How a MacBook Camera Can Spy Without Lighting Up 371
New submitter ttyler writes "It turns out a MacBook's built-in camera can be activated without turning on the green LED. An earlier report suggested the FBI could activate a device's camera without having the light turn on, and there was a case in the news where a woman had nude pictures taken of her without her knowledge. The new research out of Johns Hopkins University confirms both situations are possible. All it takes are a few tweaks to the camera's firmware."
It's pretty simple (Score:5, Insightful)
Re:It's pretty simple (Score:5, Insightful)
Far simpler for the manufacturer to wake up to what is going on and provide a sliding lens cover and that means you, you big screen smart TV designers.
Re:It's pretty simple (Score:4, Insightful)
You're assuming it's not by design.
Re:It's pretty simple (Score:5, Insightful)
30 years on, how times have changed!
Re:It's pretty simple (Score:4, Funny)
Re:It's pretty simple (Score:5, Insightful)
If they cared even remotely enough to do that, then they would have already hardwired the indicator light to the same power source as the camera so that one couldn't be run without the other regardless of the firmware.
Re:It's pretty simple (Score:4, Informative)
Re: (Score:2, Interesting)
Re:It's pretty simple (Score:5, Informative)
Re:It's pretty simple (Score:5, Insightful)
Cams can see through black plastic (Score:5, Insightful)
Many IR receivers and transmitters, such as on remote controls, are covered by opaque black plastic. That black plastic is opaque to visible light, but transparent in infrared. CMOS cameras are very good at seeing in infrared. Therefore, a factory installed cover could APPEAR opaque but actually be transparent for spying purposes.
When I was a licensed private investigator I may have taken advantage of that fact.
Re:Cams can see through black plastic (Score:4, Informative)
Light from common lightsources is unpolarized, but that does NOT mean that it is not polarized, That means, it containes a mix of light polarized in every possible direction. So even if your cover lets through some specific polarization, this wil be visible and the cover would not appear opaque.
Stick with the IR wavelengths...
Re:It's pretty simple (Score:4, Informative)
A sliding cover to a camera does not adhere to KISS from a user's perspective. It's actually an annoying additional step to using the camera - not to mention another moving part on a laptop that may break and/or jam. Plus it's actually less useful - if the sliding cover is open one probably still wants an LED to indicate whether or not the camera is actually active.
The idea of tying the LED to the power supply to the camera also won't work, at least for modern macbooks, because that camera sensor is in fact always active. It's also used as the ambient light sensor to automatically dim the display in low-light conditions. Of course, they could have used an additional sensor for that, but that would have increased the cost and complexity of the camera hardware.
The real issue here is much more general, which is that it should manifestly not be possible without root privileges to modify the firmware in any of the microcontrollers in a laptop (of which I'm sure there are several).
Re:It's pretty simple (Score:5, Funny)
A sliding cover to a camera does not adhere to KISS from a user's perspective. It's actually an annoying additional step to using the camera
I was going to say the same thing - that it makes the camera annoying to use and would probably confuse a lot of people if you ship it closed (and if you don't ship it closed, why even bother?)
There is one way you could make it covered and still not confuse users - have the sliding door activated by the computer when the camera is active. Then you could see when the camera was active, and the door could hard-wire an LED activation...
It would add cost and complexity though, and it does sound like a system that would be prone to failure rendering the camera useless. So there's still that issue.
Re: (Score:3)
Your post makes no sense. (Is it sarcastic?) A sliding cover is exactly the type of implementation that most users would trust. It is the type of intuitive things, like toggle switches for off buttons. Users used to be afraid that hackers could penetrate their systems though the modem. They knew that the system without power is safe. The more novice users did not trust that the ACPI off rally work and may have heard from "wake on lan" features. The simple solution, put the entire PC on a connector strip wit
Re: (Score:2)
Yep, and they used to call this out. I've even got an iSight with a manual lens cover iris ring. Something[body] convinced Apple to stop protecting its users' privacy. I'd put a buck down on Bull Run and spin the wheel.
Re:It's pretty simple (Score:5, Insightful)
Now, why they have an 8051 hardwired to the USB bus that accepts arbitrary firmware uploads without even having to elevate beyond user permissions, I can only blame stupidity.
Re: (Score:3)
The problem is that manufacturers want to use the camera all the time for facial recognition, gesture detection, auto-on when someone enters the room, even stuff like auto brightness/contrast control. The LED would be flickering like mad all the time.
Also, we need LEDs for microphones.
Re: (Score:3)
Re: (Score:3)
Except it was, sort of. The camera sensor has a line called STANDBY. When it's high, the camera is off and is not sending data to the USB chip. When it's low, the camera is sending image data. The LED is wired so when it goes low, the LED turns on.
The flaw is that the USB hardware firmware is
Re:It's pretty simple (Score:5, Informative)
This is essentially what apple did, according to the report. They connected the LED to the standby signal, which normally has to be disabled to read data from the camera chip. So far, so good.
But the camera chip also has a configuration register - and one of the register options are to disable listening to the standby signal, and go ahead without caring about this signal. So it looks like the designers overlooked that option, or didn't think about it as a serious scenario.
So my impression is that apple has gone further than I've imagined to make a good design, but sadly not a bugfree design. Remember that all designs, hardware or software, may have bugs.
Re: (Score:3)
2. LED's operate at nano to micro second speeds, typically up to the tens of MHz. Persistence of vision helps in making a short burst seem much longer.
Re:It's pretty simple (Score:5, Funny)
Far simpler for the manufacturer to wake up to what is going on and provide a sliding lens cover and that means you, you big screen smart TV designers.
There are a ton of 3rd party sliding covers out there for under $10 a piece, google will find them for you no problem.
But what I haven't seen yet is one that doesn't just black out the camera, but instead puts a photo in front of the camera. Imagine a camera slide that forces anyone spying on you to see goatse.cx instead. Just deserts.
Re: (Score:2)
Re: (Score:2)
Like they had on the original iSight? or on my 13 year old Logitech?
What's mind boggling though is it would probably *less* expensive to just hardwire the LED with the camera itself. If it's being used, light the LED.
Re: (Score:3)
I bet it is easier for automated testing. This way they don't need to connect any external equipment to measure if the LED works, just ask the microcontroller in the camera to run an internal diagnostic that checks the the voltage level on the lines to the LED.
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You'd think they'd actually save money if they just hard wired the LED into the camera's power source. If the camera has power, the LED is on. I'm sure that would cost them less, not more.
Re:It's pretty simple (Score:5, Insightful)
It's pretty simple: if you have a device with a camera, just cover the camera with a little black tape and tada, no more spying
I use a Post-It, with the non-sticky part over the camera hole.
That way, when I actually do want to use the camera, I simply bend the paper back and expose the camera. When I am done, I fold it back. Replacements are pretty simple. One pad should last you a long time. ;^)
Re: (Score:2)
The camera seems the most useless part of a macbook anyway. Just paint over it in black, scuff it with sandpaper, etc. I don't want to see a video of you talking, and you definitely don't want to see a video of me.
Re: (Score:3)
Well, it's pretty clear that your use case is the only one for the entire world so let's go to town!
Re: (Score:2, Funny)
If it doesn't involve Duck tape and tie-wraps, it's not geeky enough (trying to integrate popsicle sticks in it would be really cool :p
Re: (Score:2)
Re: (Score:2)
I just check if the firmware has changed.
Sticky notes? tape? Slashdot - News for mediocre office workers.
I wrote my Malware with a hook into the operating system that detects when you're reading the camera firmware to see if it's changed, then it feeds you the unaltered firmware. Plus, I only load my firmware when I want to spy on you, the rest of the time I load up the old firmware.
Re: (Score:2)
I made this modification to my macbook pro on the first day. I don't want a camera, and it stands to reason if someone can install keyloggers on my machine, they can compromise any hardware... Unfortunately there's not much to be done for the mic without voiding warranty.
I don't want either of these features, or at least i'm willing to buy special hardware for it if I need it.
Re: (Score:3)
Fix for the mic would be to either short to ground (tip) the mic lead of a headset plug, or if the macbook checks resistance link a 1k ohm reistor between tip and the mic lead, and make sure that the computer switches to using the external mic when you plug something in that provides a suitable resistance.
This could all be built within a 90 degree 3.5mm plug , or even a 2.5mm plug if necessary. It won't be quite flush with the side of the macbook, and if they use a common plug for speakers and mic, you may
Re: (Score:2)
It's pretty simple: if you have a device with a camera, just cover the camera with a little black tape and tada, no more spying
What about the microphone?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Agreed.
That's what one of my colleagues did. I thought he was being maybe just a little *too* much paranoid but admired that he actually did something about it a few months back (instead of just bitching about it.) Looks like he was simply being prudent !
Tape it. (Score:3)
Hmm... I stuck a piece of black electrical tape over mine when I got the MacBook.
Re:Tape it. (Score:5, Funny)
I put a backwards mirror over mine so they thought I was spying on them.
Re:Tape it. (Score:5, Funny)
I put a backwards mirror over mine so they thought I was spying on them.
I make sure I'm naked any time I'm within range of the camera -- anyone that makes the mistake of spying on me will not do it again.
Re:Tape it. (Score:5, Funny)
I put a backwards mirror over mine so they thought I was spying on them.
I make sure I'm naked any time I'm within range of the camera -- anyone that makes the mistake of spying on me will not do it again.
Don't be so hard on yourself. You have a lovely body.
Re: (Score:2)
Good work, JHU guys. Apple, not so much. (Score:2)
I was pretty convinced that I didn't have to put a post-it over my MacBook camera. Guess I'll go ahead and do it after all.
Re: (Score:2)
I see nothing in the article to indicate that later models are any more secure. This particular software may not work with them, but I have no confidence that they can't be hacked the same way.
Firmware (Score:2)
Re:Firmware (Score:5, Insightful)
Surely firmware can not be updated/modified without user knowledge, am I wrong?
Click here to view videos of cute kittens!!!!!!
Re:Firmware (Score:5, Funny)
Click here to view videos of cute kittens!!!!!!
OMG, where? You forgot your link!
Re:Firmware (Score:5, Informative)
Apple did actually try to fix this problem by requiring firmware updates to be encrypted. They fucked it up though and leaked the keys via the firmware update apps, so anyone could write their own battery pack malware that literally causes your laptop to catch fire.
Re: (Score:2)
Re: (Score:2)
You wouldn't think so, but in fairness to Apple, these were pretty old machines, which means they had pretty old versions of OS-X. My guess is Apple closed this bug a long time ago, which is why the researchers had to use old Macs.
Re: (Score:2)
Haha, Apple closing a security bug before it's been broadcast all over the internet, for months. Good one. You should write for Leno.
Re: (Score:2)
Surely firmware can not be updated/modified without user knowledge, am I wrong?
The article used a virtual machine which required privilege to install, and then called it "firmware modified from user space", but actually it was "firmware modified from user space by first escalating privilege".
If you are willing to escalate privilege, you can pretty much do what you want to any USB devices firmware, assuming it's not in ROM and not hardware fused to make it non-updateable.
Re: (Score:2)
If you are willing to escalate privilege, you can pretty much do what you want to any USB devices firmware, assuming it's not in ROM and not hardware fused to make it non-updateable.
I believe the assumption here is that it's not difficult for TPTB to get their firmware onto your computer. In an enterprise it's slightly tricky to do it without risk of being caught. Where individual users are concerned there is little risk in leaning on the OS vendor to deliver to you and you alone an additional payload right in a signed patch package.
Re: (Score:2)
Pretty sure that's not how the FBI does it : )
Re: (Score:3)
ASUSupdate is able to flash the BIOS without giving it admin rights, so It could be used silently I guess (on Windows XP at least last time I did it).
For other systems (*NIX including Mac OS), just make it part of a system update.
Dont forget about Sound (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
If this is in linux, this might have something to do with ACPI [wikipedia.org]. The firmware has a table called the DSDT [01.org] (Differentiated System Description Table) which basically tells the operating system how to turn integrated peripherals like network cards off and on when going to sleep or waking up.
One peculiarity of the DSDT is that the ACPI specification allows it to include different instructions to different operating systems, and this is a common source of problems in linux installs. Some manufacturers (Toshiba)
Re:Dont forget about Sound (Score:5, Interesting)
Yeah, but... (Score:2)
Yeah, but you can't hear boobies. Useless hack.
This has been known for years (Score:5, Informative)
I worked for Apple, their education department had an uproar when one school district was found to spying on the students via the iSight, the light never went on.
The school admitted they set it up that way.
They were spying on them at home, I wonder how many little kids got undressed in front of their iSights while someone watched.
http://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District [wikipedia.org]
Re: (Score:3, Informative)
"Students were particularly troubled by the momentary flickering of their webcams' green activation lights, which several students reported would periodically turn on when the camera wasn't in use, signaling that the webcam had been turned on.[8][22][24][47] Student Katerina Perech recalled: "It was just really creepy."[24] Some school officials reportedly denied that it was anything other than a technical glitch, and offered to have the laptops examined if students were concerned."
Sounds like the indicator
Godwin (Score:2)
Re:This has been known for years (Score:5, Informative)
This is news? (Score:3, Insightful)
Not by accident (Score:5, Interesting)
The big companies do as they are told. They are either owned by extremely evil sociopaths (like Bill Gates), who believe that they are fundamentally more 'elite' than powerful politicians, bankers, generals, religious leaders, etc, or they are owned by people who know the cost of doing business at such a level means 'playing ball' with those that hold real power and influence.
In an age when Bill Gates spent TENS OF BILLIONS buying the state-of-the-art depth sensor companies that eventually gave Microsoft the ability to design and build the military grade 'time-of-flight' sensor used in the Kinect 2, all at the behest of NSA full surveillance ambitions, fiddling the software and hardware so the LED that accompanies the CCD camera is controlled in a completely independent way seems like comparing the achievement of an air-craft carrier with a pea-shooter.
However, it is all a never ending program of attacks against us, the general population. You are a serious sex criminal if you put a 'hidden' camera in the room used by your 'au pair', but when the government itself specifically distributes laptops at a high-school, so spyware can video your children in their own bedrooms, NO CRIME has been committed. They push to see how far they can go, and mainstream media outlets like Slashdot encourage you to offer no resistance, no matter how horrible their abuses become.
Normally, society works by EQUILIBRIUM. They push. We push. At some point, both forces are equal. Since the time of Tony Blair, all this has changed. Now so-called civilised nations in the West are supposed to INCREASE the amount they push each and every year, and each and every year we are supposed to walk backwards another mile. Notice the Blairite propaganda for the need for ever more laws, and the need for ever greater punishments for existing laws.
Tony Blair (the 'Putin of the UK, but far more powerful and influential than Putin) travels the world, calling for more state surveillance, more censorship, more laws, more severe punishments, far more organised religion in the lives of ordinary people, and far more military actions. Blair is 'god' for Gates, Obama, and other happy members of the actual far-Right, and the pseudo-liberal far-right.
To Team Blair, we are literal CATTLE, to be controlled, manipulated and used in whatever ways best suit the needs of those that call themselves the 'elite'. Does a farmer hesitate to practice full surveillance methods over his livestock when useful? Of course not.
The combined influence of the British and Americans over the rest of the planet is terrifying. If the British and Americans put on a united front, and say to the world "spy on your sheeple as far as your funds and technology allows, and gain and lasting better control over them in this way", not one nation will stand up and say "no, this is fundamentally evil". If, in the 19th century, Britain and the US had stood together in favour of slavery, Human slavery would be more widespread today than at any previous moment in Human History.
Blair knows how far the legacy of Britain's impact on recent Human events across these last centuries goes. He knows that as I type, all across Asia, Africa, the Middle East and East Europe, despotic regimes are saying "we can get away with this, because they do the same things today in the UK and USA".
Social engineering is now happening on a scale unthinkable even a decade back. Your children are subject to waves of abusive propaganda that would have made Winston Smith think he lived in a paradise of freedom by comparison. You are now told that it is fundamentally WRONG to allow people with non-state-approved opinions to be heard in public forums. The current front page of Digg is BOASTING how science forums on Reddit only allow Tony Blair approved opinions on matters of scientific 'fact'. And yet science, by definition, is the one area where the truth needs no sociological protection, so long as individual scientific voices are not suppressed. The scientific method requires debat
Re: (Score:2)
Re:Not by accident (Score:5, Insightful)
Why are people naked in front of their PC? (Score:2)
Re: (Score:3)
Re: (Score:3)
That's where the porn lives.
Two words. (Score:2)
Duct. Tape.
And also: "and there was a case in the news where a woman had nude pictures taken of her without her knowledge". Heh heh. Those zany FBI analysts...
Goatsx (Score:5, Funny)
Obligatory (Score:3)
$5 solution (Score:3, Insightful)
Re: (Score:2)
Drive a sharp nail into the mic port should solve one of your problems.
Re: (Score:2)
It was at one time (Score:4, Informative)
A lens cover would not be compatible with the Apple Aesthetic (TM)
I have an external iSight [wikipedia.org] from way back, it actually does have a close-able lens
Re: (Score:2)
Why can't I buy a webcam with a lens cover and no microphone, or a physical on/off switch for the microphone anymore?
I wouldn't trust the switch to actually turn off the microphone any more than I trust the switch that supposedly turns off the WiFi and Bluetooth to actually do so (rather than tell the software to not use them - for the normal stack.)
Even if it DID physically turn off the Microphone, remember that the speakers built into a typical laptop can also act as microphones. If the chip driving them
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Some smart code would show the malware results of allowing a camera to be on with no visual feedback.
This was unexpected as the many people seem to think a US brand would have kept the hardware to camera working light link - suggested in an early external firewire model.
http://www.washingtonpost.com/business/technology/2013/12/06/352ba174-5397-11e3-9e2c-e1d01116fd98_story.html [washingtonpost.com]
"...overtl
Re: (Score:3)
My HP doesn't have a built in camera. My mics are filled with caulking. When I need either, I plug in external.
But that's only the mics you know about. One of those things that looks like a capacitor on your motherboard is actually a secret NSA microphone. It's wired in with one of the inside-layer traces on the motherboard so no one has detected it yet.
Re:No no (Score:4, Funny)
That's OK. You know that filling you had replaced last year?
Re: (Score:2)
Re: (Score:2)
Handheld digital cameras make a shutter noise, mandated by law, last I heard.
If you record video, does it have to play the sound of 8mm film clacking through a noisy gate?
Re: (Score:2)
Re: (Score:2)
That would be really cool, even cooler if the case looked like this and paired with either one of those
http://www.mobileshop.com/blog/mobile-phone-blogs/retro-ise-the-hell-out-of-your-nokia-n97-with-the-cityman-450/ [mobileshop.com]
http://www.amazon.com/Native-Union-MM01H-B-1-Black-Handset/dp/B003DKL4JA/ref=pd_sim_cps_4 [amazon.com]
http://www.thegreenhead.com/2012/08/iphone-cb-radio-handset.php [thegreenhead.com]
Re: (Score:2)
Re: (Score:2)
*I'ts not like you could hang the LED off of the sensor's power line.*
You could if the silicon was designed to allow it (ie: like in old webcams)
Re: (Score:2)
Re: (Score:2)
My previous laptop had an actual hardware killswitch that physically broke the connection between the camera and the USB bus, and a similar one for the wifi. My current one doesn't, it just has a key combination that disables the camera, presumably in software. This is stupid.
I'm actually wondering why this (a physical kill switch) isn't a required thing by businesses such as, oh, gyms, and companies concerned about corporate espionage. Awhile back there was a push in some companies to only issue company phones without cameras, but that seems to have fallen by the wayside.