Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#1

Post by jeffo_rulez » Sat, Jul 14, 2018, 12:09 AM UTC

Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
tech.firstlook.media

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#2

Post by Someone1234 » Sat, Jul 14, 2018, 2:20 AM UTC

In Apple's computers the web cam light cannot be disabled, because the web cam is controlled by a co-processor as demoed here. In the newer Pros with Touchbar Apple uses their own chip for this same function.

On a lot of PC webcams, you can run the camera without the light or visa versa[0].

[0] https://blog.erratasec.com/2013/12/how-to-disable-webcam-lig...

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#3

Post by kabdib » Sat, Jul 14, 2018, 2:20 AM UTC

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know?

You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if you X-ray'd the board. I'm guessing that a similarly stealthy receiver would be noticeable due to required external discrete components (e.g., amplifiers, filter networks).

Plonking down a whole chip for "secret wifi" is likely overkill.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#4

Post by Rebelgecko » Sat, Jul 14, 2018, 2:30 AM UTC

Someone1234 wrote: post #2

In Apple's computers the web cam light cannot be disabled, because the web cam is controlled by a co-processor as demoed here. In the newer Pros with Touchbar Apple uses their own chip for this same function. On a lot of PC webcams, you can run the camera without the light or visa versa[0]. [0] https://blog.erratasec.com/2013/12/how-to-disable-webcam-lig...

Previous hacks of the iSight cam involved rewriting the firmware of that separate microcontroller. IIRC there was also a delay at one point, so that it was possible to take a picture really fast before the LED turned on.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#5

Post by jws » Sat, Jul 14, 2018, 2:57 AM UTC

kabdib wrote: post #3

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if…

…something that didn't look too much like an antenna…

The Raspberry Pi Zero W has a perfectly serviceable antenna which is simply a cavity formed between layers of copper and two tiny capacitors which look about like grains of salt.

They are designed by some very clever Swedes. http://www.proant.se/en/news.htm

That second page shows the Raspberry Pi 3B+ whose antenna looks to be just a trace with the aforementioned grains of salt on it.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#6

Post by amagumori » Sat, Jul 14, 2018, 3:08 AM UTC

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#7

Post by shawn » Sat, Jul 14, 2018, 3:12 AM UTC

kabdib wrote: post #3

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if…

The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer.

The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, you wouldn’t be able to notice anything wrong apart from a slightly reduced total bandwidth.

The value of such a tool is that it can be installed remotely, with no physical presence.

They also have all kinds of gadgets to defeat airgaps. IIRC one of them was a replacement keyboard that looks identical to the normal one, but provides the stealth wifi you mention.

One way to get an idea of what the NSA is up to is to look at their job listings. They can fake everything else, but not those.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#8

Post by userbinator » Sat, Jul 14, 2018, 3:16 AM UTC

We’re not sure exactly what the technicians did to remove the chip – heat gun, maybe? – but it came off cleanly and you wouldn’t notice it was missing unless you were specifically looking for it on the board.

Almost certainly, or more precisely, a "hot air rework station". For someone with experience, it only takes a few minutes to remove and replace BGAs with one.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#9

Post by cozzyd » Sat, Jul 14, 2018, 3:22 AM UTC

amagumori wrote: post #6

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

Don't you see, they used Kali Linux which contains the specialized lspci hacker tool.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#10

Post by dsmithatx » Sat, Jul 14, 2018, 3:24 AM UTC

amagumori wrote: post #6

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

Not sure why you were down voted. The test only showed removing the chip disabled the camera. The chip BCM15700A2 is a WLAN/Bluetooth chip used on Intel 8260 cards and lots of Dell laptops.

There is a Linux kernel driver written for this chip used for 802.11a wireless.