Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Research shows how MacBook Webcams can spy on their users without warning

washingtonpost.com

Post reply on HN
Print view View original

191–200 of 241 posts

Re: Research shows how MacBook Webcams can spy on their users without warning

#191

Post by cnvogel »

Guvante wrote: post #188
wmeredith wrote: post #32

Earlier quoted context omitted.

It's such an obvious solution that I really thought that WAS the case until just now. Why in the world would you tackle this problem any other way?

They basically did, the light can only be turned off when the USB signals "standby". The hack is to override the camera to ignore that signal. It is a rather unique idea and probably not something anyone even considered at Apple.

I don't think anyone at Apple considered this LED to be designed "tamper proof". They just lazily implemented a requirement possibly written as:

-- A LED shall light up when the camera is activated.

But what they should have implemented is:

-- It shall not be possible to activate the camera without the LED being lit, taking malicious third-party software into account.

The first requirement is obviously, and demonstrably, implemented by every camera (ignoring hardware defects regarding the LED). The second is, as proven by the paper, not fulfilled by any.

{EDIT: added the malicious part to the 2nd requirement}

Re: Research shows how MacBook Webcams can spy on their users without warning

#192

Post by lawnchair_larry »

userbinator wrote: post #181
lawnchair_larry wrote: post #143

Earlier quoted context omitted.

What is a software strap? Tried to google what that is and how it works, but I don't see much. Is it known by another term?

configuration.

Not really what I'm looking for.

Re: Research shows how MacBook Webcams can spy on their users without warning

#193

Post by unwind »

justin66 wrote: post #155
winstonx wrote: post #151

Earlier quoted context omitted.

A blinking light requires electricity. The sliding cover is purely mechanical, tamper evident, and requires physical access to hack. The sliding cover is simpler and more secure.

I'm pretty sure you don't understand the significance of the "inline" in "inline LED." We're talking about an LED that will always light when the camera is powered up because it gets power when the camera itself does, from the same physical wire. It is on if the camera is getting power from the port. You could build a prototype with an LED spliced into a webcam's USB cable if you need to convince yourself that this i…

A mechanical sliding piece of material without any electrical components at all must be considered simpler (and thus "less engineered") than an LED, mustn't it?

I would be way easier to convince that a piece of plastic is harder to hack than a LED. For instance, there would be no embedded microcontroller to subvert.

Also, USB is a bus, you can't splice an LED into the power line of the USB going to a camera and conclude that when the LED is lit, the camera is recording. There's a lot of other traffic that could be happening beween the host and the device, that doesn't mean the camera is performing any recording. The reverse would of course be true, though (no light = no recording).

Re: Research shows how MacBook Webcams can spy on their users without warning

#194

Post by rcthompson »

praptak wrote: post #47
eurleif wrote: post #16

And I thought I was clever for turning the light on for only a tiny split-second to take a picture... (I wasn't writing malware. I put the program on my own laptop before I sent it in to be serviced. http://ecritters.biz/applecarefacility/ )

It actually is clever. I like this "go around instead of breaking" approach very much. Two similar cases: A car magazine claimed they discovered a serious weakness in a particular brand of a steering wheel lock. The company made a series of improvements to the lock and challenged the magazine to demo their hack. The magazine guy approached the new lock, gave it a good hard yank and it came off the steering wheel. Ano…

> serious weakness in a particular brand of a steering wheel lock ... gave it a good hard yank and it came off the steering wheel

Serious weakness indeed. Not what people (especially HN readers) usually mean by that phrase!

Re: Research shows how MacBook Webcams can spy on their users without warning

#195

Post by rcthompson »

justin wrote: post #5

I would be more concerned about the microphone. I can easily cover the camera with tape. Also, random pictures of me programming or reading HN are probably less damaging audio recordings of conversations I might be having.

Also note that a speaker can be used as microphones as well. (In physics terms they are the same device, which can convert sound to electricity or vice versa.) With modern sound cards having reprogrammable inputs and outputs, I wouldn't be surprised if even a laptop with no microphone installed could record audio.

(My friend once had to record herself for a foreign language homework, but her microphone broke. I instructed her to plug her headphones into the microphone jack and ust them instead. It worked, but she had to talk loudly to make them work.)

Re: Research shows how MacBook Webcams can spy on their users without warning

#196

Post by zmb_ »

cnvogel wrote: post #191
Guvante wrote: post #188

Earlier quoted context omitted.

They basically did, the light can only be turned off when the USB signals "standby". The hack is to override the camera to ignore that signal. It is a rather unique idea and probably not something anyone even considered at Apple.

I don't think anyone at Apple considered this LED to be designed "tamper proof". They just lazily implemented a requirement possibly written as: -- A LED shall light up when the camera is activated. But what they should have implemented is: -- It shall not be possible to activate the camera without the LED being lit, taking malicious third-party software into account. The first requirement is obviously, and demonstra…

I'd be much happier with a requirement to the industrial design department:

-- There shall be a way for the user to physically obstruct the camera lens.

Apple used to have this in their standalone camera back in the day.

Re: Research shows how MacBook Webcams can spy on their users without warning

#197

Post by collyw »

Theodores wrote: post #79
x0054 wrote: post #9

Honestly, I don’t understand why it’s so difficult to create a camera chip not susceptible to any software hack. The camera sensor needs electrical current to work. Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up. My knowledge of electronics is limited, but I know for a fact that this can be achieved without th…

Having an inline LED is still a bit over-engineered in my opinion. The earliest standalone webcams, for instance Logitech models and the IndyCam that came with the Silicon Graphics 'Indy' workstation, had a 'door' that you could slide over the lens when not in use. Lenovo had this on their all in one PC's a few years ago but I don't think they kept that feature. What was wrong with the slide-across lens cover? You wo…

It would be too complicated for some users.

Re: Research shows how MacBook Webcams can spy on their users without warning

#198

Post by collyw »

NickSharp wrote: post #165
Theodores wrote: post #79

Earlier quoted context omitted.

Having an inline LED is still a bit over-engineered in my opinion. The earliest standalone webcams, for instance Logitech models and the IndyCam that came with the Silicon Graphics 'Indy' workstation, had a 'door' that you could slide over the lens when not in use. Lenovo had this on their all in one PC's a few years ago but I don't think they kept that feature. What was wrong with the slide-across lens cover? You wo…

Two words: Masking tape.

Yep, my hippy friend does this. I thought he was being a bit paranoid.

Re: Research shows how MacBook Webcams can spy on their users without warning

#200

Post by belorn »

FBI had knowledge about this security vulnerability for years, yet they traded the security of innocent for an increased attack capability.

This is of course nothing new. They used Firefox zero day vulnerabilities before. It just highlights the priority that exist today. Their job is no longer to serve and protect, but to create news article where they can gain glory of taking down bad people.

Post reply on HN