Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Research shows how MacBook Webcams can spy on their users without warning

washingtonpost.com

Post reply on HN
Print view View original

131–140 of 241 posts

Re: Research shows how MacBook Webcams can spy on their users without warning

#131

Post by jdiez17 »

superuser2 wrote: post #100
nexttimer wrote: post #74

Earlier quoted context omitted.

It's a dig at anything closed.

Why would open source hardware not be vulnerable to this sort of attack?

Two reasons:

First: peer review. If your design documents are readily available, researchers don't have to reverse engineer them. Also, by open sourcing hardware design you lower the bar for critique: you might get feedback from an experienced electrical engineer who might not know how to write and upload a custom firmware for a USB controller.

Second: you can easily change it because it's not a black box.

Re: Research shows how MacBook Webcams can spy on their users without warning

#132

Post by jdiez17 »

millerm wrote: post #49
nexttimer wrote: post #38

As usual - what's possible to exploit will be exploited. There's really only 1 solid solution to this: Open software and open hardware.

I'm just playing devil's advocate here... Your argument for "open software/hardware" doesn't apply here. There was an exploit found in almost 6+ year old hardware/software. Has nothing to do with the fact if it is open or not. "Open" != "non-exploitable" || "flawless". Edited for bad boolean.

Open doesn't mean it's flawless. Open means you get more eyeballs on your designs, increasing the chance of catching a mistake.

Re: Research shows how MacBook Webcams can spy on their users without warning

#133

Post by bigiain »

philip1209 wrote: post #102
justin wrote: post #5

I would be more concerned about the microphone. I can easily cover the camera with tape. Also, random pictures of me programming or reading HN are probably less damaging audio recordings of conversations I might be having.

Some hardening guides suggest having the camera and microphone removed by an apple tech. I'm considering having this done on my next laptop - I just don't use them that often.

That's one big advantage of my old FireWire iSight camera – if the FireWire cable isn't plugged in, you _know_ it's not taking pictures.

(And now I half expect to read a new Snowden paper tomorrow detailing how the NSA coerced Apple into fitting batteries and flash storage into webcams so they could be instructed to covertly record video while not plugged in and upload it automatically later…)

Re: Research shows how MacBook Webcams can spy on their users without warning

#134

Post by greglindahl »

superuser2 wrote: post #53
greglindahl wrote: post #43

Earlier quoted context omitted.

I use a cut-out piece of postit note for the camera, and a small piece of etape for the microphones -- seems stable, and both are pretty easy to take off without leaving too much spooge behind.

Does tape actually provide enough impedance to prevent surveillance through your microphones? Seems like all an attacker would have to do is amplify (and possibly filter) the audio a bit.

I turned up the mic all the way, did a skype test call. I could hear myself if I shouted (input level=0). If I talked at a normal volume level, it was audible (and the input level showed as 2/15. I might try a couple of layers of tape...

EDIT: Yeah, 2nd layer of tape = 0 input level even if I shout really, really loudly. You can't imagine how much my coworkers are enjoying this experimentation!

Re: Research shows how MacBook Webcams can spy on their users without warning

#135

Post by sneak »

x0054 wrote: post #9

Honestly, I don’t understand why it’s so difficult to create a camera chip not susceptible to any software hack. The camera sensor needs electrical current to work. Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up. My knowledge of electronics is limited, but I know for a fact that this can be achieved without th…

> Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up.

So, upon (my incorrectly) presuming this was how it's already done in hardware and reading the headline of the article before I got to the text, I assumed they were turning it on and taking a single frame and turning it off fast enough that the LED was only on for a short enough time for the user not to be able to see it (or not notice).

Turns out the article claims they just reprogrammed the microcontroller to not turn it on in the first place. Of course that's a bad design, but you do need some more logic in there - the light needs to stay on for a minimum time when the camera is functioning so that the user can notice it.

This, too, is simple enough that it can be achieved without a microcontroller, but please don't presume that it's a simple fix. It's not just "put it in parallel".

Re: Research shows how MacBook Webcams can spy on their users without warning

#136

Post by jahewson »

pavel_lishin wrote: post #81
SiVal wrote: post #30

I want hardware on/off switches for camera, microphone, wifi, bluetooth, and maybe even external speakers. These should be power switches, not switches that make a polite request to firmware for the firmware to act as if the devices are off.

I'd pay someone $10 if I could figure out a way to make sure that my macbook never plays the "I AM NOW TURNING ON" sound.

If your MacBook is muted when you shut it down hen it will not play the startup sound.

Re: Research shows how MacBook Webcams can spy on their users without warning

#138

Post by sneak »

smsm42 wrote: post #80
StringyBob wrote: post #66

Earlier quoted context omitted.

My current Thinkpad has a physical switch to disable radios. I'd like to have a physical 'privacy' switch that cut the power to internal microphones and cameras. To be security aware, this has to be an auditable hardware power switch, and not just an interrupt/driver/bios combination that could be bypassed. It's also prefereable for security to have a an off-by-default switch, than an activity light you might not not…

Great idea. Must be a physical switch that just cuts all physical links between the camera/microphone and the rest of the system, so that no reprogramming is possible. Unfortunately, little chance to see it in Apple products, as such switch would probably not look "slick" and would probably be considered "confusing for the user" and as such not suitable for implementing.

> Unfortunately, little chance to see it in Apple products, as such switch would probably not look "slick" and would probably be considered "confusing for the user" and as such not suitable for implementing.

That was my first thought, but then I realized the absolutely ridiculous extent to which Apple goes to build secure devices, and how "slick" the mute switch is on iPhones and iPads.

I wouldn't bet against it.

Re: Research shows how MacBook Webcams can spy on their users without warning

#139

Post by lawnchair_larry »

dunham wrote: post #108
hrktb wrote: post #39

Earlier quoted context omitted.

Same here. Even nude photos would be embarrassing, but audio recordings could have effects far worse than some prude shame. Especially since there is no LED to signal the microphone is active, it doesn't need to point anywhere. If it could be activated while the laptop is closed (force wake up a part of the OS for just a few minutes here and there for instance) it would be a really tough problem.

Maybe unload/delete the kernel module? (This is how I used to silence the pcspkr beep on Linux.)

No, an attacker can just reload it. The hardware is still there, waiting for a driver to control it.

Re: Research shows how MacBook Webcams can spy on their users without warning

#140

Post by SiVal »

SiVal wrote: post #30

I want hardware on/off switches for camera, microphone, wifi, bluetooth, and maybe even external speakers. These should be power switches, not switches that make a polite request to firmware for the firmware to act as if the devices are off.

In fact, I'd like these switches to be above the F-keys and to have tiny LEDs that glowed when the switch (not the device, just the power switch) was allowing power to reach the device. I still want indicators showing when the devices themselves are operating, but for security purposes, I would treat the power switch LED as a warning that the devices have power and, therefore, could be on whether they claimed to be or not.
Post reply on HN