4 ms·

It's such an obvious solution that I really thought that WAS the case until just now. Why in the world would you tackle this problem any other way?

FireBeyond 13y ago
Well, Apple and supporters (obligatory disclaimer: I own, and love, my rMBP, iPhone 5, and have two iPads in my house) have claimed that it was the case, and that it was physically impossible not to. Then again, Apple’s marketing for the iPhone 5s made many claims of “subdermal fields”, “RF micro fields produced by the human body”, and how, as a result, it couldn’t be faked. Except it could. Fairly easily. And without any remote pretense around the ‘emulate a live finger’. Just the fingerprint. Much as I like Apple, these are pretty bold-faced deceptions.
- arrrg 13y ago
  “… and how, as a result, it couldn’t be faked.” Except, you know, they never actually said that.
- valleyer 13y ago
  Citation needed on the Touch ID claims.
cseelus 13y ago
Exactly my thoughts. Hope anyone with more clue can explain this.
Guvante 13y ago
They basically did, the light can only be turned off when the USB signals "standby". The hack is to override the camera to ignore that signal. It is a rather unique idea and probably not something anyone even considered at Apple.
- cnvogel 13y ago
  I don't think anyone at Apple considered this LED to be designed "tamper proof". They just lazily implemented a requirement possibly written as: -- A LED shall light up when the camera is activated. But what they should have implemented is: -- It shall not be possible to activate the camera without the LED being lit, taking malicious third-party software into account. The first requirement is obviously, and demonstrably, implemented by every camera (ignoring hardware defects regarding the LED). The second is, as proven by the paper, not fulfilled by any. {EDIT: added the malicious part to the 2nd requirement}
  - zmb_ 13y ago
    I'd be much happier with a requirement to the industrial design department: -- There shall be a way for the user to physically obstruct the camera lens. Apple used to have this in their standalone camera back in the day.
    - iriche 13y ago
      Yeah, HP had that in some of there old machines too, remember I had one with a physical slidethingy
      - adisbladis 13y ago
        You still can. Just put a piece of tape over it.
- kro0ub 13y ago
  So is an MBP/A running Linux susceptible to the hack, then?
  - theshrike79 13y ago
    As far as I can tell, yes. The hack is about rewriting the camera controller chip, which isn't platform specific in any way. OS X allows non-privileged users to do that for some reason though...

FireBeyond 13y ago

Well, Apple and supporters (obligatory disclaimer: I own, and love, my rMBP, iPhone 5, and have two iPads in my house) have claimed that it was the case, and that it was physically impossible not to. Then again, Apple’s marketing for the iPhone 5s made many claims of “subdermal fields”, “RF micro fields produced by the human body”, and how, as a result, it couldn’t be faked. Except it could. Fairly easily. And without any remote pretense around the ‘emulate a live finger’. Just the fingerprint. Much as I like Apple, these are pretty bold-faced deceptions.

arrrg 13y ago
“… and how, as a result, it couldn’t be faked.” Except, you know, they never actually said that.
valleyer 13y ago
Citation needed on the Touch ID claims.

cseelus 13y ago

Exactly my thoughts. Hope anyone with more clue can explain this.

Guvante 13y ago

They basically did, the light can only be turned off when the USB signals "standby". The hack is to override the camera to ignore that signal. It is a rather unique idea and probably not something anyone even considered at Apple.

cnvogel 13y ago
I don't think anyone at Apple considered this LED to be designed "tamper proof". They just lazily implemented a requirement possibly written as: -- A LED shall light up when the camera is activated. But what they should have implemented is: -- It shall not be possible to activate the camera without the LED being lit, taking malicious third-party software into account. The first requirement is obviously, and demonstrably, implemented by every camera (ignoring hardware defects regarding the LED). The second is, as proven by the paper, not fulfilled by any. {EDIT: added the malicious part to the 2nd requirement}
- zmb_ 13y ago
  I'd be much happier with a requirement to the industrial design department: -- There shall be a way for the user to physically obstruct the camera lens. Apple used to have this in their standalone camera back in the day.
  - iriche 13y ago
    Yeah, HP had that in some of there old machines too, remember I had one with a physical slidethingy
    - adisbladis 13y ago
      You still can. Just put a piece of tape over it.
kro0ub 13y ago
So is an MBP/A running Linux susceptible to the hack, then?
- theshrike79 13y ago
  As far as I can tell, yes. The hack is about rewriting the camera controller chip, which isn't platform specific in any way. OS X allows non-privileged users to do that for some reason though...