Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

Post by cozzyd » Sat, Jul 14, 2018, 3:30 AM UTC

shawn wrote: post #7

kabdib wrote: post #3

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if…

The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, yo…

Post by saagarjha » Sat, Jul 14, 2018, 3:41 AM UTC

Rebelgecko wrote: post #4

Someone1234 wrote: post #2

In Apple's computers the web cam light cannot be disabled, because the web cam is controlled by a co-processor as demoed here. In the newer Pros with Touchbar Apple uses their own chip for this same function. On a lot of PC webcams, you can run the camera without the light or visa versa[0]. [0] https://blog.erratasec.com/2013/12/how-to-disable-webcam-lig...

Previous hacks of the iSight cam involved rewriting the firmware of that separate microcontroller. IIRC there was also a delay at one point, so that it was possible to take a picture really fast before the LED turned on.

Post by cozzyd » Sat, Jul 14, 2018, 3:49 AM UTC

8bitsrule wrote: post #12

This story made me realize: I haven't seen the phrase "tin-foil hat" used much in the past couple of years. Huh. Which reminded me of a quote: "For a while you wondered whether the fools were pretending to be fools as some kind of deception, or whether there was a real efficient service somewhere else. Later in my fiction, I invented one. But alas the reality was the mediocrity." — Le Carre

Post by monochromatic » Sat, Jul 14, 2018, 3:55 AM UTC

userbinator wrote: post #8

We’re not sure exactly what the technicians did to remove the chip – heat gun, maybe? – but it came off cleanly and you wouldn’t notice it was missing unless you were specifically looking for it on the board. Almost certainly, or more precisely, a "hot air rework station". For someone with experience, it only takes a few minutes to remove and replace BGAs with one.

Post by 01100011 » Sat, Jul 14, 2018, 4:28 AM UTC

kabdib wrote: post #3

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if…