and I actually wasn't aware Apple has publicly ever made a statement to that effect. What I can say is that relying on the dedicated LED or "sensor array active" signal some camera sensors provide, while technically hard-wired in the sense there is no firmware driving it, is not foolproof.