Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Research shows how MacBook Webcams can spy on their users without warning

washingtonpost.com

Post reply on HN
Print view View original

221–230 of 241 posts

Re: Research shows how MacBook Webcams can spy on their users without warning

#221

Post by wil421 »

Don_ wrote: post #174
daeken wrote: post #21

Earlier quoted context omitted.

> I really would hate to taint my MBP with ugly duct tap on the camera, but I may have to in the future. A tiny piece of black electrical tape blends in nicely and won't leave gunk on your bezel.

>All these tape/paper/etc advices to cover the webcam Jesus Christ, guys. Do you use Linux? Just blacklist the webcam module to preventing it from loading whenever the system boots. Want to use the webcam? Load the module manually. # modprobe uvcvideo Want to unload the camera again? Easy. # modprobe -r uvcvideo Generally, it's the uvcvideo module, but it might change from system to system. A malicious code would nee…

I am pretty sure it is assumed they have root access if a hacker has installed malicious software that is taking web cam pics without a light on...

Re: Research shows how MacBook Webcams can spy on their users without warning

#222

Post by sehugg »

unspecified wrote: post #85

There is a freely-available kernel extension[1] to make this firmware hack accessible to root only. The exploit depends on modding the camera firmware from userspace. The kext is created by the same authors of the paper[2] this article is talking about. Search the paper for "iSightDefender". [1] https://github.com/stevecheckoway/iSightDefender [2] https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...

Once you're in userspace it's a short hop to root.

Re: Research shows how MacBook Webcams can spy on their users without warning

#223

Post by unspecified »

sehugg wrote: post #222
unspecified wrote: post #85

There is a freely-available kernel extension[1] to make this firmware hack accessible to root only. The exploit depends on modding the camera firmware from userspace. The kext is created by the same authors of the paper[2] this article is talking about. Search the paper for "iSightDefender". [1] https://github.com/stevecheckoway/iSightDefender [2] https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...

Once you're in userspace it's a short hop to root.

But short of any hardware changes (including taping over the camera), this kext as far as you can go in software.

I'd MUCH rather see an admin password prompt come up, instead of nothing all.

Re: Research shows how MacBook Webcams can spy on their users without warning

#224

Post by justin66 »

unwind wrote: post #193
justin66 wrote: post #155

Earlier quoted context omitted.

I'm pretty sure you don't understand the significance of the "inline" in "inline LED." We're talking about an LED that will always light when the camera is powered up because it gets power when the camera itself does, from the same physical wire. It is on if the camera is getting power from the port. You could build a prototype with an LED spliced into a webcam's USB cable if you need to convince yourself that this i…

A mechanical sliding piece of material without any electrical components at all must be considered simpler (and thus "less engineered") than an LED, mustn't it? I would be way easier to convince that a piece of plastic is harder to hack than a LED. For instance, there would be no embedded microcontroller to subvert. Also, USB is a bus , you can't splice an LED into the power line of the USB going to a camera and conc…

> A mechanical sliding piece of material without any electrical components at all must be considered simpler (and thus "less engineered") than an LED, mustn't it?

Absolutely not. The moving parts vs. no moving parts divide is pretty huge, and an LED is not a complicated thing.

> I would be way easier to convince that a piece of plastic is harder to hack than a LED. For instance, there would be no embedded microcontroller to subvert.

Having the LED in parallel on the power line is impossible to subvert without a soldering iron. I don't know why people are having trouble understanding this bit.

Perhaps to do this properly with a USB camera you'd need to give the camera its own USB controller. My god, who cares? The USB thing was just an example. The point is that you can wire in an LED such that when the camera has power, the LED has power.

> that doesn't mean the camera is performing any recording

The light today doesn't signify "recording," it just signifies that the camera is on.

Re: Research shows how MacBook Webcams can spy on their users without warning

#225

Post by pavel_lishin »

jahewson wrote: post #136
pavel_lishin wrote: post #81

Earlier quoted context omitted.

I'd pay someone $10 if I could figure out a way to make sure that my macbook never plays the "I AM NOW TURNING ON" sound.

If your MacBook is muted when you shut it down hen it will not play the startup sound.

I do not want to have to remember to mute the macbook every time I want to reboot. I'm going to try the nvram thing.

Re: Research shows how MacBook Webcams can spy on their users without warning

#226

Post by pavel_lishin »

switz wrote: post #93
pavel_lishin wrote: post #81

Earlier quoted context omitted.

I'd pay someone $10 if I could figure out a way to make sure that my macbook never plays the "I AM NOW TURNING ON" sound.

sudo nvram SystemAudioVolume=0 If this works for you, please donate the $10 to Archive.org.

Didn't work. :(

Re: Research shows how MacBook Webcams can spy on their users without warning

#227

Post by Arelius »

Lagged2Death wrote: post #117
Arelius wrote: post #110

Earlier quoted context omitted.

It's not difficult, but it makes the system unflexible, The vendors, not worried about the privacy implications, choose what makes the system more flexible. I've heard that this was a serious flaw in Google's opinion, and they went through great efforts to ensure that the LED for the chromebook pixel was actually hard-wired into the camera's electronics. Which if true, shows that it's indeed possible.

It's not difficult, but it makes the system unflexible... Um. That would be exactly the point of doing it, in this case. The camera indicator (and the microphone indicator that every laptop should but currently does not have) should be completely inflexible. What "flexibility" is added by having an indicator that only sort-of indicates, anyway?

As a consumer, from a privacy standpoint I agree. But engineers and designers of the actual hardware don't tend to feel quite the same way.

Re: Research shows how MacBook Webcams can spy on their users without warning

#228

Post by cdcarter »

Lagged2Death wrote: post #130
DanBC wrote: post #28

Earlier quoted context omitted.

Now all you have to do is warn users that the one LED is important and means something. Not like all the other LEDs that are on all the time and are mostly pointless. http://www.wired.com/threatlevel/2010/10/webcam-spy-settleme... http://www.pcmag.com/article2/0,2817,2386599,00.asp > When the school district investigated the case, it found other incidents of webcam spying, and notified the students involved, includin…

Now all you have to do is warn users that the one LED is important and means something. There is already a common pop-culture shorthand for "now recording," the blinking red light. That's cheap and simple, and everyone already knows what it means, particularly when it's on a camera. The real question, in my mind, is how the world-renowned user-experience and user-interface experts at Apple decided to use anything els…

A blinking red light would be fairly annoying for long video conferences and calls.

Re: Research shows how MacBook Webcams can spy on their users without warning

#229

Post by robryk »

nemothekid wrote: post #167
Mindless2112 wrote: post #69

Earlier quoted context omitted.

Sure, but that remaining 1% is who those 99% go to when their computer isn't working properly.

In anycase, if I wanted to know if my drive was being trashed, I'd look at command like 'top'. If people can perform remote admin on machines 1000s of miles away without the need of green LEDs, I'm sure consumer tech will do just fine.

The problem is that getting top to start can take a long time if it's actually thrashing heavily enough.

I'd agree that the LED is nonessential with HDDs -- you can just listen; and then you can even make out whether it's doing a lot of seeking or long continuous accesses, but you can't do that with SSDs.

Post reply on HN