17 ms·

Research shows how MacBook Webcams can spy on their users without warning

301 points by clint 13y ago

seiji 13y ago
Notes from the article: they demonstrate it on a black macbook from 2008. They don't have a "modern" version of their disable-webcam-LED exploit. The victim they talked to mentioned "she never saw the light on her laptop go on" — that doesn't mean it didn't, it just means she could have just not been looking for it. Ideally, your webcam LED will be wired with your webcam itself. For your webcam sensor to be powered up, the LED will be powered up as a physical requirement of sending power to the webcam sensor. Many lesser-engineered webcams have software controlled LEDs (kinect bar, generic egg-shaped webcams) that don't even take "hacks" or "malware" to disable LEDs—you just run "turn led off."
nodata 13y ago
On early Macbook webcams it was electrically impossible to turn on the webcam without activating the light next to it. I'll see if I can find a source. Edit: the story refers to precisely these early Macbooks. Yikes.
- lucaspiller 13y ago
  Any ideas why they changed it? Surely the circuit would be simpler like this rather than having the LED hooked up to the microchip and software controlling it.
  - kyzyl 13y ago
    If you have the LED hooked up in parallel with the chip, then you can't really do any fancy indication things like blink the LED, change colour (voltage level) etc. It's possible that the engineers wanted to maintain that flexibility. Second, if the LED fails to a short your camera won't get any power. That means an expensive component appears to be broken when it's only a very cheap component, and you have no way to knowing that w/o opening up and inspecting or replacing parts. In contrast, if an isolated LED fails, one can still verify that the camera works via software, and choose not to send it in for repair. Also, LEDs have a very small leakage current even in their off state. If somebody is hyperoptimizing power consumption they might choose to put the LED on a high impedence controller output rather than feeding off a power rail or similar. Finally, the desired led might work off a configurable controller output, but that might not be the same as the output driving the chip enable pin. So you could require extra circuitry to convert to a compatible voltage/current level. That's my guess.
    - esmi 13y ago
      Also, brightness trim via some sort of PWM on a GPIO.
    - lake99 13y ago
      > Second, if the LED fails to a short your camera won't get any power. One never puts an LED on the power line directly. That will certainly blow up most LEDs. Power rails are typically 5V or 3.3V. LED drop is about 1V (+/- 0.3, varies between part numbers). There is always a resistor in series with the LED, to drop the rest of the voltage, and limit the current. So, LED getting shorted is not a problem. This is the case even when we're driving LEDs from an o/p pin. Besides, Hobbyists often blow up LEDs because they're still learning. But how often have you seen these tiny LEDs fail in professionally designed products? I have never ever seen it happen. Degrade and lose brightness over the years? Sure. Fail? Never. > LEDs have a very small leakage current even in their off state. Are you talking about reverse bias? That makes no sense in this context. When you don't supply any power to it, there is nothing to leak. > the desired led might work off a configurable controller output That is what has led to this mess of surreptitious filming, in the first place. It's time they went back to the old ways.
      - kyzyl 13y ago
        Sorry I didn't check back here for a couple days. > There is always a resistor in series with the LED Sure, almost always. But there are many different voltage level, forward drop, forward current combinations for a given application. There's no guarantee, even with a ballast resistor, that the a shorted LED won't result in an effective short to the power rail (not a real short, but drawing close to the power supply's current sourcing limit). A resistor with a shorted LED results in a useless current sink, in any case. > But how often have you seen these tiny LEDs fail...I have never ever seen it happen. What you've seen or not seen has very little bearing on the reality that parts fail. Period. Things should be designed in a cost effective way that minimizes the possibility/effects of failures. FWIW, I had a laptop recently that had a dead LED on the front panel :-/ > There is always a resistor in series with the LED I just meant that if your "power rail" is actually just a signal line (or whatever) for some other purpose, and the led is there to indicate activity, then even in "low" signal states where the LED isn't fully conducting yet there is a small leakage current.
eurleif 13y ago
And I thought I was clever for turning the light on for only a tiny split-second to take a picture... (I wasn't writing malware. I put the program on my own laptop before I sent it in to be serviced. http://ecritters.biz/applecarefacility/ http://ecritters.biz/applecarefacility/)
- praptak 13y ago
  It actually is clever. I like this "go around instead of breaking" approach very much. Two similar cases: A car magazine claimed they discovered a serious weakness in a particular brand of a steering wheel lock. The company made a series of improvements to the lock and challenged the magazine to demo their hack. The magazine guy approached the new lock, gave it a good hard yank and it came off the steering wheel. Another one was the Flash fullscreen mode. Flash used to (probably still does) display a hard-coded warning after the app went full screen - obviously to prevent Flash apps from impersonating browsers, OSes and so on. I've seen a demo that took advantage of the fact that the text was an overlay over what the app displayed. The demo app just went full screen and printed lots of messages in the same font as the Flash warning, all over the screen. The overlay was still visible (Flash made it impossible to hide or cover) but it was basically impossible to read. The demo then pretended it did a Windows restart - it was pretty scary :-)
  - dec0dedab0de 13y ago
    Do you have sources? They seem like interesting stories.
    - damoncali 13y ago
      Don't know, but I've seen The Club circumvented by cutting the steering wheel with what looked like gardening shears. Literally took less than two seconds to remove the device.
  - rcthompson 13y ago
    > serious weakness in a particular brand of a steering wheel lock ... gave it a good hard yank and it came off the steering wheel Serious weakness indeed. Not what people (especially HN readers) usually mean by that phrase!
boon 13y ago
Does anyone know of how to secure against this type of thing (other than tape)?
- nexttimer 13y ago
  Buy hardware and software you, as the paying customer, remain allowed to control.
  - tedunangst 13y ago
    ? Are you suggesting the problem here is people aren't allowed to control 2008 era macbooks?
  - superuser2 13y ago
    I'm assuming this is a dig at Apple. Care to show that any other laptop manufacturer's webcams are impervious to having their firmware overwritten?
    - nexttimer 13y ago
      It's a dig at anything closed.
      - superuser2 13y ago
        Why would open source hardware not be vulnerable to this sort of attack?
        jdiez17 13y ago
        Two reasons: First: peer review. If your design documents are readily available, researchers don't have to reverse engineer them. Also, by open sourcing hardware design you lower the bar for critique: you might get feedback from an experienced electrical engineer who might not know how to write and upload a custom firmware for a USB controller. Second: you can easily change it because it's not a black box.
shabble 13y ago
The obvious solution is of course a bit of tape, but that's less convenient when you do actually want to use the camera. I notice that the EFF have some nifty little 'ultra-removable adhesive' stickers[1] that might do better, but what would be better is some sort of low-profile adhesive backed sliding cover. ... It appears I spoke too soon, there are already plenty out there, with mixed reviews. The 'iPatch'[2] looks interesting. [1] https://supporters.eff.org/shop/laptop-camera-cover-set https://supporters.eff.org/shop/laptop-camera-cover-set [2] http://www.virtualspaceindustries.com/theipatch/ http://www.virtualspaceindustries.com/theipatch/
- a3n 13y ago
  Why don't they just build a damned slider right into the laptop?
mathhead 13y ago
Nice. I own a Logitech C920 Pro and a software called webcam settings allows me to easily turn off the lights. If this software can do this, so can a malware. Also, a malware can be designed to click quick snaps when there is no keyword or mouse activity for a specific period. This can help the malware go unnoticed without controlling the light. Want to take it to the next level? You can use the mic anytime to estimate the user's distance from the system and then enable webcam accordingly. I know this would not be very accurate, but possible.
- toomuchtodo 13y ago
  You could use the hard drive accelerometer to feel for vibrations to guess proximity. Just like a snake.
- jrochkind1 13y ago
  This story is not about a Logitech camera. It is about the Macbook iSight. There is definitely no (official, known) software that allows you to turn off the privacy light. The Apple engineers intended it to be impossible to disable, and believed it was.
  - mathhead 13y ago
    Yes, I do understand the story is about Macbook iSight. Was just sharing what happens with another vendor as this is relevant and related.
vezzy-fnord 13y ago
I've always sealed the webcam opening with a strip of black tape on my laptop, personally.
- deleted 13y ago
  [deleted]
justin 13y ago
I would be more concerned about the microphone. I can easily cover the camera with tape. Also, random pictures of me programming or reading HN are probably less damaging audio recordings of conversations I might be having.
- hrktb 13y ago
  Same here. Even nude photos would be embarrassing, but audio recordings could have effects far worse than some prude shame. Especially since there is no LED to signal the microphone is active, it doesn't need to point anywhere. If it could be activated while the laptop is closed (force wake up a part of the OS for just a few minutes here and there for instance) it would be a really tough problem.
  - dunham 13y ago
    Maybe unload/delete the kernel module? (This is how I used to silence the pcspkr beep on Linux.)
    - sirkneeland 13y ago
      But how do we do that on the more and more locked-down computing appliances consumers gravitate towards? One does not simply unload/delete kernel module on an iPad...
      - ancarda 13y ago
        Recent versions of iOS ask for permission to use the microphone.
        codygman 13y ago
        What if in the case of a "lawful intercept" iOS does not ask for permission?
        13y ago
auctiontheory 13y ago
I always cover the camera with a Post It sticky. But the mic might be listening in on me. Embrace Big Brother, folks, 'cos he's here.
samolang 13y ago
It would be nice if there was a physical switch to disable the webcam and microphone.
auctiontheory 13y ago
One of my friends always keeps her MacBook open, and had Skype set up to auto-answer video calls. (Until I fixed that for her.) She's a very educated professional woman who teaches at a university you've heard of. In other words, HN readers might come up with defensive hacks, but 99% of the population is completely vulnerable to all kinds of spying, whether government or stalker, and the situation can only get worse as wireless electronics pervade every part of our lives. Books? Internet-enabled. Fridge? Internet-enabled. Car? Internet-enabled. Our own bodies? Carry wireless-connected smartphone 24x7.
- Zikes 13y ago
  One could argue that devising an effective privacy strategy to build into new device categories would be a waste of time until the devices are sufficiently popular enough to warrant the effort. Now that we've reached that tipping point there should be sufficient interest from an adequate number of skilled and educated people to begin to work on solving this problem.
  - bithive123 13y ago
    Display-mounted cameras should have a sliding lens cap built in which can close (but not open) itself after a configurable period of non-use.
    - indrax 13y ago
      Which then nearly ruins the use case of theft recovery software. Sometimes you want to turn on the camera in software.
      - bigiain 13y ago
        I wonder where the balance of good things vs bad things that've happened due to software-enableable laptop cameras currently sits? I strongly suspect that the number of stolen laptops recovered thanks to the owner being able to use the camera to "invade the privacy and potentially take creep-shots" of the unauthorized current user, is way way smaller than the number of people who've had their privacy invaded and potentially had creepshots taken by their laptops unauthorized "p0wners".
x0054 13y ago
Honestly, I don’t understand why it’s so difficult to create a camera chip not susceptible to any software hack. The camera sensor needs electrical current to work. Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up. My knowledge of electronics is limited, but I know for a fact that this can be achieved without the use of any reprogrammable microchips, with the use of a simple electrical circuit.
- RBerenguel 13y ago
  IIRC, in my old Macbook (early 2008) the led is actually inlined. Some machines had a weird hardware bug that shorted this area and sometimes the led would go on... and the camera would be useless until next reboot (mine was one of these, didn't realise until ~after 6 months of owning it
- DanBC 13y ago
  Now all you have to do is warn users that the one LED is important and means something. Not like all the other LEDs that are on all the time and are mostly pointless. http://www.wired.com/threatlevel/2010/10/webcam-spy-settlement/ http://www.wired.com/threatlevel/2010/10/webcam-spy-settleme... http://www.pcmag.com/article2/0,2817,2386599,00.asp http://www.pcmag.com/article2/0,2817,2386599,00.asp > When the school district investigated the case, it found other incidents of webcam spying, and notified the students involved, including Levin. According to the lawsuit, filed in Eastern Pennsylvania District Court, Levin's younger brother commented on a light near the webcam that appeared to go on and off at odd times. His mother "dismissed the idea as absurd," but it appears he was right.
  - Crito 13y ago
    "Now all you have to do is warn users that the one LED is important and means something. Not like all the other LEDs that are on all the time and are mostly pointless." No longer plastering devices with semi-pointless LEDs would help. Harddrive activity? Wifi? Bluetooth? I don't think all these lights are really necessary. Throw one on the power cable maybe, and a few to backlight the keyboard, but otherwise only use them as indicator lights for things that are actually important to the standard user.
jrochkind1 13y ago
So their proof of concept malware... actually changes the firmware in the camera micro-controller? Do I have that right? Here's the research paper linked to in the story, if anyone wants to see what the researchers have to say. I haven't taken a look yet myself: https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569 Ah, there it is right in the abstract, yep: > The same technique that allows us to disable the LED, namely reprogramming the ﬁrmware that runs on the iSight, enables a virtual machine escape whereby malware running inside a virtual machine reprograms the camera to act as a USB Human Interface Device (HID) keyboard which executes code in the host operating system. Ooh, neat.
- Zikes 13y ago
  Seems that way. It wasn't too long ago there was a post about new breeds of malware that target various microcontrollers throughout a PC, able even to "hide out" in something like an optical drive to avoid detection or removal.
wil421 13y ago
I really would hate to taint my MBP with ugly duct tap on the camera, but I may have to in the future. Months ago I read about a company that rented laptops for people to make payments on and eventually own. They installed spy software so they could locate the laptops had the user not made a monthly payment. Employees were spying on users while they were having sex and other things. This wasnt on MBPs but they still managed to not notify the user. http://www.wired.com/threatlevel/2012/09/laptop-rental-spyware-scandal/ http://www.wired.com/threatlevel/2012/09/laptop-rental-spywa...
- daeken 13y ago
  > I really would hate to taint my MBP with ugly duct tap on the camera, but I may have to in the future. A tiny piece of black electrical tape blends in nicely and won't leave gunk on your bezel.
  - wil421 13y ago
    I will try that. If anything fishy happens the camera is getting an ice pick. Problem solved I have barely used it.
    - Crito 13y ago
      I've heard a drill works well.
      - DanBC 13y ago
        Scary, because with some machines you're not drilling into a separate webcam lens but through the display glass to get to the webcam lens.
        Crito 13y ago
        Good point. That would also be an issue with the ice-pick method I guess. It might be possible to drill out the webcam from the backside so long as you were very careful to not drill too far, but if that is how your computer is set up you should probably look for a safer method.
Ben-G 13y ago
Interesting to note: iPhone and iPad and a lot of Android devices don't have a camera indicator LED. While it is difficult to distribute iOS Apps outside the AppStore (where Apple would hopefully reject an App accessing camera information without informing the user) this totally could happen with Android Apps distributed outside of App Stores. A while ago I wrote a component for the iPad that emulates the proximity sensor of the iPhone by measuring the brightness of images the the front camera captured. There was no way for the user to detect that I was actually capturing images.
nexttimer 13y ago
As usual - what's possible to exploit will be exploited. There's really only 1 solid solution to this: Open software and open hardware.
- millerm 13y ago
  I'm just playing devil's advocate here... Your argument for "open software/hardware" doesn't apply here. There was an exploit found in almost 6+ year old hardware/software. Has nothing to do with the fact if it is open or not. "Open" != "non-exploitable" || "flawless". Edited for bad boolean.
  - jdiez17 13y ago
    Open doesn't mean it's flawless. Open means you get more eyeballs on your designs, increasing the chance of catching a mistake.
- midas007 13y ago
  Hear, hear. Also applies to crypto-accelerated CPU instructions. With OSS and OSH, at least there's a chance of auditing what one has is what was released, and a chance to audit that there's no funny business going on.
SiVal 13y ago
I want hardware on/off switches for camera, microphone, wifi, bluetooth, and maybe even external speakers. These should be power switches, not switches that make a polite request to firmware for the firmware to act as if the devices are off.
- pasbesoin 13y ago
  Although I haven't looked into it in detail, yet, the T430 I have at the moment has a physical switch for WiFi and Bluetooth functionality. I want the same for the built-in camera and mic. A little physical "red switch" that no amount of coding can defeat. I agree with others, here. I'm worried at least as much about the microphone as I am about the camera. I can always physically block the camera -- and control what it is pointed at. Further, I'm not comfortable with plugging in a microphone to "override" the built-in microphone. Physical design alone leaves me certain (although without proof) that this "override" is controlled by code. And a bit of experience with software that overrides such defaults to allow simultaneous input over multiple, "normally" orthogonal channels leaves me convinced that such can likely be done with the internal microphone of most devices.
  - falcolas 13y ago
    I've found a few laptops with physical shutters for cameras; I like those. However, nothing similar for a mic yet.
- pavel_lishin 13y ago
  I'd pay someone $10 if I could figure out a way to make sure that my macbook never plays the "I AM NOW TURNING ON" sound.
  - switz 13y ago
    sudo nvram SystemAudioVolume=0 If this works for you, please donate the $10 to Archive.org.
    - 13y ago
tehwalrus 13y ago
There was an article about this before - with a case where a hacker in California tried to blackmail students who he'd spied on having webcam-sex during a long term relationship. Since I read that, I've been keeping a piece of post-it note on my Macbook Air camera, although it does fall off occasionally (and I need to remove it, very rarely, to actually use the camera.) I've just upgraded it to a proper piece of card with real tape. ugly, but effective.
kayoone 13y ago
That the victim in this case didn't see the light, doesn't mean that it wasn't on. She might just not have noticed it. If the older models required so much effort to hack, i doubt it got easier with the newer models, especially since we are talking about Apple here. Obv. its still a problem, even if the light turns on. Taking a quick picture doesnt requite the light to be on for long, so it could go by unnoticed.
troubledwine 13y ago
There's quite a bit of alarm here and in the wording of the article. But no mention of HOW this exploit is applied. I mean surely they're not saying you send someone an e-mail and if they open it their webcam firmware is changed? Or visit a web page or have a flash banner ad run? You'd have to get the user to download and run a package installer that prompts for an admin password RIGHT? In other words; this isn't just something that can happen without end user interaction.
- evan_ 13y ago
  > You'd have to get the user to download and run a package installer that prompts for an admin password RIGHT? In theory; but a motivated party with sufficient resources could simply ("simply") author a fake OS update and deliver it to you over a compromised ISP and you'd never know the difference.
  - joshfraser 13y ago
    You would just chain multiple exploits. For the right price you can buy a zero-day exploit for anything you want -- for the browser, OS & root access. If you have the money, installing the camera exploit in place is trivial.
  - joshfraser 13y ago
    No, it can run in user space by an unprivileged (non-root) application: https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569
- enneff 13y ago
  To do this you need code execution privileges on the target machine, but there are many ways to do this (social engineering, browser exploit, etc). The research is specifically about disabling the camera light.
- asciimo 13y ago
  I agree, and I remain skeptical that this is a trivial or common hack: > But researchers figured out how to reprogram the chip inside the camera, known as a micro-controller, to defeat this security feature. Aren't Mac firmware updates always a big deal with special boot modes and audio tones?
downer88 13y ago
Welcome to 1984. WEAKNESS IS STRENGTH
headgasket 13y ago
... The voice came from an oblong metal plaque like a dulled mirror ... The instrument (the telescreen, it was called) could be dimmed, but there was no way of shutting it off completely. (1.1.3) Oceanians live in a constant state of being monitored by the Party, through the use of advanced, invasive technology. It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away. A nervous tic, an unconscious look of anxiety, a habit of muttering to yourself – anything that carried with it the suggestion of abnormality, of having something to hide. In any case, to wear an improper expression on your face (to look incredulous when a victory was announced, for example) was itself a punishable offense. There was even a word for it in Newspeak: facecrime, it was called. (1.5.65) What's aggregated about you? Are you against this monitoring that protects us from fear and terrorism? Did you state that in some online devious hacker forum? INFORM and VOTE
datums 13y ago
I'm not crazy, yes. When I first purchased a laptop with a camera (MBP 2008) I put tape on it. I did some research and found that the NSA had published a report that stated they could not confidently secure the iSight camera from external access. trying to find it now.
bananacurve 13y ago
While this is theoretically possible with some firmware hack on 2008 machines you are far more likely to be compromised on any Android device that has side loaded apps.
- collyw 13y ago
  It isn't going to be possible on mine, as it doesn't have a front facing camera.
unspecified 13y ago
There is a freely-available kernel extension[1] to make this firmware hack accessible to root only. The exploit depends on modding the camera firmware from userspace. The kext is created by the same authors of the paper[2] this article is talking about. Search the paper for "iSightDefender". [1] https://github.com/stevecheckoway/iSightDefender https://github.com/stevecheckoway/iSightDefender [2] https://jscholarship.library.jhu.edu/bitstream/handle/1774.2/36569/camera.pdf?sequence=1 https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...
- sehugg 13y ago
  Once you're in userspace it's a short hop to root.
  - unspecified 13y ago
    But short of any hardware changes (including taping over the camera), this kext as far as you can go in software. I'd MUCH rather see an admin password prompt come up, instead of nothing all.
nelmaven 13y ago
That's why I disable the webcam in the device manager
- wowaname 13y ago
  Small chance that the driver can be installed remotely.
- lawnchair_larry 13y ago
  Can you re-enable it? Then so can malware.
joshfraser 13y ago
Since this is HN, a link to some related code seems appropriate. https://launchpad.net/isight-firmware-tools/+download https://launchpad.net/isight-firmware-tools/+download
joshfraser 13y ago
Since this is HN, a link to some related code seems appropriate. https://launchpad.net/isight-firmware-tools/+download https://launchpad.net/isight-firmware-tools/+download
herbig 13y ago
No one has mentioned cellphone camera/microphone. I assume it's feasible to do the same remote operation with those?
- lignuist 13y ago
  They usually don't even have indicator leds and most smartphone have cameras on both sides. It is almost as if these devices are built to spy on their owners.
mixmastamyk 13y ago
How can software directly access microcontrollers in order to reprogram them? I thought the days of DOS/System7 were long behind us... or are we talking about kernel drivers that must be installed by root?
wowaname 13y ago
> conventional wisdom said there was at least no way to deactivate the warning light. New evidence indicates otherwise. I thought this was old news.
TheLML 13y ago
Reminds me a lot of this: http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men-who-spy-on-women-through-their-webcams/ http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet...
FollowSteph3 13y ago
I still don't understand why laptops don't have a physical slider for the webcam that goes overtop. Unless it's open no problem. Sure u still have to deal with audio but at least the video is taken care of...
sneak 13y ago
What's said in my office is of a lot more value than how much my beard has grown. There's no light that indicates an active audio input channel.
adamconroy 13y ago
The web cam on the inferior computer I use doesn't work if I don't plug it in.
uptown 13y ago
Interesting in light of this: "NSA recommends physically removing iSight webcam from Apple laptops for security reasons" http://endthelie.com/2013/08/20/nsa-recommends-physically-removing-isight-webcam-from-apple-laptops-for-security-reasons/ http://endthelie.com/2013/08/20/nsa-recommends-physically-re...
slr555 13y ago
We had friends over the other night whose daughter goes to an elite private high school in nyc. She said one of her classmates had gotten bounced from school for executing the same hack described on fellow classmates. Kids these days.
dewyatt 13y ago
I don't understand why webcam indicator LEDs would ever need to be controlled by software. I know of one Logitech USB webcam that has this issue. Turning the indicator off is as simple as: $ uvcdynctrl -s 'LED1 Mode' 0
lucb1e 13y ago
TL;DR firmware flash disables LED on some webcams, particularly Macbooks'. We already knew this: http://security.stackexchange.com/q/6758/10863 http://security.stackexchange.com/q/6758/10863
belorn 13y ago
FBI had knowledge about this security vulnerability for years, yet they traded the security of innocent for an increased attack capability. This is of course nothing new. They used Firefox zero day vulnerabilities before. It just highlights the priority that exist today. Their job is no longer to serve and protect, but to create news article where they can gain glory of taking down bad people.
andyjohnson0 13y ago
Ars Technica has a good explanation of the workaround [1], including a circuit diagram that I found helpful in understanding it. [1] http://arstechnica.com/security/2013/12/perv-utopia-light-on-macbook-webcams-can-be-bypassed/ http://arstechnica.com/security/2013/12/perv-utopia-light-on...
wepple 13y ago
The flashing of the firmware to create a VM escape (Also in the research paper) is 100% cooler than being able to switch off the Webcam light
kro0ub 13y ago
So, is this rooted in the firmware and hardware of the macbook itself, or does it only apply to those running OS X? In other words, would this work while the machine is off or running Linux?
pepijndevos 13y ago
Where can I get the code? I want to try it on my 2007 Intel Mac and use it as a signal light, much like caps lock, but for Vim insert mode.
krosaen 13y ago
Don't existing theft recovery programs already do this? I can't find the link right now but I remember a couple of triumphant "nerd recovers macbook pro" stories where they show photos taken of the thief using their macbook - presumably using this very trick to take a photo without turning on the indicator light.
zbthomas 13y ago
This is not news.
charris5 13y ago
...um, FYI, this hack has been avail for several years now... welcome to a Brave New World.

301 points by clint 13y ago

seiji 13y ago

Notes from the article: they demonstrate it on a black macbook from 2008. They don't have a "modern" version of their disable-webcam-LED exploit. The victim they talked to mentioned "she never saw the light on her laptop go on" — that doesn't mean it didn't, it just means she could have just not been looking for it. Ideally, your webcam LED will be wired with your webcam itself. For your webcam sensor to be powered up, the LED will be powered up as a physical requirement of sending power to the webcam sensor. Many lesser-engineered webcams have software controlled LEDs (kinect bar, generic egg-shaped webcams) that don't even take "hacks" or "malware" to disable LEDs—you just run "turn led off."

nodata 13y ago

On early Macbook webcams it was electrically impossible to turn on the webcam without activating the light next to it. I'll see if I can find a source. Edit: the story refers to precisely these early Macbooks. Yikes.

lucaspiller 13y ago
Any ideas why they changed it? Surely the circuit would be simpler like this rather than having the LED hooked up to the microchip and software controlling it.
- kyzyl 13y ago
  If you have the LED hooked up in parallel with the chip, then you can't really do any fancy indication things like blink the LED, change colour (voltage level) etc. It's possible that the engineers wanted to maintain that flexibility. Second, if the LED fails to a short your camera won't get any power. That means an expensive component appears to be broken when it's only a very cheap component, and you have no way to knowing that w/o opening up and inspecting or replacing parts. In contrast, if an isolated LED fails, one can still verify that the camera works via software, and choose not to send it in for repair. Also, LEDs have a very small leakage current even in their off state. If somebody is hyperoptimizing power consumption they might choose to put the LED on a high impedence controller output rather than feeding off a power rail or similar. Finally, the desired led might work off a configurable controller output, but that might not be the same as the output driving the chip enable pin. So you could require extra circuitry to convert to a compatible voltage/current level. That's my guess.
  - esmi 13y ago
    Also, brightness trim via some sort of PWM on a GPIO.
  - lake99 13y ago
    > Second, if the LED fails to a short your camera won't get any power. One never puts an LED on the power line directly. That will certainly blow up most LEDs. Power rails are typically 5V or 3.3V. LED drop is about 1V (+/- 0.3, varies between part numbers). There is always a resistor in series with the LED, to drop the rest of the voltage, and limit the current. So, LED getting shorted is not a problem. This is the case even when we're driving LEDs from an o/p pin. Besides, Hobbyists often blow up LEDs because they're still learning. But how often have you seen these tiny LEDs fail in professionally designed products? I have never ever seen it happen. Degrade and lose brightness over the years? Sure. Fail? Never. > LEDs have a very small leakage current even in their off state. Are you talking about reverse bias? That makes no sense in this context. When you don't supply any power to it, there is nothing to leak. > the desired led might work off a configurable controller output That is what has led to this mess of surreptitious filming, in the first place. It's time they went back to the old ways.
    - kyzyl 13y ago
      Sorry I didn't check back here for a couple days. > There is always a resistor in series with the LED Sure, almost always. But there are many different voltage level, forward drop, forward current combinations for a given application. There's no guarantee, even with a ballast resistor, that the a shorted LED won't result in an effective short to the power rail (not a real short, but drawing close to the power supply's current sourcing limit). A resistor with a shorted LED results in a useless current sink, in any case. > But how often have you seen these tiny LEDs fail...I have never ever seen it happen. What you've seen or not seen has very little bearing on the reality that parts fail. Period. Things should be designed in a cost effective way that minimizes the possibility/effects of failures. FWIW, I had a laptop recently that had a dead LED on the front panel :-/ > There is always a resistor in series with the LED I just meant that if your "power rail" is actually just a signal line (or whatever) for some other purpose, and the led is there to indicate activity, then even in "low" signal states where the LED isn't fully conducting yet there is a small leakage current.

eurleif 13y ago

And I thought I was clever for turning the light on for only a tiny split-second to take a picture... (I wasn't writing malware. I put the program on my own laptop before I sent it in to be serviced. http://ecritters.biz/applecarefacility/ http://ecritters.biz/applecarefacility/)

praptak 13y ago
It actually is clever. I like this "go around instead of breaking" approach very much. Two similar cases: A car magazine claimed they discovered a serious weakness in a particular brand of a steering wheel lock. The company made a series of improvements to the lock and challenged the magazine to demo their hack. The magazine guy approached the new lock, gave it a good hard yank and it came off the steering wheel. Another one was the Flash fullscreen mode. Flash used to (probably still does) display a hard-coded warning after the app went full screen - obviously to prevent Flash apps from impersonating browsers, OSes and so on. I've seen a demo that took advantage of the fact that the text was an overlay over what the app displayed. The demo app just went full screen and printed lots of messages in the same font as the Flash warning, all over the screen. The overlay was still visible (Flash made it impossible to hide or cover) but it was basically impossible to read. The demo then pretended it did a Windows restart - it was pretty scary :-)
- dec0dedab0de 13y ago
  Do you have sources? They seem like interesting stories.
  - damoncali 13y ago
    Don't know, but I've seen The Club circumvented by cutting the steering wheel with what looked like gardening shears. Literally took less than two seconds to remove the device.
- rcthompson 13y ago
  > serious weakness in a particular brand of a steering wheel lock ... gave it a good hard yank and it came off the steering wheel Serious weakness indeed. Not what people (especially HN readers) usually mean by that phrase!

boon 13y ago

Does anyone know of how to secure against this type of thing (other than tape)?

nexttimer 13y ago
Buy hardware and software you, as the paying customer, remain allowed to control.
- tedunangst 13y ago
  ? Are you suggesting the problem here is people aren't allowed to control 2008 era macbooks?
- superuser2 13y ago
  I'm assuming this is a dig at Apple. Care to show that any other laptop manufacturer's webcams are impervious to having their firmware overwritten?
  - nexttimer 13y ago
    It's a dig at anything closed.
    - superuser2 13y ago
      Why would open source hardware not be vulnerable to this sort of attack?
      - jdiez17 13y ago
        Two reasons: First: peer review. If your design documents are readily available, researchers don't have to reverse engineer them. Also, by open sourcing hardware design you lower the bar for critique: you might get feedback from an experienced electrical engineer who might not know how to write and upload a custom firmware for a USB controller. Second: you can easily change it because it's not a black box.

shabble 13y ago

The obvious solution is of course a bit of tape, but that's less convenient when you do actually want to use the camera. I notice that the EFF have some nifty little 'ultra-removable adhesive' stickers[1] that might do better, but what would be better is some sort of low-profile adhesive backed sliding cover. ... It appears I spoke too soon, there are already plenty out there, with mixed reviews. The 'iPatch'[2] looks interesting. [1] https://supporters.eff.org/shop/laptop-camera-cover-set https://supporters.eff.org/shop/laptop-camera-cover-set [2] http://www.virtualspaceindustries.com/theipatch/ http://www.virtualspaceindustries.com/theipatch/

a3n 13y ago
Why don't they just build a damned slider right into the laptop?

mathhead 13y ago

Nice. I own a Logitech C920 Pro and a software called webcam settings allows me to easily turn off the lights. If this software can do this, so can a malware. Also, a malware can be designed to click quick snaps when there is no keyword or mouse activity for a specific period. This can help the malware go unnoticed without controlling the light. Want to take it to the next level? You can use the mic anytime to estimate the user's distance from the system and then enable webcam accordingly. I know this would not be very accurate, but possible.

toomuchtodo 13y ago
You could use the hard drive accelerometer to feel for vibrations to guess proximity. Just like a snake.
jrochkind1 13y ago
This story is not about a Logitech camera. It is about the Macbook iSight. There is definitely no (official, known) software that allows you to turn off the privacy light. The Apple engineers intended it to be impossible to disable, and believed it was.
- mathhead 13y ago
  Yes, I do understand the story is about Macbook iSight. Was just sharing what happens with another vendor as this is relevant and related.

vezzy-fnord 13y ago

I've always sealed the webcam opening with a strip of black tape on my laptop, personally.

deleted 13y ago
[deleted]

justin 13y ago

I would be more concerned about the microphone. I can easily cover the camera with tape. Also, random pictures of me programming or reading HN are probably less damaging audio recordings of conversations I might be having.

hrktb 13y ago
Same here. Even nude photos would be embarrassing, but audio recordings could have effects far worse than some prude shame. Especially since there is no LED to signal the microphone is active, it doesn't need to point anywhere. If it could be activated while the laptop is closed (force wake up a part of the OS for just a few minutes here and there for instance) it would be a really tough problem.
- dunham 13y ago
  Maybe unload/delete the kernel module? (This is how I used to silence the pcspkr beep on Linux.)
  - sirkneeland 13y ago
    But how do we do that on the more and more locked-down computing appliances consumers gravitate towards? One does not simply unload/delete kernel module on an iPad...
    - ancarda 13y ago
      Recent versions of iOS ask for permission to use the microphone.
      - codygman 13y ago
        What if in the case of a "lawful intercept" iOS does not ask for permission?
        13y ago

auctiontheory 13y ago

I always cover the camera with a Post It sticky. But the mic might be listening in on me. Embrace Big Brother, folks, 'cos he's here.

samolang 13y ago

It would be nice if there was a physical switch to disable the webcam and microphone.

auctiontheory 13y ago

One of my friends always keeps her MacBook open, and had Skype set up to auto-answer video calls. (Until I fixed that for her.) She's a very educated professional woman who teaches at a university you've heard of. In other words, HN readers might come up with defensive hacks, but 99% of the population is completely vulnerable to all kinds of spying, whether government or stalker, and the situation can only get worse as wireless electronics pervade every part of our lives. Books? Internet-enabled. Fridge? Internet-enabled. Car? Internet-enabled. Our own bodies? Carry wireless-connected smartphone 24x7.

Zikes 13y ago
One could argue that devising an effective privacy strategy to build into new device categories would be a waste of time until the devices are sufficiently popular enough to warrant the effort. Now that we've reached that tipping point there should be sufficient interest from an adequate number of skilled and educated people to begin to work on solving this problem.
- bithive123 13y ago
  Display-mounted cameras should have a sliding lens cap built in which can close (but not open) itself after a configurable period of non-use.
  - indrax 13y ago
    Which then nearly ruins the use case of theft recovery software. Sometimes you want to turn on the camera in software.
    - bigiain 13y ago
      I wonder where the balance of good things vs bad things that've happened due to software-enableable laptop cameras currently sits? I strongly suspect that the number of stolen laptops recovered thanks to the owner being able to use the camera to "invade the privacy and potentially take creep-shots" of the unauthorized current user, is way way smaller than the number of people who've had their privacy invaded and potentially had creepshots taken by their laptops unauthorized "p0wners".

x0054 13y ago

Honestly, I don’t understand why it’s so difficult to create a camera chip not susceptible to any software hack. The camera sensor needs electrical current to work. Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up. My knowledge of electronics is limited, but I know for a fact that this can be achieved without the use of any reprogrammable microchips, with the use of a simple electrical circuit.

RBerenguel 13y ago
IIRC, in my old Macbook (early 2008) the led is actually inlined. Some machines had a weird hardware bug that shorted this area and sometimes the led would go on... and the camera would be useless until next reboot (mine was one of these, didn't realise until ~after 6 months of owning it
DanBC 13y ago
Now all you have to do is warn users that the one LED is important and means something. Not like all the other LEDs that are on all the time and are mostly pointless. http://www.wired.com/threatlevel/2010/10/webcam-spy-settlement/ http://www.wired.com/threatlevel/2010/10/webcam-spy-settleme... http://www.pcmag.com/article2/0,2817,2386599,00.asp http://www.pcmag.com/article2/0,2817,2386599,00.asp > When the school district investigated the case, it found other incidents of webcam spying, and notified the students involved, including Levin. According to the lawsuit, filed in Eastern Pennsylvania District Court, Levin's younger brother commented on a light near the webcam that appeared to go on and off at odd times. His mother "dismissed the idea as absurd," but it appears he was right.
- Crito 13y ago
  "Now all you have to do is warn users that the one LED is important and means something. Not like all the other LEDs that are on all the time and are mostly pointless." No longer plastering devices with semi-pointless LEDs would help. Harddrive activity? Wifi? Bluetooth? I don't think all these lights are really necessary. Throw one on the power cable maybe, and a few to backlight the keyboard, but otherwise only use them as indicator lights for things that are actually important to the standard user.

jrochkind1 13y ago

So their proof of concept malware... actually changes the firmware in the camera micro-controller? Do I have that right? Here's the research paper linked to in the story, if anyone wants to see what the researchers have to say. I haven't taken a look yet myself: https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569 Ah, there it is right in the abstract, yep: > The same technique that allows us to disable the LED, namely reprogramming the ﬁrmware that runs on the iSight, enables a virtual machine escape whereby malware running inside a virtual machine reprograms the camera to act as a USB Human Interface Device (HID) keyboard which executes code in the host operating system. Ooh, neat.

Zikes 13y ago
Seems that way. It wasn't too long ago there was a post about new breeds of malware that target various microcontrollers throughout a PC, able even to "hide out" in something like an optical drive to avoid detection or removal.

wil421 13y ago

I really would hate to taint my MBP with ugly duct tap on the camera, but I may have to in the future. Months ago I read about a company that rented laptops for people to make payments on and eventually own. They installed spy software so they could locate the laptops had the user not made a monthly payment. Employees were spying on users while they were having sex and other things. This wasnt on MBPs but they still managed to not notify the user. http://www.wired.com/threatlevel/2012/09/laptop-rental-spyware-scandal/ http://www.wired.com/threatlevel/2012/09/laptop-rental-spywa...

daeken 13y ago
> I really would hate to taint my MBP with ugly duct tap on the camera, but I may have to in the future. A tiny piece of black electrical tape blends in nicely and won't leave gunk on your bezel.
- wil421 13y ago
  I will try that. If anything fishy happens the camera is getting an ice pick. Problem solved I have barely used it.
  - Crito 13y ago
    I've heard a drill works well.
    - DanBC 13y ago
      Scary, because with some machines you're not drilling into a separate webcam lens but through the display glass to get to the webcam lens.
      - Crito 13y ago
        Good point. That would also be an issue with the ice-pick method I guess. It might be possible to drill out the webcam from the backside so long as you were very careful to not drill too far, but if that is how your computer is set up you should probably look for a safer method.

Ben-G 13y ago

Interesting to note: iPhone and iPad and a lot of Android devices don't have a camera indicator LED. While it is difficult to distribute iOS Apps outside the AppStore (where Apple would hopefully reject an App accessing camera information without informing the user) this totally could happen with Android Apps distributed outside of App Stores. A while ago I wrote a component for the iPad that emulates the proximity sensor of the iPhone by measuring the brightness of images the the front camera captured. There was no way for the user to detect that I was actually capturing images.

nexttimer 13y ago

As usual - what's possible to exploit will be exploited. There's really only 1 solid solution to this: Open software and open hardware.

millerm 13y ago
I'm just playing devil's advocate here... Your argument for "open software/hardware" doesn't apply here. There was an exploit found in almost 6+ year old hardware/software. Has nothing to do with the fact if it is open or not. "Open" != "non-exploitable" || "flawless". Edited for bad boolean.
- jdiez17 13y ago
  Open doesn't mean it's flawless. Open means you get more eyeballs on your designs, increasing the chance of catching a mistake.
midas007 13y ago
Hear, hear. Also applies to crypto-accelerated CPU instructions. With OSS and OSH, at least there's a chance of auditing what one has is what was released, and a chance to audit that there's no funny business going on.

SiVal 13y ago

I want hardware on/off switches for camera, microphone, wifi, bluetooth, and maybe even external speakers. These should be power switches, not switches that make a polite request to firmware for the firmware to act as if the devices are off.

pasbesoin 13y ago
Although I haven't looked into it in detail, yet, the T430 I have at the moment has a physical switch for WiFi and Bluetooth functionality. I want the same for the built-in camera and mic. A little physical "red switch" that no amount of coding can defeat. I agree with others, here. I'm worried at least as much about the microphone as I am about the camera. I can always physically block the camera -- and control what it is pointed at. Further, I'm not comfortable with plugging in a microphone to "override" the built-in microphone. Physical design alone leaves me certain (although without proof) that this "override" is controlled by code. And a bit of experience with software that overrides such defaults to allow simultaneous input over multiple, "normally" orthogonal channels leaves me convinced that such can likely be done with the internal microphone of most devices.
- falcolas 13y ago
  I've found a few laptops with physical shutters for cameras; I like those. However, nothing similar for a mic yet.
pavel_lishin 13y ago
I'd pay someone $10 if I could figure out a way to make sure that my macbook never plays the "I AM NOW TURNING ON" sound.
- switz 13y ago
  sudo nvram SystemAudioVolume=0 If this works for you, please donate the $10 to Archive.org.
  - 13y ago

tehwalrus 13y ago

There was an article about this before - with a case where a hacker in California tried to blackmail students who he'd spied on having webcam-sex during a long term relationship. Since I read that, I've been keeping a piece of post-it note on my Macbook Air camera, although it does fall off occasionally (and I need to remove it, very rarely, to actually use the camera.) I've just upgraded it to a proper piece of card with real tape. ugly, but effective.

kayoone 13y ago

That the victim in this case didn't see the light, doesn't mean that it wasn't on. She might just not have noticed it. If the older models required so much effort to hack, i doubt it got easier with the newer models, especially since we are talking about Apple here. Obv. its still a problem, even if the light turns on. Taking a quick picture doesnt requite the light to be on for long, so it could go by unnoticed.

troubledwine 13y ago

There's quite a bit of alarm here and in the wording of the article. But no mention of HOW this exploit is applied. I mean surely they're not saying you send someone an e-mail and if they open it their webcam firmware is changed? Or visit a web page or have a flash banner ad run? You'd have to get the user to download and run a package installer that prompts for an admin password RIGHT? In other words; this isn't just something that can happen without end user interaction.

evan_ 13y ago
> You'd have to get the user to download and run a package installer that prompts for an admin password RIGHT? In theory; but a motivated party with sufficient resources could simply ("simply") author a fake OS update and deliver it to you over a compromised ISP and you'd never know the difference.
- joshfraser 13y ago
  You would just chain multiple exploits. For the right price you can buy a zero-day exploit for anything you want -- for the browser, OS & root access. If you have the money, installing the camera exploit in place is trivial.
- joshfraser 13y ago
  No, it can run in user space by an unprivileged (non-root) application: https://jscholarship.library.jhu.edu/handle/1774.2/36569 https://jscholarship.library.jhu.edu/handle/1774.2/36569
enneff 13y ago
To do this you need code execution privileges on the target machine, but there are many ways to do this (social engineering, browser exploit, etc). The research is specifically about disabling the camera light.
asciimo 13y ago
I agree, and I remain skeptical that this is a trivial or common hack: > But researchers figured out how to reprogram the chip inside the camera, known as a micro-controller, to defeat this security feature. Aren't Mac firmware updates always a big deal with special boot modes and audio tones?

downer88 13y ago

Welcome to 1984. WEAKNESS IS STRENGTH

headgasket 13y ago

... The voice came from an oblong metal plaque like a dulled mirror ... The instrument (the telescreen, it was called) could be dimmed, but there was no way of shutting it off completely. (1.1.3) Oceanians live in a constant state of being monitored by the Party, through the use of advanced, invasive technology. It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away. A nervous tic, an unconscious look of anxiety, a habit of muttering to yourself – anything that carried with it the suggestion of abnormality, of having something to hide. In any case, to wear an improper expression on your face (to look incredulous when a victory was announced, for example) was itself a punishable offense. There was even a word for it in Newspeak: facecrime, it was called. (1.5.65) What's aggregated about you? Are you against this monitoring that protects us from fear and terrorism? Did you state that in some online devious hacker forum? INFORM and VOTE

datums 13y ago

I'm not crazy, yes. When I first purchased a laptop with a camera (MBP 2008) I put tape on it. I did some research and found that the NSA had published a report that stated they could not confidently secure the iSight camera from external access. trying to find it now.

bananacurve 13y ago

While this is theoretically possible with some firmware hack on 2008 machines you are far more likely to be compromised on any Android device that has side loaded apps.

collyw 13y ago
It isn't going to be possible on mine, as it doesn't have a front facing camera.

unspecified 13y ago

There is a freely-available kernel extension[1] to make this firmware hack accessible to root only. The exploit depends on modding the camera firmware from userspace. The kext is created by the same authors of the paper[2] this article is talking about. Search the paper for "iSightDefender". [1] https://github.com/stevecheckoway/iSightDefender https://github.com/stevecheckoway/iSightDefender [2] https://jscholarship.library.jhu.edu/bitstream/handle/1774.2/36569/camera.pdf?sequence=1 https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...

sehugg 13y ago
Once you're in userspace it's a short hop to root.
- unspecified 13y ago
  But short of any hardware changes (including taping over the camera), this kext as far as you can go in software. I'd MUCH rather see an admin password prompt come up, instead of nothing all.

nelmaven 13y ago

That's why I disable the webcam in the device manager

wowaname 13y ago
Small chance that the driver can be installed remotely.
lawnchair_larry 13y ago
Can you re-enable it? Then so can malware.

joshfraser 13y ago

Since this is HN, a link to some related code seems appropriate. https://launchpad.net/isight-firmware-tools/+download https://launchpad.net/isight-firmware-tools/+download

joshfraser 13y ago

Since this is HN, a link to some related code seems appropriate. https://launchpad.net/isight-firmware-tools/+download https://launchpad.net/isight-firmware-tools/+download

herbig 13y ago

No one has mentioned cellphone camera/microphone. I assume it's feasible to do the same remote operation with those?

lignuist 13y ago
They usually don't even have indicator leds and most smartphone have cameras on both sides. It is almost as if these devices are built to spy on their owners.

mixmastamyk 13y ago

How can software directly access microcontrollers in order to reprogram them? I thought the days of DOS/System7 were long behind us... or are we talking about kernel drivers that must be installed by root?

wowaname 13y ago

> conventional wisdom said there was at least no way to deactivate the warning light. New evidence indicates otherwise. I thought this was old news.

TheLML 13y ago

Reminds me a lot of this: http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men-who-spy-on-women-through-their-webcams/ http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet...

FollowSteph3 13y ago

I still don't understand why laptops don't have a physical slider for the webcam that goes overtop. Unless it's open no problem. Sure u still have to deal with audio but at least the video is taken care of...

sneak 13y ago

What's said in my office is of a lot more value than how much my beard has grown. There's no light that indicates an active audio input channel.

adamconroy 13y ago

The web cam on the inferior computer I use doesn't work if I don't plug it in.

uptown 13y ago

Interesting in light of this: "NSA recommends physically removing iSight webcam from Apple laptops for security reasons" http://endthelie.com/2013/08/20/nsa-recommends-physically-removing-isight-webcam-from-apple-laptops-for-security-reasons/ http://endthelie.com/2013/08/20/nsa-recommends-physically-re...

slr555 13y ago

We had friends over the other night whose daughter goes to an elite private high school in nyc. She said one of her classmates had gotten bounced from school for executing the same hack described on fellow classmates. Kids these days.

dewyatt 13y ago

I don't understand why webcam indicator LEDs would ever need to be controlled by software. I know of one Logitech USB webcam that has this issue. Turning the indicator off is as simple as: $ uvcdynctrl -s 'LED1 Mode' 0

lucb1e 13y ago

TL;DR firmware flash disables LED on some webcams, particularly Macbooks'. We already knew this: http://security.stackexchange.com/q/6758/10863 http://security.stackexchange.com/q/6758/10863

belorn 13y ago

FBI had knowledge about this security vulnerability for years, yet they traded the security of innocent for an increased attack capability. This is of course nothing new. They used Firefox zero day vulnerabilities before. It just highlights the priority that exist today. Their job is no longer to serve and protect, but to create news article where they can gain glory of taking down bad people.

andyjohnson0 13y ago

Ars Technica has a good explanation of the workaround [1], including a circuit diagram that I found helpful in understanding it. [1] http://arstechnica.com/security/2013/12/perv-utopia-light-on-macbook-webcams-can-be-bypassed/ http://arstechnica.com/security/2013/12/perv-utopia-light-on...

wepple 13y ago

The flashing of the firmware to create a VM escape (Also in the research paper) is 100% cooler than being able to switch off the Webcam light

kro0ub 13y ago

So, is this rooted in the firmware and hardware of the macbook itself, or does it only apply to those running OS X? In other words, would this work while the machine is off or running Linux?

pepijndevos 13y ago

Where can I get the code? I want to try it on my 2007 Intel Mac and use it as a signal light, much like caps lock, but for Vim insert mode.

krosaen 13y ago

Don't existing theft recovery programs already do this? I can't find the link right now but I remember a couple of triumphant "nerd recovers macbook pro" stories where they show photos taken of the thief using their macbook - presumably using this very trick to take a photo without turning on the indicator light.

zbthomas 13y ago

This is not news.

charris5 13y ago

...um, FYI, this hack has been avail for several years now... welcome to a Brave New World.