Live data from Hacker News

Research shows how MacBook Webcams can spy on their users without warning

washingtonpost.com

211–220 of 241 posts

Re: Research shows how MacBook Webcams can spy on their users without warning

#211

Earlier quoted context omitted.

It's such an obvious solution that I really thought that WAS the case until just now. Why in the world would you tackle this problem any other way?

They basically did, the light can only be turned off when the USB signals "standby". The hack is to override the camera to ignore that signal. It is a rather unique idea and probably not something anyone even considered at Apple.

So is an MBP/A running Linux susceptible to the hack, then?

Re: Research shows how MacBook Webcams can spy on their users without warning

#212

Earlier quoted context omitted.

But how do we do that on the more and more locked-down computing appliances consumers gravitate towards? One does not simply unload/delete kernel module on an iPad...

Recent versions of iOS ask for permission to use the microphone.

What if in the case of a "lawful intercept" iOS does not ask for permission?

Re: Research shows how MacBook Webcams can spy on their users without warning

#213
post #193

Earlier quoted context omitted.

I'm pretty sure you don't understand the significance of the "inline" in "inline LED." We're talking about an LED that will always light when the camera is powered up because it gets power when the camera itself does, from the same physical wire. It is on if the camera is getting power from the port. You could build a prototype with an LED spliced into a webcam's USB cable if you need to convince yourself that this i…

A mechanical sliding piece of material without any electrical components at all must be considered simpler (and thus "less engineered") than an LED, mustn't it? I would be way easier to convince that a piece of plastic is harder to hack than a LED. For instance, there would be no embedded microcontroller to subvert. Also, USB is a bus , you can't splice an LED into the power line of the USB going to a camera and conc…

> A mechanical sliding piece of material without any electrical components at all must be considered simpler (and thus "less engineered") than an LED, mustn't it?

Looking at my current macbook lid, I don't how how that would physically fit. The camera would need to be recessed further into the lid to accomodate for the door.

> I would be way easier to convince that a piece of plastic is harder to hack than a LED. For instance, there would be no embedded microcontroller to subvert.

I'm inclined to believe that a mechanical sliding door would have a higher failure rate than an LED.

Re: Research shows how MacBook Webcams can spy on their users without warning

#215
Don't existing theft recovery programs already do this?

I can't find the link right now but I remember a couple of triumphant "nerd recovers macbook pro" stories where they show photos taken of the thief using their macbook - presumably using this very trick to take a photo without turning on the indicator light.

Re: Research shows how MacBook Webcams can spy on their users without warning

#216
post #9

Honestly, I don’t understand why it’s so difficult to create a camera chip not susceptible to any software hack. The camera sensor needs electrical current to work. Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up. My knowledge of electronics is limited, but I know for a fact that this can be achieved without th…

Story time .... a while ago I had a similar discussion with someone because I said I have a thick black tape on my Macbook's webcam and I rest easy knowing I cannot be spied on using that camera unless the laws of physics change.

Of course many people made fun of it and mentioned "blah blah you are paranoid the LED cannot be manipulated and will always turn on ...".

Well ... here you go. Where are you now?

I wouldn't be surprised if someone-cough-you-know-who-cough had influenced the design for this to become a possibility. We know they are actively looking for opportunities like this. Go ahead, call me a paranoid again ... and next month when the story about how they did just that hits hacker news, I'll have an even better story to tell.

Re: Research shows how MacBook Webcams can spy on their users without warning

#217
post #174
post #21

Earlier quoted context omitted.

> I really would hate to taint my MBP with ugly duct tap on the camera, but I may have to in the future. A tiny piece of black electrical tape blends in nicely and won't leave gunk on your bezel.

>All these tape/paper/etc advices to cover the webcam Jesus Christ, guys. Do you use Linux? Just blacklist the webcam module to preventing it from loading whenever the system boots. Want to use the webcam? Load the module manually. # modprobe uvcvideo Want to unload the camera again? Easy. # modprobe -r uvcvideo Generally, it's the uvcvideo module, but it might change from system to system. A malicious code would nee…

The same thing is possible on OS X with kextload/unload and kextutil. Moving the extension to a "disabled" folder and so on, and you have a camera without a driver.

I would say that it's still notable even if it relies on root access, since it's been previously believed that this was not possible with software at all.

Re: Research shows how MacBook Webcams can spy on their users without warning

#219
post #35

Earlier quoted context omitted.

"Now all you have to do is warn users that the one LED is important and means something. Not like all the other LEDs that are on all the time and are mostly pointless." No longer plastering devices with semi-pointless LEDs would help. Harddrive activity? Wifi? Bluetooth? I don't think all these lights are really necessary. Throw one on the power cable maybe, and a few to backlight the keyboard, but otherwise only use…

NO, that is the wrong way to go. HDD is important (especially if you have an SSD) because it shows when it's being accessed, Wifi is even more important because you're communicating over the network when that one activates, and if it's doing so without any reason to then you should suspect something going on (like malware infection). Ditto for BlueTooth. If they're implemented well, hardware indicators are impossible…

A Wi-Fi indicator is pretty useless for most users to detect malware infection because there's so much else that might be using the network at any given moment on a modern system. Likewise, I can't remember the last time I needed an HD access indicator. Don't need more things blinking at me conveying nothing useful/actionable.

Re: Research shows how MacBook Webcams can spy on their users without warning

#220
post #56
post #9

Honestly, I don’t understand why it’s so difficult to create a camera chip not susceptible to any software hack. The camera sensor needs electrical current to work. Simply place the LED inline or in parallel to the camera and you are done. Any time current is sent to the camera sensor, the LED cant help it but light up. My knowledge of electronics is limited, but I know for a fact that this can be achieved without th…

I thought the same as well. An LED in series with the circuit powering the CMOS sensor is all that would be needed. No amount of reprogramming is going to bypass a physical circuit. This is disappointing, and I expect Apple will redesign the cameras because of it.

> This is disappointing, and I expect Apple will redesign the cameras because of it.

The article mentions that authorities have tools to bypass the LED. I would guess that the complexity is on purpose and wasn't supposed to be used by the general public. I bet the same is true for sound.

Post reply on HN