Sophisticated OS X Backdoor Discovered

Post by landr0id » Thu, Sep 08, 2016, 6:06 PM UTC

jobu wrote: post #8

Mizza wrote: post #2

Are video captures actually possible? I could imagine video capture as part of a RAT, but what scares me is the idea of video capture that doesn't turn on the camera activity light. Are there any examples of that?

It was definitely possible a couple years back - https://jscholarship.library.jhu.edu/handle/1774.2/36569 We describe how to disable the LED on a class of Apple internal iSight webcams used in some versions of MacBook laptops and iMac desktops. This enables video to be captured without any visual indication to the user and can be accomplished entirely in user space by an unprivileged (non- root) application.

Post by nitrogen » Thu, Sep 08, 2016, 6:11 PM UTC

cptskippy wrote: post #9

stephenr wrote: post #4

Earlier quoted context omitted.

I don't know that it's possible on recent Apple hardware. I remember reading somewhere that the green LED is triggered by the camera power line, or something along those lines.

That's how it should be however that's not how it is for all web cameras. I don't know specifics about Apple.

Post by semi-extrinsic » Thu, Sep 08, 2016, 6:14 PM UTC

Mizza wrote: post #2

Are video captures actually possible? I could imagine video capture as part of a RAT, but what scares me is the idea of video capture that doesn't turn on the camera activity light. Are there any examples of that?

Post by drinchev » Thu, Sep 08, 2016, 6:15 PM UTC

Post by mhurron » Thu, Sep 08, 2016, 6:21 PM UTC

yuja_wang wrote: post #12

I thought MacOS was "Secure By Design". This is what Apple states in their official product descriptions. In fact, it says it on this current page: http://www.apple.com/business/mac/ "Because OS X is secure by design, there’s no need for IT to install additional tools or lock down functionality for employees. And with an automated zero-touch deployment process, they don’t even have to open the box."