Micro Snitch – Know when someone spies on you • Hacker News Board

Re: Micro Snitch – Know when someone spies on you

#41

Post by Bartweiss » Fri, Oct 12, 2018, 4:52 PM UTC

xoa wrote: post #13

et15 wrote: post #3

How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.

> How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere. Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally b…

It's worth noting there is one way to verify camera activity without needing to offer source code or elaborate test setups: embed a "camera-on" LED on the power circuit. As long as somebody does a teardown to prove it and you're pretty sure no one has compromised your specific machine's hardware, it ought to be safe.

I don't meant to detract from the "trusting trust" question, there are lots of issues which really are best handled by just pushing the problem problem outside the average user's threat model. Even source-code verification isn't actually terribly robust on the user level: are you sure you got a clean install? Are you sure nothing has modified it? And so at a certain point "just trust Apple" is entirely reasonable.

But I do think we sometimes rely on webs of trust, elaborate app signing schemes, and other software or legal solutions when we could be getting by with a simple hardware answer. (And the entire IoT domain looks a lot like undoing solved hardware problems...)

Re: Micro Snitch – Know when someone spies on you

#42

Post by tomc1985 » Fri, Oct 12, 2018, 4:54 PM UTC

How is this any more effective than the software-controlled lights on cameras today?

IIRC all the good webcam implants ignore softlights -- presumably they'd slip by whatever code is monitoring the camera here

Re: Micro Snitch – Know when someone spies on you

#43

Post by vtail » Fri, Oct 12, 2018, 4:57 PM UTC

If you stop for a minute to think about it, it's a very sad state of affairs that you need to buy a closed-source app for the most secure consumer operating system, and pay constant attention to its status, in hope to avoid (or detect) spying.

I'm personally re-thinking my approach to security and anonymity online, esp. in light of recent news re: Facebook (Cambridge Analytica, account breach), Google (Chrome 69, increased spying), etc.

I've bought a new laptop, and for the first time in 12 years it's not a Mac - it's Thinkpad X1 Carbon 6 (similar/better specs vs Macbook Pro at half the price) with OpenBSD, which takes 10 min to install, works flawlessly with Thinkpad's hardware (minus bluetooth and finger scanner) and have a security model I can trust.

Re: Micro Snitch – Know when someone spies on you

#44

Post by microtonal » Fri, Oct 12, 2018, 5:02 PM UTC

crunchiebones wrote: post #31

drtse4 wrote: post #4

Or just install Oversight, it's free, does the same thing. And if you want you can support the author on Patreon. https://objective-see.com/products/oversight.html

why are these all for MacOS? are windows and linux not targeted by similar malware?

Of course, other operating systems are vulnerable as well. The problem is more that for a long time the security model of Linux was that an attacker is interested in getting root access. This hasn't been true anymore since DDoS attacks, crypto mining, etc. became a thing. And in recent years, attacks have moved towards phishing, crypto lockers, etc. Though Linux for a long time still had the model that an application has the same rights as a user. As a result, virtually every app is able to use an audio device if the user has the right permissions and/or eavesdrop on other applications and limited possibilities for access control:

https://www.freedesktop.org/wiki/Software/PulseAudio/Documen...

Similarly, X11 applications can snoop on keystrokes, mouse events, and other applications, etc.

Luckily, there has been a strong push to change things. E.g. Pipewire is going to provide access control for sound devices and cameras, Wayland provides more GUI isolation between applications, and Flatpak/Bubblewrap are introducing application sandboxing at a larger scale.

Re: Micro Snitch – Know when someone spies on you

#45

Post by giosch » Fri, Oct 12, 2018, 5:09 PM UTC

vtail wrote: post #43

If you stop for a minute to think about it, it's a very sad state of affairs that you need to buy a closed-source app for the most secure consumer operating system, and pay constant attention to its status, in hope to avoid (or detect) spying. I'm personally re-thinking my approach to security and anonymity online, esp. in light of recent news re: Facebook (Cambridge Analytica, account breach), Google (Chrome 69, inc…

"the most secure consumer operating system" ?

Re: Micro Snitch – Know when someone spies on you

#46

Post by lostlogin » Fri, Oct 12, 2018, 5:09 PM UTC

tomc1985 wrote: post #42

How is this any more effective than the software-controlled lights on cameras today? IIRC all the good webcam implants ignore softlights -- presumably they'd slip by whatever code is monitoring the camera here

The log is a big feature

Re: Micro Snitch – Know when someone spies on you

#47

Post by blablabla123 » Fri, Oct 12, 2018, 5:11 PM UTC

xoa wrote: post #13

et15 wrote: post #3

How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.

> How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere. Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally b…

> Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds

Actually it is sufficient. On macOS one can install homebrew and add the build from source option. Most Linux distributions provide similar facilities.

Of course on can go Hardcore and use Gentoo, but yeah, in that case verified builds + OSS are the more efficient option unless on has access to a cluster.

Re: Micro Snitch – Know when someone spies on you

#48

Post by vtail » Fri, Oct 12, 2018, 5:12 PM UTC

giosch wrote: post #45

vtail wrote: post #43

If you stop for a minute to think about it, it's a very sad state of affairs that you need to buy a closed-source app for the most secure consumer operating system, and pay constant attention to its status, in hope to avoid (or detect) spying. I'm personally re-thinking my approach to security and anonymity online, esp. in light of recent news re: Facebook (Cambridge Analytica, account breach), Google (Chrome 69, inc…

"the most secure consumer operating system" ?

Well, that’s certainly up to debate - but please note the “consumer” qualifier there. I do believe that for an average non-experienced consumer, it offers better security over Windows (fewer viruses, App Store launched earlier, etc.)

I should have added “desktop” there as well, otherwise I would say iOS is the most secure consumer operating system these days.

Re: Micro Snitch – Know when someone spies on you

#49

Post by sanityvampire » Fri, Oct 12, 2018, 5:14 PM UTC

vtail wrote: post #43

If you stop for a minute to think about it, it's a very sad state of affairs that you need to buy a closed-source app for the most secure consumer operating system, and pay constant attention to its status, in hope to avoid (or detect) spying. I'm personally re-thinking my approach to security and anonymity online, esp. in light of recent news re: Facebook (Cambridge Analytica, account breach), Google (Chrome 69, inc…

I'm a fan of the X1 Carbon line; my current home laptop is a 3rd-gen that I grabbed on eBay for cheap a while back. Might leapfrog to the next model when it's released, but the "Alexa for PC" integration is kinda sketching me out.

I know it's just factory-installed bloatware at this point, but I'm concerned that before long Amazon's going to be paying off OEMs for physically integrated spy hardware, and while I love my ThinkPad systems, Lenovo's willingness to include Alexa makes me nervous.

Re: Micro Snitch – Know when someone spies on you

#50

Post by nobody271 » Fri, Oct 12, 2018, 5:16 PM UTC

vtail wrote: post #43

If you stop for a minute to think about it, it's a very sad state of affairs that you need to buy a closed-source app for the most secure consumer operating system, and pay constant attention to its status, in hope to avoid (or detect) spying. I'm personally re-thinking my approach to security and anonymity online, esp. in light of recent news re: Facebook (Cambridge Analytica, account breach), Google (Chrome 69, inc…

I'm on a fresh Debian install and using a VPN. At some point I need to lock down my home router and flash the BIOS on some of my more promiscuous computers.

What I would REALLY like though is a quality Linux operating system for the phone like Ubuntu Touch. I just don't feel comfortable on Android.