[deleted]
Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
41–50 of 80 posts
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#42In Apple's computers the web cam light cannot be disabled, because the web cam is controlled by a co-processor as demoed here. In the newer Pros with Touchbar Apple uses their own chip for this same function. On a lot of PC webcams, you can run the camera without the light or visa versa[0]. [0] https://blog.erratasec.com/2013/12/how-to-disable-webcam-lig...
Previous hacks of the iSight cam involved rewriting the firmware of that separate microcontroller. IIRC there was also a delay at one point, so that it was possible to take a picture really fast before the LED turned on.
Concerned only pre-2009 models or earlier, needed physical access as well. AFAICR.
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#43uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".
This alone wouldn't be enough sure. But you can get more data to say that it isn't doing any RF by looking at the circuit board and looking for antennas, they've got some fairly distinct shapes to be able to radiate efficiently. Of course they could still be inefficient radiators on purpose to prevent them from being found, but that also then means that they'd have to be even closer to pick up the signal. You can tak…
The cable to the camera could also serve as an antenna.
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#44If you really need an air gapped computer, wouldn't it make a whole lot more sense to build a desktop with some variety of ATX form factor motherboard that you can examine in detail to confirm that it has zero wireless functionality? A Macbook Air, which is pretty much designed as a wifi-dependent network terminal, would be way down my list of hardware I would choose if I had to build an airgap lab environment.
Presumably because they wanted something portable?
I would start with a Librem laptop as this is exactly the point of them. Hopefully all you'd have to do is verify the killswitch works as advertised. disclaimer: typing on one now.
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#45uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".
Not sure why you were down voted. The test only showed removing the chip disabled the camera. The chip BCM15700A2 is a WLAN/Bluetooth chip used on Intel 8260 cards and lots of Dell laptops. There is a Linux kernel driver written for this chip used for 802.11a wireless.
The 15700 is a PCIe bridge and PLX chip with some signal conversion capabilities it was never even designated as a wireless chip heck we have apple’s manuals:
338S1186 1 IC,BCM15700A2,S2 PCIE CAMERA PROCESSOR U3900 CRITICAL
5 digit part numbers are Broadcom’s “IP bridge SoC” the BCM15900 on the iPAD pro for example handles the eDP connection with the screen IIRC and the digitizer function.
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#46Earlier quoted context omitted.
You're judging their methodology by what they chose not to do?
If they considered it for long enough to put in the article then its clear they are amateurs in electronics.
I'm an amateur in electronics, and I would consider using a heat gun to desolder the BGA-looking chip (which basically means I know what a heat gun does and I know what BGA looks like). The article author's skill level is "I saw some electronics once".
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#47uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".
Don't you see, they used Kali Linux which contains the specialized lspci hacker tool.
I don't know if you're being sarcastic, but there's nothing specialized or Kali Linux specific about lspci. Every linux distro I've seen comes with the lspci (also, lsusb, lsmem). system_profiler on OSX is probably the closest to all of these and more, rolled into one command line tool.
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#48Earlier quoted context omitted.
Don't you see, they used Kali Linux which contains the specialized lspci hacker tool.
I don't know if you're being sarcastic, but there's nothing specialized or Kali Linux specific about lspci. Every linux distro I've seen comes with the lspci (also, lsusb, lsmem). system_profiler on OSX is probably the closest to all of these and more, rolled into one command line tool.
It is definitely sarcasm.
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#49I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if…
The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, yo…
Do you have a source for this claim?
Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
#50Earlier quoted context omitted.
Use an RF antenna to see if it is putting out any signal.
Could very well not tx until it receives a wake up message.
True. But you could transmit a variety of RF frequencies at the device and try to detect resonance in the antenna. Unfortunately WiFi uses direct conversion rather than IF demodulation, but there is no reason to assume a covert transmitter would use wifi, which is easily spotted by off the shelf equipment. https://youtu.be/ZxyU_1xUOWc
Micropatch antennas are super hard to detect, even with x-ray, and newer types even harder. https://www.nature.com/articles/s41467-017-00343-8