Apple Closes iSight Security Hole

Gruber Duckie writes "Apple's security update 2006-008, posted yesterday, is a little more interesting than it sounds. According to information (and a demo!) posted at Macslash the "information leak" mentioned in Apple's advisory actually makes it possible for a web site to send whatever your (isight) web cam sees up to the server. I'm glad they fixed this quickly."

Comments

Security Hole?

[Billosaur]

Or cleverly disguised attempt to monitor people by the Department of Homeland Security? You be the judge!

Re:Security Hole?

[D-Cypell]

You be the judge!

Can I be the clandestine military tribunal?

Re:Security Hole?

[TheRaven64]

In his book, 1984, George Orwell proposed the idea of television screens that also acted as camera and allowed a remote viewer to monitor whatever was going on in front of them.

In the year 1984, Apple Computers released an advert for the first Mac with the slogan 'Why 1984 won't be like 1984.'

In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

Re:Security Hole?

[FunkeyMonk]

People, ANYTHING you do on the internet is not private -- ever!

Re:Security Hole?

[forkazoo]

Or cleverly disguised attempt to monitor people by the Department of Homeland Security? You be the judge!

I dunno about DHS, but I do know that this report has made me cancel the Christmas orders I had placed for Mac Laptops to give to hot chicks...

Re:Security Hole?

[peragrin]

I believe it's apple but it could be another company but someone has a patent for inserting a photo receptor along side of LCD color pixels.

by using software to combine the image the screen could literally be the camera.

Good for video conferencing, useful for general security(bars and vegas could suddenly have more camera's at various angles at their disposal), totally 1984.

Re:Security Hole?

[Billosaur]

In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

And in the year 2011, iMacs and iPods will join together in a cyber-network to battle the ultra-powerful PS3 collective. Oops... you weren't supposed to know about that...

Re:Security Hole?

[geobeck]

And in the year 2011, iMacs and iPods will join together in a cyber-network to battle the ultra-powerful PS3 collective.

"Those helmets weren't designed to handle this level of rock'n'roll!" -PS3 (Plankton, Sheldon the Third)

C'mon, we all know the iPods will win with music, right?

Re:Security Hole?

[Anonymous Coward]

Seriously... I knew this shit was gonna happen, which is why I was reluctant to get a macbook. Having a built in camera = asking for trouble.

Re:Security Hole?

[LurkerXXX]

Psst, hey anonymous troll. MS used to release patches at random intervals as soon as they were ready as well. They did that for many years. Their huge corporate clients asked them to consolidate the patches to a regular interval so that their tech staff could test and roll them out in synch, saving tons of time testing all their regular and custom built in-house apps with each patch that MS released to make sure nothing broke, then rolling them out to thousands of machines, then testing all their stuff again 3 days later when another patch rolled out, then 5 days later when another patch rolled out, etc, etc.

Patch Tuesday was because of customer requests. This isn't 'competition' against patch tuesday.

Re:Security Hole?

[djh101010]

That's going to keep me laughing a long time. ESPECIALLY at the mac zealots out there (those who believe it was the perfectly secure OS,

You know, it's funny. The ONLY people I ever see who say "perfectly secure" or "bulletproof", are people like you. Maybe you just don't read clearly and you think Mac folks actually are saying it, or maybe you're just an AC trying to stir up discussion. So are you ignorant, or are you lying?

Re:Security Hole?

[internic]

While what you're saying might well be true, I really don't understand the logic. If MS released patches continuously as they were completed, how would this stop major corporations from testing and deploying them on a regular cycle? Couldn't the corporation equally well still have a "patch Tuesday" where the collect all the current, undeployed patches and begin the process of testing and deploying them? All patches that became ready later than that would be processed in the next cycle. If MS released patches as they were done, each company would have the option of using whatever patching cycle they see fit. What's the benefit of MS forcing everyone to use a specific patching cycle?

Re:Security Hole?

[LurkerXXX]

Some security holes are reported to the public by security researchers, etc. But lots of them are security holes MS finds themselves, or are reported to them in private by security researchers (giving them a fair amount of time to fix them before they would be made public).

When MS releases a patch to fix one of those MS-only-new-about holes, hackers do quick diffs, etc between them and the original files to find out what exactly the hole was that MS was patching. They then write an exploit for it and release it on the net (to take over machines for bot-armies, do corporate espionage, etc). This happens within a day or a few days of the patch release. If a company doesn't bother testing and rolling out those patches until a bunch of them accumulate, they are going to leave a nice big window of attack for the bad guys.

Re:Security Hole?

[TheRaven64]

Sometimes, someone (malicious) outside MS finds a security hole and exploits it. This is called a zero-day vulnerability, since exploits are available from day 0.

More often, either a reputable security firm or someone inside MS finds a flaw. If they are outside the company, then they go through normal notification channels. Microsoft then release a patch fixing the vulnerability. At this point, a load of crackers install the patch and then diff their new system against the old one. They can then narrow down quite a lot where the hole is, and usually find it and produce exploits. Thus, an unpatched system is only vulnerable in a practical sense from some time (possibly only a few hours) after MS releases the patch. If everyone patched on different schedules then this would mean that they would have a much larger window of vulnerability. The idea of Patch Tuesday is to get everyone patched in as small amount of time as possible, so the number of vulnerable systems online after an exploit has been reverse-engineered is at a minimum.

Re:Security Hole?

[TheRaven64]

The original iSigh had a physical shutter. When the camera was turned off, the shutter closed. You could look in the end and see that it was impossible to take a picture. I don't understand why something like this wasn't included with the built-in one; a simple slider over the front would have done the trick...

Re:Security Hole?

[Roger Avary]

In his book, 1984, George Orwell proposed the idea of television screens that also acted as camera and allowed a remote viewer to monitor whatever was going on in front of them.

In the year 1984, Apple Computers released an advert for the first Mac with the slogan 'Why 1984 won't be like 1984.'

In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

I seem to recall reading here on /. that Apple actually took this a step further and patented a screen with a clusters of cameras built in-between the pixels -- which is REALLY close to Orwell's 1984.
--
ra

Re:Security Hole?

[Fahrenheit 450]

Well, if you want a number of resellers will physically disable the camera for you. We needed to have that done where I work if we ever wanted to bring them in from the parking lot...
Or you could, you know, stick an index card or a Band-Aid or something over the lens...

Re:Security Hole?

[Skuld-Chan]

He does have a point. I was in the Apple store only a month ago where an Apple salesman was telling me they have a totally secure OS that doesn't get viruses and is hacker proof (his words). I don't have my own Mac (I have one at work), but I was doubtful to his claims. I can see however how an unsuspecting consumer might buy into that.

So no - I heard this from an actual Apple employee that OSX is "perfectly secure".

To be honest they only people I've heard this claim from are Apple sales people and Apple employees at conventions (I work for a software developer).

Re:Security Hole?

[Anonymous Coward]

So are you ignorant, or are you lying?

Neither - the intelligence was bad.

Re:Security Hole?

[Anonymous Coward]

No. They'd do that with an operating system that actually has more than 5% marketshare. ;)

Re:Security Hole?

[Moofie]

And you should always take every word that comes out of a salesperson's mouth as the gospel truth, and not apply common sense ever.

Re:Security Hole?

[Anonymous Coward]

Follow the thread. He responded to someone who claimed that someone is either ignorant or lying if they think there are people making claims like "hacker proof". Salesperson or not, this refutes the "ignorant or lying" charge. He explicitly mentioned he was doubtful of the claim.

Re:Security Hole?

[internic]

That makes some sense, but it does rely on a number of assumptions: For example, if one could only discover how to exploit a vulnerability by looking at the patch, then this policy would clearly be well justified. In reality, some vulnerabilities will be announced by others before they are patched by MS, and people will devise exploits from those announced vulnerabilities or may find for themselves and exploit some of the vulnerabilities that MS is sitting on the patches for. In the end, whether the "patch Tuesday" system makes sense will depend on what proportion of exploitable vulnerabilities are discovered by MS and how much the availability of a patch speeds the development of an exploit for an already known vulnerability.

Re:Security Hole?

[djh101010]

Your interpretation is flawed. He wrote:

That's going to keep me laughing a long time. ESPECIALLY at the mac zealots out there (those who believe it was the perfectly secure OS,

to which I replied: You know, it's funny. The ONLY people I ever see who say "perfectly secure" or "bulletproof", are people like you.

That's hardly me saying "Nobody ever claims that OS X is bulletproof and perfectly safe.". If you're unable to see the difference, well, maybe someone can explain it to you. My point was, and is, I've never met this mythical person who allegedly believes that. But this is more than enouogh effort for an AC's troll post, don't you think?

Re:Security Hole?

[Moofie]

OK, so I'm a fanboy because I told you to not believe the person who's trying to sell you something? Dude, that's just common sense.

"I guess you've got to be pretty insane to paint Microsoft as the Satan of vendor lock-in, completely ignore GNU/Linux and jump to Mac which not only locks you into software but hardware too"

OK, if I had done any of those things, you might have a productive discussion with me about them. But since I didn't, I suggest you take it up with the person who did say them. I (me this carbon unit) think Microsoft is the Satan of mediocre-to-lousy quality software, with a pretty unethical business behind it. Don't much care about vendor lock in, if it's a good vendor.

Ignore GNU/Linux? Well, it's not for me. If you like it, great.

Locks you into software and hardware? As long as they do the job, vendor lock in isn't the end of the world for me. I don't get all weepy at the notion of a Mazda vehicle with a Mazda engine, either. If it works, it works.

I was surprised that Apple made the jump to Intel, but it looks like it was handled very gracefully. It could very well have gone the other way. You're arguing to a straw man.

Re:Security Hole?

[eikonos]

Wait... are you telling us that a salesman lied to you in order to make a sale!? Woah, stop the presses!

Re:Security Hole?

[noidentity]

In the year 2006, TheRaven64 was informed that there is no company named "Apple Computers".

Re:Security Hole?

[LurkerXXX]

Certainly it relies on some assumptions, and there are exceptions. Sometimes MS does release a critical patch between patch Tuesdays if there is there is an exploit in the wild, etc.

Security is always a matter of trade offs, comprehensive security vs functionality, ease-of-use, etc, etc. I'm not saying that it's a total win on either side, merely that after analysis a lot of their major clients determined that a monthly cycle would be the trade-off they wanted, and it's a pretty reasonable one. There are always going to be exploits out that MS doesn't know about, and others that they scramble to beat to the punch after someone announces a hole without giving them ample warning to fix it.

I was mainly responding to the first anonymous troll. I'm not a MS fanboy by any means. I don't feel safe unless an OpenBSD machine is between me and evildoers ;) MS does plenty of evil, lazy and/or really stupid things. Patch Tuesday is simply not one of them. They responded to customer requests by giving them what the customers asked for. It's a trade-off, but I think a quite reasonable one, and might be the best one for the situation as it is.

Re:Security Hole?

[internic]

Right. I wasn't implying it's an unreasonable compromise, only that the answer to whether it is depends on a lot of information (which I don't have). It's definitely understandable if they've done it in response to customer requests, thought I'd still be a bit skeptical of how much it really benefits the customers.

Re:Security Hole?

[geoffspear]

The Apple Store salesperson I bought my iMac from a couple of months ago asked me what color I wanted.

Clearly they're hiring people who are experts in the products they're selling.

Re:Security Hole?

[Anonymous Coward]

Your interpretation is flawed. He wrote:

That's going to keep me laughing a long time. ESPECIALLY at the mac zealots out there (those who believe it was the perfectly secure OS,

He was only referring to those Mac zealots (not all Mac users, obviously) who believe OS X is perfectly secure. If you doubt they exist, then you are naive.

to which I replied:

You know, it's funny. The ONLY people I ever see who say "perfectly secure" or "bulletproof", are people like you.

Immediately after that, you wrote: Maybe you just don't read clearly and you think Mac folks actually are saying it, or maybe you're just an AC trying to stir up discussion. So are you ignorant, or are you lying?

He said "mac zealots out there (those who believe it was the perfectly secure OS)." You called hime ignorant or a liar for thinking "Mac folks" (a larger subset than Mac zealots) would say such a thing. So are you purposely building a straw man, or are you just plain stupid?

Re:Security Hole?

[dangitman]

You know, it's funny. The ONLY people I ever see who say "perfectly secure" or "bulletproof", are people like you.

Actually, I heard Artie McStrawman say this once...

Re:Security Hole?

[boone]

So are you ignorant, or are you lying?

It seems he is doing neither, he is utilizing a practice called "Generalization" , originally made infamous by mac cultists in the act of proselytizing.

Re:Security Hole?

[MustardMan]

you expect logic from corporate IT departments?

big shocker - a bunch of dickwad corporate twits complain, and everyone on the planet suffers for it.

Re:Security Hole?

[toddestan]

I've run into a few, usually their "proof" revolves around there being no widespread viruses and malware out in the wild for the Mac like there is for Windows.

Re:Security Hole?

[Anonymous Coward]

When the camera was turned off, the shutter closed.

Actually you opened or closed the shutter by rotating the front lens (a physical interlock, so it was impossible to open the shutter in software).

Re:Security Hole?

[djh101010]

I've run into a few, usually their "proof" revolves around there being no widespread viruses and malware out in the wild for the Mac like there is for Windows.

So, does that mean that you _have_ evidence of viruses and spyware for MacOSX? Because if you know of it, you'll be farking famous. It just plain does't exist, other than in Macafee's lab. A reasonable person might question Macafee's objectiveness on the topic, all things considered.

Face it. unix's security model is different from, and superior to, that of Windows. That is what it boils down to. PCs give the bozo user rights to break the machine, Unix boxes do not. This isn't a subtle distinction. If you give Joe User control over system critical files, you're asking for trouble. Not much to say here, it's a fundamental design difference.

Re:Security Hole?

[Anonymous Coward]

My point was, and is, I've never met this mythical person who allegedly believes that.

Bullshit. You were not simply adding nothing to the conversation by pointing out you've never MET anyone that believes that. How can you add "So are you ignorant, or are you lying?" if you're just talking about who you met?

Re:Security Hole?

[Pootie Tang]

Face it. unix's security model is different from, and superior to, that of Windows. That is what it boils down to. PCs give the bozo user rights to break the machine, Unix boxes do not.

I think that's oversimplified at best. It's true that OS X (and unix in general) provides a good mechanism to become a super user temporarily which doesn't tempt people to just do everthing as a super user. There are plenty of people who do login and do everything as root though (unix in general, not sure I know OS X users that do that). I agree those people are bozos, but they exist, and unix doesn't prevent them from being idiots.

To say that unix's security model is superior is a stretch. The unix security model is actually quite limited. Access is very coarse grained. Windows is actually superior in terms of granularity. You could even argue that part of the problem is that a non-privileged user is too restrictive in windows, thus the always login as an admin behavior. Really though windows just doesn't do enough to discourage it, it's not a fundamental flaw in capabilities as you suggest, it's just horrible attention to security at the UI layer.

Finally, "break[ing] the machine" was an important consideration in the 70s when the unix security model was developed. On a shared machine protecting the users from other users is important. On a desktop, typically with a single user, protecting the OS (which is easily reinstalled) is not as important as protecting the data of the user. OS X doesn't have a security model that prevents Joe User from hosing the important files, his own data. I'm not saying it should either, that's kind of the nature of the game.

Re:Security Hole?

[node 3]

Salesperson: What color iMac would you like?
Customer: Oh, I didn't know they still came in different colors. Do you have blue?
S: Nope, sorry. All out.
C: Shoot. Well, how about green?
S: Um... No. No green.
C: Orange?
S: Let me check. <goes into the back, returns a few minutes later> Sorry, no orange.
C: How about black? That would be cool.
S: Yes.
C: Yes?
S: Yes. I mean, no. We're fresh out of black iMacs.
C: What color *do* you have in stock?
S: White.
C: That's it? White? They don't really come in colors anymore, do they?
S: No, sorry.
C: Why did you run me through this nonsense?
S: I thought for sure you were going to pick white.

Re:Security Hole?

[node 3]

The obvious counter-argument is to point out the dearth of exploits in the wild for unix-based systems compared to Windows, although that point really isn't proof so much as evidence.

More to the point, however, is that the hurdle of gaining root through user interaction limits the rate at which any exploits can spread. It doesn't make exploits impossible (in fact, there have been a few "proofs-of-concept"), but it does make a wide-spread outbreak extremely unlikely.

I really have no fear of viruses and worms on the Mac. While possible, they are extremely unlikely. More worrisome (but still a long ways off) is spyware. Fortunately, given the open nature of the Unix underpinnings (not open as in "open source", but as in the easy access to the underlying system), it will be much more difficult for spyware to hide and defend itself on a Mac (or other Unixes) like it does on Windows.

Re:Security Hole?

[node 3]

I agree that a physical, non-software-controlled shutter would be best, but I think the green LED is meant to serve a similar role. It doesn't disable the iSight, but it does notify you if it's activated.

Re:Security Hole?

[Pootie Tang]

the hurdle of gaining root through user interaction limits the rate at which any exploits can spread

No, it doesn't. An exploit can spread even from a non-privileged user. It only affects spreading from one user on the machine to another user on the same machine, which is not the normal propagation mechanism.

And images of

[Timesprout]

A fat sweaty bearded geek sitting in his parents basement scoffing pizza and jolt while on a raid with his guild is a security issue how exactly?

Re:And images of

[Rakshasa Taisab]

Uhm, the article said Apple, not Windows.

As is well known, we users of MacOSX are all tall with athletic bodies.

Re:And images of

[vjmurphy]

Well, understand that my knowledge of computers has come totally from watching TV and movies: my assumption is that while said fat sweaty bearded geek may look like he's raiding with his guild, it's likely that he's accidentally connected to a Department of Defense computer and is actually sending orders to a highly trained team of Navy Seals working undercover. The good news is that these types of things always seem to end well for all involved, with DKP for all.

Re:And images of

[jimstapleton]

given a recent slashdot article, I think your comment should be fixed:

A fat sweaty bearded granny sitting in his parents basement scoffing pizza and jolt while on a raid with his guild is a security issue how exactly?

Re:And images of

[un1xl0ser]

Dude, this was on a Mac... no games. duh

Re:And images of

[PoloniumSandwich]

It's a security issue if you're in the opposing guild. You haven't seen ".-=AAPL=-. TheJobster" running around with a giant bastard sword?

Re:And images of

[operagost]

Liar. There's Breakout, Super Breakout, and Photoshop!

Re:And images of

[shrubya]

Dude, except for WoW. that game. duh

Re:And images of

[hab136]

As is well known, we users of MacOSX are all tall with athletic bodies.

Speak for yourself.. I'm a fat sweaty geek sitting in a basement scoffing pizza and Pepsi while on a raid with his guild (WoW for OSX). No beard though, and it's my basement.

Re:And images of

[Anonymous Coward]

Its not our fault, we were just born this way!

Re:And images of

[Anonymous Coward]

Ahem. On macs?? You have a good chance of having sweaty underdressed graphic artists scoffing Tab while photoshopping.

Dreams...

Re:And images of

[Clock Nova]

Hey, we got Starcraft just last week. That's pretty fun.

Re:And images of

[blake3737]

I am?? Can you tell all the hot girls that?? They don't seem to think so... please convince them for me!!

Re:And images of

[djh101010]

Dude, this was on a Mac... no games. duh

Ignorance, or humor? It's so, so hard to tell. And besides, I could always boot the thing into Windows if I wanted. But by all means, don't let actual facts get in the way of your ignorance and/or joke. /me waits for "one button mouse" comment/

Re:And images of

[Conanymous Award]

Thank you, fellow OS X user, for making my day with this comment. Unfortunately, I must sue you for the loss of my MacBook's keyboard due to a sudden, violent outburst of tea you just caused.

Re:And images of

[jargoone]

Wow, you're awfully touchy and defensive about your choice of computer. Lighten up and just sip your latte, ok?

Oh, you can stop waiting: one-button laptop touchpads suck. Is that close enough?

Re:And images of

[rdoger6424]

You forgot chess!

Re:And images of

[Burz]

A fat sweaty bearded geek sitting in his parents basement scoffing pizza and jolt while on a raid with his guild...

Hey, some people think Santa is sexy!

Re:And images of

[VWJedi]

Actually, Photoshop (for the Mac) is compiled for a PPC processor. On an Intel Mac it runs through Rosetta (the PPC emulator built into OS X). For now, Photoshop users would be better served by keeping their PPC Macs.

Re:And images of

[djh101010]

How does a message saying, in effect, "I don't know if you're trying to be funny or if you're just completely unfamiliar with what you're talking about" equal touchy? Maybe I'm trying to understand a new, extremely subtle form of humor or something?

Re:And images of

[havockla]

CRAP....YOU SAW ME...IT DOES WORK....now i HAVE to do that security upgrade.

Re:And images of

[aristotle-dude]

Actually, Photoshop (for the Mac) is compiled for a PPC processor. On an Intel Mac it runs through Rosetta (the PPC emulator built into OS X). For now, Photoshop users would be better served by keeping their PPC Macs.

The Beta of CS3 was released on Friday as a Universal binary.

Re:And images of

[dangitman]

Not anymore. Adobe has released a public beta of Photoshop CS3 as a Universal binary. In any case, my PPC version of Photoshop runs at about the same speed on an Intel Core 2 Duo iMac as it does on my dual-core G5 Powermac.

Re:And images of

[node 3]

Thank you, fellow OS X user, for making my day with this comment. Unfortunately, I must sue you for the loss of my MacBook's keyboard due to a sudden, violent outburst of tea you just caused.

The weird thing is, Conanymous Award has never drank tea.

Too late, Taco!

[elrous0]

They didn't update QUITE fast enough. I've already seen you in your underwear.

It's not a pretty sight, folks.

-Eric

Re:Too late, Taco!

[alexburke]

Way back when, Taco's sig was something along the lines of "Pants are optional, but recommended for you." Perhaps he should have remembered that...

I guess we won't be.....

[8127972]

..... Able to see cute college co-eds prancing around in their dorms half (of if we're lucky, totally) naked.

Re:I guess we won't be.....

[rune-bare-rune]

I guess this page would quickly be the first to be subverted with that particular java applet.

Nonsense

[CmdrGravy]

The internet is full of ladies and they all surf practically naked, I know this because this is what they tell me in chatrooms and other socialising sites.

Re:Nonsense

[larkost]

Porn sites are not exactly "socializing sites".

Re:Nonsense

[Yirimyah]

Always remember that there are no girls on the internet.

Re:Nonsense

[Mir322]

who actively claim to be & access it the same way as most men do, at least.

Re:Nonsense

[Anonymous Coward]

& access it the same way as most men do

One-handed?

As Someone Who Doesn't Own A Mac...

[sweatyboatman]

I personally am disappointed. Imagine the YouTube videos that would have been possible with just a month's worth of such video. I mean, yes, 90% of it would be unshowered nerds with bad posture, but that 10% would have been gold!

Yeah

[Anonymous Coward]

Now the all the exhibitionists start using macs..

and...

[SuperStretchy]

it didn't take till Tuesday of the second week, 2 months after the hole was found either.

Re:and...

[cnettel]

Reservation: I didn't read TFA, I've no idea about CVE numbers, but the CVE number for this issue was first listed as "reserved" over a month ago. Not two months after it was found, but still six weeks or so.

Re:and...

[petard]

Apple reserves blocks of CVE numbers in advance, without necessarily having a problem report that matches up. They were told about this on 01 December.

Re:and...

[Valthan]

Wasn't the hole found about a year ago now?

Darn.

[Grendel Drago]

And Mac users are lithe, sexy art types, too. I know, because the ads tell me so.

Re:Darn.

[pnaro]

And we are too ... if you consider THIS Mac user to be a middle-aged, self-employed unix geek / database administrator / developer. The ads made me so.

Don't believe it

[Anonymous Coward]

I refuse to believe this, it has to be a hoax. Everyone round here keeps saying that only 'Windoze' has security problems, and that Macs are immune. Besides, Mac users don't run with admin rights, so this can't be possible, right?

Wrong demographic for Mac...

[xxxJonBoyxxx]

Wrong demographic for Mac...if you wanted to see male liberal arts majors with rectangular-lensed glasses watch Futurama reruns on bean-bag chairs I think you'd be happier.

Would make for a GREAT security wake-up website

[Jah-Wren Ryel]

There are a few websites out there that will tell you your IP address, browser type, OS type and even guess at your general geographic location based on things your browser tells it. Some of these sites do it to "shock" people into realizing they are NOT anonymous on the net.

What a great enhancement it would be for such websites to display a picture of the user at his computer! "We know you use a Mac, Live in California and Look like THIS!" Just one visit such a site would go a LONG way to instilling a useful level of caution.

Re:Would make for a GREAT security wake-up website

[Peganthyrus]

You can still do this.

Re:Would make for a GREAT security wake-up website

[GrueMoon]

Thanks a lot - that web page completely froze up my Firefox.

Re:Would make for a GREAT security wake-up website

[Peganthyrus]

Sorry about that. Works fine for me on Safari. I guess Firefox and/or your system doesn't like tiny Quartz compositions.

Re:Would make for a GREAT security wake-up website

[Peganthyrus]

Oops, no, you can't - I just went and plugged in the webcam to check. Seems that any and all QCs that use the 'video input' or 'audio input' are now "unsafe, and cannot be viewed in WebKit", though you only get that warning when linking straight to the .qtz. Well, that's no fun!

You know, people can get audio and video through the Flash player too and nobody's gone hogshit.

Re:Would make for a GREAT security wake-up website

[Anthracks]

It froze mine too...on Windows XP. WTF? Why should WinXP care about Quartz? Perhaps I'll have to file a bug.

Re:Would make for a GREAT security wake-up website

[RandomPrecision]

Huh. Mine too, but after closing FF and restoring my session, it worked fine. Strange.

Re:Would make for a GREAT security wake-up website

[Macthorpe]

Did exactly the same with me and Opera. Crashed the browser, restarted and it worked fine.

What an oddity.

Re:Would make for a GREAT security wake-up website

[Firehed]

That freaked me out when it came up in MacHeist. It continues to freak be out because it's not blocked by my freshly installed NoScript extension.

Re:Would make for a GREAT security wake-up website

[Lars T.]

So it showed you Firefox has a potential security hole allowing code execution instead.

Re:Would make for a GREAT security wake-up website

[99BottlesOfBeerInMyF]

Thanks a lot - that web page completely froze up my Firefox.

It worked fine for me with Firefox 3alpha1, although it displays the end of the tag as text. No crashes though. For an alpha, I'm pretty impressed with the stability and the native spellchecking and cocoa widgets rule. Check it out. (Disclaimer your milage may vary, it is an alpha... don't try typing your thesis in this and complain when it crashes.)

Re:Would make for a GREAT security wake-up website

[emlyncorrin]

I just installed the update and restarted, and that website STILL switches on my iSight without warning.

Why didn't anybody tell me?

[UnknowingFool]

[Stops dancing wildly in front of computer]
Nobody saw that, right?

Re:Why didn't anybody tell me?

[Lars T.]

[Stops dancing wildly in front of computer]
Nobody saw that, right?

No, but we felt the earth move.

Re:Why didn't anybody tell me?

[frdmfghtr]

[Stops dancing wildly in front of computer]
Nobody saw that, right?

Ask me again after I wash my eyes out with battery acid.

Re:Why didn't anybody tell me?

[dangitman]

Is that you, Elaine Benez?

Am I the only one

[LittleBunny]

Am I the only one who wishes that the laptops with the built-in iSight had a way to manually close the shutter, like the standalone iSight? I always keep mine closed when I'm not using it, but the lack of such a shutter on the laptops makes me profoundly uncomfortable at the thought of owning one. Maybe this sort of thing will serve as a wakeup call?

Re:Am I the only one

[Orthodork]

Duct tape will manually close the shutter. And a tinfoil hat will keep those nasty thoughts out of your head a little better.

Re:Am I the only one

[Sierran]

Heh. You're not the only one. Despite fears of being called a paranoiac, and despite assurances that the 'in use' LED would warn me, I have this nice little stuffed penguin, see...and when I place him atop my iMac, his beak fits just precisely over the camera lens.

Now all those unscrupulous bastards at DHS need to do is realize that my cat is a) home all day and b) bribable with kibbles and I'm *screwed*.

Re:Am I the only one

[Anonymous Coward]

Am I the only one who wishes that the laptops with the built-in iSight had a way to manually close the shutter, like the standalone iSight?

Some guy makes and sells a $10 bit of plastic that does what you want.

If you want to disable it permanantly it only takes a little drop of glue to disfigure the lens so the camera doesn't show anything useful...

Re:Am I the only one

[LittleBunny]

I've tried the tinfoil hat, believe me. Multiple layers, even. It seems to have no discernable effects on nasty thoughts. But then, maybe I just haven't given it enough time.

Re:Am I the only one

[OldeTimeGeek]

It works better if you nail it down. Or so I've been told...

Re:Am I the only one

[geobeck]

...I have this nice little stuffed penguin, see...and when I place him atop my iMac...

So you're using a Linux patch for your Mac vulnerability?

Re:Am I the only one

[soft_guy]

There are inexpensive third party covers for the built-in iSight that stay on real well and don't damage the computer/camera.

Re:Am I the only one

[Thumper_SVX]

And you're going to miss the honking great green "in use" light? If you can't see that while looking at the screen, I'd have your eyes checked. Mine on my Macbook Pro is actually quite distracting when it's on. Yes, I use it for IM occasionally.

Re:Am I the only one

[LittleBunny]

Well, I don't know... if someone's savvy enough to hack a Mac enough to activate my camera without my permission, it's reasonable to think that they might be able to turn off the honking great green 'in use' light (BTW when is a light that's approximately 1 mm square 'honking great'?). Call me crazy, but I trust a nice, opaque metal shutter a bit more than a green LED.

Re:Am I the only one

[Thumper_SVX]

Electrically speaking, that's impossible. The way the LED is wired up it isn't software controlled; it's hardware. If there's a current to the camera, there's a current to the LED.

OK... it isn't big, but it IS bright. I mean distractingly so... it just looks big when it's on :)

Re:Am I the only one

[slamb]

Am I the only one who wishes that the laptops with the built-in iSight had a way to manually close the shutter, like the standalone iSight?

First, there is an obvious green light by the camera that comes on when it's active. I hope that it's hardwired so that a firmware update can't just flash that functionality away. So you can at least know something's up when the light comes on, though you can't necessarily prevent it in advance without add-on security. (Something seems wrong about taping over my shiny laptop, though Zen and the Art of Motorcycle Maintenance says it's okay to fix the motorcycle with the cheap metal from a pop can.)

But no, you're not the only person who wishes that. I'd like to go further. I wish there were a similar mechanism (at least the light, maybe a manual switch) for the microphone. I'm not sure why people are so worried about people looking at them but don't even think of the possibility that somone could be listening to them. Almost all laptops (not just new Apple ones) come with a built-in microphone, and it's only a matter of time until people start using viruses/worms/trojans to spy on conversations.

Still...if we can't trust our computers not to spy on us in the physical world, that's a pretty sad statement for eCommerce. At some point you have to type the credit card number into the computer...better make the software trustworthy...

Whew!

[Anonymous Coward]

Good thing I'm running Linux...

Nothing to iSight here...

[Rastignac]

...move along. ;)

Why this is interesting

[daveschroeder]

Of course, an application running on your local machine can do anything it wants. So it's not surprising that a malicious Java applet/application could, well, do malicious things.

For those who don't know, a Quartz Composer composition saved as a QuickTime movie can display the iSight image locally. Since QuickTime movies can be embedded in web pages, you can create a movie that displays the *local* iSight image back to the person, locally. Nifty, right?

But is interesting is that via Java hooks in QuickTime for Java, a Java applet could be used in conjunction with this Quartz Composer movie to do anything that a Java applet could instruct QuickTime to do - including take a shot of whatever is being displayed in the QuickTime movie - and then do anything else a Java applet could be designed to do - in this case, potentially send that image somewhere.

So, this could be done on any platform with a camera, since all it is is malware running to perform a specific task.

But what's more interesting is:

- All Mac OS X systems will always have QuickTime, and thus always have the capability to run such a composition
- All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)

The ubiquitousness of iSight camera is what makes this little trick interesting. It also raises issues such as: why didn't Apple offer an option to delete the camera (especially for government/military customers, as other vendors, like Palm, do), and why didn't Apple offer a mechanical shutter for the iSight on all models?

In any case, it's fixed with Security Update 2006-008, but a legitimate Java application, i.e., one you trust, could still do just that. Which stands to reason, of course, since code running on your machine - even if instantiated by a web page - can really do anything that you have permission to do, including delete files. That's the nature of applications.

One other note: you can indeed disable the iSight by (re)moving: /System/Library/Extensions/Apple_iSight.kext /System/Library/QuickTime/QuickTimeUSBVDCDigitizer .component

In sum, the reason why this is interesting is because of the ubiquitousness of the Apple iSight on Apple laptops and the fact that it's ready for use. But, someone still has to visit a malicious site and run a malicious Java applet - user interaction: the hallmark of Mac OS X vulnerabilities!

Re:Why this is interesting

[galego]

- All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)

What .. just like those that save a piece of the packaging to act as a buffer between the keyboard and screen on their laptops... save a piece of tape [duct|electrical|masking] to patch that [security] hole.

:p

Re:Why this is interesting

[daveschroeder]

I should also note that, for government/military customers, Apple does have a contractor that can physically disconnect the iSight and internal microphone as part of the procurement process, and meets GSA schedules and requirements for "no-camera" or "no-microphone" environments; additionally, infrared, Bluetooth, and AirPort can also be disabled. This does not void any waranties. That contractor is:

Holmans
6201 N. Jefferson Ave
Albuquerque, NM 887109
Tony Greiner
505 343 3529
tgreiner@holmans.com

GSA schedule GS-35F-0341N
DOE authorized (LLNL and LANL)
DOE "L" clearance personnel

For individual customers, any Apple Authorized Service Provider can disconnect any or all of the above components, and are happy to accommodate such requests. Such requests also do not void warranties.

Again, these components can all be disabled by software means in managed environments where physical disconnection/removal of the device(s) is not a requirement.

I should note that this trick could technically be done any any platform with a camera: run malicious software designed to send imagery from an attached camera somewhere. But in the case of Mac OS X on Apple hardware, it becomes interesting because Apple has already done all the work to drive the camera and display within QuickTime (via Quartz Composer, the integrated camera and drivers, and so on), and then QuickTime for Java can be used via a malicious Java application or applet (which still has to be run, of course) to send images remotely. After Security Update 2006-008, a Java applet (unless it is a signed applet that is specifically allowed by the user) can no longer make such such calls to QuickTime for Java.

Re:Why this is interesting

[Anonymous Coward]

Seriously. If you want EASILY and QUICKLY disable iSight, what about just putting a piece of tape over the camera?!

Re:Why this is interesting

[IamTheRealMike]

In sum, the reason why this is interesting is because of the ubiquitousness of the Apple iSight on Apple laptops and the fact that it's ready for use. But, someone still has to visit a malicious site and run a malicious Java applet - user interaction: the hallmark of Mac OS X vulnerabilities!

Look, I know you like Macs, like Apple etc. It's a running theme whenever I see your posts. However, it's perfectly feasable to (say) buy a Flash advert slot on a widely used network then have the Flash movie inject an invisible java applet into the page using its DOM integration (if you even want to get that fancy). Java applets are designed to be loaded and run automatically, that's why they have this secure sandbox model that Apple went and violated in the classic fashion of integrating all its OS components with the web browser. If a Java applet can record what your camera sees that is a HUGE deal. It cannot simply be blown off like that!

Re:Why this is interesting

[daveschroeder]

It's a good thing that this was never in the wild (insert someone ominously saying "THAT WE KNOW OF..." here) and is now fixed, then, isn't it?

And actually, this has nothing to do with "integrating all (?) its OS components with the web browser". It has to do with QuickTime movies being able to be embedded in a web page, which is perfectly appropriate, and another supported feature of QuickTime, namely QuickTime for Java, being able to take instructions from a Java applet, like it was designed to do. None of these things are "bugs", but the confluence of them in this circumstance allows a malicious applet to take imagery from the camera via a Quartz Composer composition. This has ZERO to do with "integrating OS components" into the browser. This is all done via QuickTime and QuickTime for Java, which can be accessed via the browser. Oversight? Yes. Now fixed? Yes.

As for how long you think a malicious ad doing *anything* on a major network would survive, let's just say "not long". By that logic, you could make the same claim about things that install malware via browser vulnerabilities on any platform: "But what if you got this on a popular site?!?" Yeah, what if?

Re:Why this is interesting

[IamTheRealMike]

As for how long you think a malicious ad doing *anything* on a major network would survive, let's just say "not long".

It doesn't have to be long, that's the trick. This isn't a theoretical problem, it has actually happened multiple times with previous browser based exploits. One ad-based attack is estimated to have zombied over a million machines in the span of hours it was live for. This makes sense - ad networks serve millions of impressions per hour, and it can easily take several hours for them to respond and pull an ad, especially if it goes live in the middle of the night (or worse, the ad is designed to behave itself when loaded into the ad networks IP address range - I believe this has also happened).

See here for more details

Re:Why this is interesting

[mandelbr0t]

But is interesting is that via Java hooks in QuickTime for Java, a Java applet could be used in conjunction with this Quartz Composer movie to do anything that a Java applet could instruct QuickTime to do - including take a shot of whatever is being displayed in the QuickTime movie - and then do anything else a Java applet could be designed to do - in this case, potentially send that image somewhere.

It's also interesting to note that a Java applet by default is designed not to do what you're suggesting. The worst case scenario is that you download an applet from a site, and it sends the image there. It would not, without modifying the local Java policy (not for n00bs), be able to send the image anywhere except the website you downloaded the applet from. You would have to accept the applet, and the warning very clearly states that accepting an unsigned applet is dangerous. If the applet is signed, the warning will tell you who signed it, and that accepting the applet requires trusting the signer. I'll admit, there's some people that might be taken in by this rogue applet, but doing nasty things with a Java applet was something that Java took some effort to prevent.

mandelbr0t

Re:Why this is interesting

[Thrip]

Thanks for the lucid summary.

... a malicious Java application or applet (which still has to be run, of course)... If I understand, before the patch this did not require a signed applet, which means it did not "have to be run" -- it would run automatically when the page loaded.

Re:Why this is interesting

[Mistah Blue]

- All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)

Not true. I have a PowerBook G4. It has no camera.

Keep their little heads in the sand.

[delire]

Got to love the idea of using an OS whose scope of security vulnerability need to be 'leaked' to be known.

Fsck that..

Re:Keep their little heads in the sand.

[delire]

Yes I realise I just had an RTFA parse error..

No security hole -- RTFrigginA

[Deep Fried Geekboy]

If Cmdr Taco had actually read the friggin' MacSlash article he links to, and scrolled down to the comments, he'd see that the 'exploit' is not fixed by this patch and what's more, doesn't send info to the server. Fer feck's sake.

Re:No security hole -- RTFrigginA

[Anonymous Coward]

Uhh... you need to RTFA and look at the demo. The exploit is the ability to send the picture to the server, and that works if you haven't patched. The old prank movies that don't send the picture to the server (they're related to the exploit but are only part of the equation) still work after the patch.

Re:No security hole -- RTFrigginA

[annodomini]

And if you had read the Security Advisory, you would have seen that the problem they were fixing was about data being sent to the server and was fixed. They did not remove quartz composer functionality from Quicktime movies, so the movies you can download that show you to yourself, possibly with some effects added, still work (and are still a little creepy), but they only display the picture locally. What they did was remove the functionality from unsigned Java applets to embed such movies, because those applets could take the image produced by Quicktime and send it back to the server, which was a real problem.

Re:No security hole -- RTFrigginA

[99BottlesOfBeerInMyF]

What they did was remove the functionality from unsigned Java applets to embed such movies, because those applets could take the image produced by Quicktime and send it back to the server, which was a real problem.

Yeah, too bad Sun announced yesterday a flaw in all their runtime environments that allows untrusted applets to access data from trusted applets. I don't think Apple has squashed that one, so there is still some potential for mischief.

Re:No security hole -- RTFrigginA

[Anonymous Coward]

FTFSA:

Description: Java applets may use QuickTime for Java to obtain the images rendered on screen by embedded QuickTime objects and upload them to the originating web site. When this facility is used in conjunction with Quartz Composer, it becomes possible to capture images that may contain local information. This update addresses the issue by disallowing Quartz Composer compositions in unsigned Java applets. Quartz Composer compositions continue to function locally.

Continue to work locally and prevent Java applets from uploading images to the originating website.
It also sounds like the problem may have been more widespread than just iSight feeds... like any QuickTime embedded object.

Re:No security hole -- RTFrigginA

[ioErr]

IIRC Apple uses their own java runtime environment, not Sun's.

Re:No security hole -- RTFrigginA

[shawnce]

What you say is true for some definition of "java runtime environment".

In general however Apple attempts to use as much of Sun's implementation as possible so very often issues in Sun's JVM can be present in Apple's.

just like flash?

[zen611]

Doesn't flash do this already? As a "feature"?

Re:just like flash?

[pwrtool 45]

As mbessy said, this is disabled by default for both your webcam and microphone. You can enable them (or change other flash settings) by going here:

http://www.macromedia.com/support/documentation/en /flashplayer/help/settings_manager03.html

Sun

[BenjyD]

I guess this kind of thing is why Sun put a mechanical lens cover on their webcams.

Re:Sun

[dangitman]

A simple mechanical cover is futile against the intense nuclear power of the sun.

Whew!

[Anonymous Coward]

Good thing I'm using IE7 + Windows XP on my Mac Book. Oh wait...

Shameful this hasn't shown up yet.

[0100010001010011]

In Soviet Russia, websites look at you!

Re:Shameful this hasn't shown up yet.

[whobutdrew]

Hahahah nicely done!

Re:Shameful this hasn't shown up yet.

[Anonymous Coward]

ROTFLMAO!!!!!!

Closes iSight (security hole)

[ezzewezza]

Just makes me think:

It is pitch black. You are likely to be eaten by a grue.

Oblig. Buckaroo Banzai quote

[transporter_ii]

Laugh-a while you can monkey boy.





Which is kind of fitting with the Buckaroo article on the front page yesterday!

Transporter_ii

Yeah, just like that, except:

[mbessey]

The "feature" of sending video to random strangers on the Internet is disabled by default for Flash, and was enabled by default for QuickTime/Java beore this patch was issued.

Scoffing pizza?

[Doctor Memory]

"Pizza, bah!"

"Your pizza is insignificant compared to the power of the Force!"

"Dude, pizza is, like, so last week, dude..."

ITYM scarfing pizza...

Re:Scoffing pizza?

[TheLink]

scoff is correct.

http://dictionary.reference.com/search?q=scoff

scarf is slang.

Re:Scoffing pizza?

[Doctor Memory]

So....

[netsfr]

does this mean that next months "Month of OSX bugs" is now one day (bug) short?

it's a feature!

[Anonymous Coward]

You guys have it all wrong. It's not a security hole, it's feature!
They wanted to save you the time it takes to post to YouTube.

Tape War

[bill_mcgonigle]

In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

Your Orwellian society is defeated by a piece of tape.

Re:Tape War

[Yvan256]

Your Orwellian society is defeated by a piece of tape.

And some CD DRM is defeated by a Sharpie marker.

Isn't technology great? In the future, Red Green is going to rule the world!

Re:Tape War

[rahrens]

Once they get the camera pixel patent into production, and the entire screen surface is the camera lens, that won't work! (unless you just don't wanna watch TV!)

Re:Tape War

[Anonymous Coward]

...if tape is outlawed, only outlaws will have tape!

Re:Tape War

[FLEB]

How about Post-Its? I use a Post-it.

Re:Tape War

[Redundant offtopic t]

Don't watch TV? That's inhuman! And inhumane! Think of the advertisers!

Amusing Anecdote

[99BottlesOfBeerInMyF]

One day I wandered into the closest Apple store and was playing with the latest version of OS X to see if I wanted to upgrade. They all had internet connections and isight cameras and I thought it would be fun to play with them. So I made up a new ichat account and added a few people I knew at the time with a camera on their system to the buddy list to see if they were online. The person available just happened to be a cute college co-ed dating one of my buddies. She's one of those skinny little redheads guys always seem to fall for. Anyway, after I got to try out the video chat feature I took off and thought no more about it.

The next time I talked to her she told me I had brought her a lot of entertainment and some embarrassment. It seems people in the store also wanted to try out the video chat, and since there was an account set up with her on the list, they kept sending her chat requests. This was the entertaining part. The embarrassing part was the first time someone did that, she assumed it was me again, and was not quite fully dressed at the time. She said the guy seemed pretty shocked, but nice enough after she jumped out of the camera's line of sight and pulled on a robe.

Re:Amusing Anecdote

[TheLink]

So she doesn't mind you seeing her "not quite fully dressed"?

Hmmm...

Re:Amusing Anecdote

[99BottlesOfBeerInMyF]

So she doesn't mind you seeing her "not quite fully dressed"?

Not everyone is a prude :) Besides, I'm living with her old roommate, who is cuter yet, which puts me in the "safe" category as far as most women are concerned.

Re:Amusing Anecdote

[Woy]

... Looking back, most industry executives agreed that the singular moment that propelled Apple to its current 97% marketshare was a lone post on what was then just another Internet forum, and not the brain center for the world government it is today: "The post from '99 [99BottlesOfBeerInMyF] really just got things started," says Steve Jobs, "Up until then we were kind of sitting around wondering how to sell all those shiny computers. We knew about girls and cameras, but we didn't think of putting the two together." ninenine and autopr0n agree: "It wasn't so much what the girls said - we couldn't really hear them - but it was the surprised look on their faces and breasts. 'OMG! Pervert!' Man...still sends a shiver down my spine. 'Pervert!'. We weren't quite exploiting sex comercially before, and then, after that post it was like 'ok, we need to get to it and get this done.' And that's what we did." Coming up next on Behind the Games: 99's sex change operation, and '99's friend's battle with fame and amphetamines.

(a tribute)

Re:Amusing Anecdote

[GregNorc]

Ladder theory.

Re:Amusing Anecdote

[TheLink]

I dunno. Maybe she was trying to get your attention... ;)

Re:Amusing Anecdote

[Anonymous Coward]

Post screen captures, please.

To, uh, proved your veracity.

/View mode

[dpbsmith]

Back in the late 1980s and early 1990s, Compuserve's "CB simulator," Delphi, and other services provided text-based multiway services of the kind now known as "chat."

It was fairly common for someone to make a joking about how they were or were not dressed. A common reply was for someone else to type something like /view mode on

and tell the group that he or she could now verify whether or not first speaker had been telling the truth. Occasionally the first speaker would be naive and gullible enough to believe it.

Little did I know that /view mode would actually be implemented within my lifetime.

Oh my god

[Thabenksta]

Haha, a security hole in a Mac! Look everyone, they suck like M$!

Let's make a big deal about it and pretend like whatever operating system we happen to enjoy is perfect.

Re:Oh my god

[Anonymous Coward]

Or let's make a big deal about it and pretend like whatever operating system we happen to enjoy is equally vulnerable, difficult to secure or as frequently compromised.

OSX user from beta : not one virus...not one

silence is golden

[GanjaManja]

Interesting that it got fixed before it was all over the net that it even existed... who knew about this before the security update was posted (yesterday on my mac)?

Sounds like an old SunOS issue

[Stonent1]

Some versions of SunOS had /dev/audio set with permissions that anyone could access it. So someone would just have to telnet into the computer with a non-root account and dd if=/dev/audio of=/export/home/joeschmoe/capture and get a dump of anything being said in that room.

What about the microphone?

[Anonymous Coward]

Even more scary. No LED. Can hear far away.

Re:What about the microphone?

[Yvan256]

Aren't the iSight and microphone supposed to be electronically wired to the LED? I.E. if the iSight and/or microphone are being accessed, the LED lights up?

Re:What about the microphone?

[Anonymous Coward]

Yeah they should In my opinion. But try this: launch QuickTime, select File and New Audio Recording and record a clip using the Macbook microphone. Unlike using the File and New Movie Recording, it DOES NOT light up the LED. Sorry.

Re:What about the microphone?

[Anonymous Coward]

that's because the camera, next to the LED, is not being used. :-0 !

Re:What about the microphone?

[Yvan256]

I would try it, but there's no LED on my PowerBook and no iSight nor microphone on my Mac mini.

Re:What about the microphone?

[SeaFox]

Aren't the iSight and microphone supposed to be electronically wired to the LED? I.E. if the iSight and/or microphone are being accessed, the LED lights up?

That is true. But the LED is only active if the camera is in use, so you [i]could[/i] take occasional still pictures and the LED would only be on for a second each time the photo is taken, so you would be less likely to notice it, it also would reduce the chances of capturing an image of any use to the spy, but still...

What Apple ought to do

[Anonymous Coward]

Apple could improve security in two ways:

1. Make the built-in camera rotate to several positions: 1. Forward to the user for iChat sessions, 2. To the side to look inside the case and thus at nothing no matter what a virus does (mechanical security), and 3. Backward so users can video tape a class or speech without a $20 mirror gadget.

2. Put a Security option in the Apple menu that'd include the ability, hardwired into the kernel, to shut down: 1. Camera, 2. Mike, 3. WiFi, 4. Bluetooth, 5. Remote Ethernet addresses, 6. All Ethernet addresses, and 7. All outgoing Ethernet traffic. In hostile situations, this would make our Macs deaf, blind and mute to all external attacks.

Give me a break

[CODiNE]

So all the high rated posts I see talk about how terrible Apple's security was, 1984 comes true, blah blah blah.

Did any of you bother to try out the exploit? I just did... know what it does? It turns on that bright green LED right next to the camera, the one that tells you when it's on. It's pretty bright and when it turns on all of the sudden, you NOTICE. It then proceeded to crash my browser. Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.

True with proprietary software one just never knows for sure, but honestly let's see someone figure out how to take a picture or make a movie without the light coming on, THEN we can start calling Apple Big Brother. Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.

Re:Give me a break

[99BottlesOfBeerInMyF]

So all the high rated posts I see talk about how terrible Apple's security was, 1984 comes true, blah blah blah.

I don't see that as the character of the highly rated posts here.

Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.

I strongly suspect that the LED is hardwired to the camera. That would be easy to do and makes sense from a design perspective. I'd be happier, however, if Apple provided some confirmation of this, rather than leaving us all to hope that is the case.

... but honestly let's see someone figure out how to take a picture or make a movie without the light coming on, THEN we can start calling Apple Big Brother.

I think that would make them lousy designers, not big brother, unless there is also evidence that they are doing something with that anti-feature. I'm not happy, however, about assuming all is well unless it can be proved otherwise. I like openness in this regard rather than relying upon obscurity.

Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.

That's not necessarily so. It could be they bought an off the shelf component without an indicator and wanted to tie its operation to the LED, but the interface was such that you couldn't just string it inline with the power without detrimental affects. So they put them both in and tied them in firmware or software and are hoping no one will figure out that it can be bypassed. That would explain their silence on the topic, although it could just be that no one who knows has realized people want to know or have doubts. I rarely use the iSight on my laptop and I did not pay for it anyway. If I feel it is a threat a small square of metal and some electrical tape will take care of it.

Re:Give me a break

[dmd]

I strongly suspect that the LED is hardwired to the camera. That would be easy to do and makes sense from a design perspective. I'd be happier, however, if Apple provided some confirmation of this, rather than leaving us all to hope that is the case.

There's no need for Apple to provide confirmation of this - even if they did, would their just saying so convince anyone?

Open it up and check. Yes, powering the camera also powers the LED. It's that simple. It took an hour.

Re:Give me a break

[99BottlesOfBeerInMyF]

Open it up and check.

Yeah, I'll be cracking open my production machine from work any minute now.

Yes, powering the camera also powers the LED. It's that simple. It took an hour.

Hopefully you took pictures. Is this clear from the wiring or is the LED attached to the control?

iSight - Unavailable at Apple Store Online

[Bones3D_mac]

If you check out the iSight section of Apple's online store, the iSight itself is nowhere to be found. I noticed this a few days ago, thinking it may just indicate an update was coming at the next MacWorld event a couple weeks from now. However, I'm starting to think this issue may well be a factor toward its seemingly sudden disappearance from Apple's website.

Re:iSight - Unavailable at Apple Store Online

[99BottlesOfBeerInMyF]

However, I'm starting to think this issue may well be a factor toward its seemingly sudden disappearance from Apple's website.

I doubt it. I suspect that they are waiting to release a new version. They pulled it from their european stores a while ago when the new import rules went into place and have not yet started selling a compliant redesign. Since they are now built-in on all laptops and imacs, there is less demand for these and it probably just is not a priority. They could even just add them as a built-in feature of their displays and stop selling stand alone models, although that would be less than ideal for some users.

Re:Tape War-what about the mic?

[Anonymous Coward]

Seriously, how can anybody be sure that everything you have ever done on your computer, since the advent of the internet, hasn't been recorded and cached somewhere, for later analysis...

Funny...

[insanityrules]

My old iSight camera (which is rumored to be discontinued soon) has a handy dandy shutter built in! And a way better microphone than the internal POS in my 15inch PPC/PB.

I somehow broke the display on my girlfriends 12inch iBook last year, er, well it just got kinda knocked of the desk (not much room in a typical studio apartment in Tokyo). I wanted to buy her a new Apple laptop, but they all have a camera that you can't physically turn off. The last thing in the world I want is for someone to see my future wife running around in her un-mentionables. Knowing her technical ability to shut off the camera, or simply remember to cover it up I opted to replace the lcd, and send an external iSight.

Funny thing, it was cheaper to put it in a box, send it home to the states, fix and ship back to her. Labor rates over there are silly stupid, but parts are really easy to find. I love otaku-land (akihabara) for parts.

A simple shutter would be really welcome, and would likely be a simple replacement bezel swap.

-YMMV

Fundamental design problem

[MobyDisk]

People who think Apple is safe by design need to take a hard look at this vulnerability.

Description: Java applets may use QuickTime for Java to obtain the images... This is just like the classic Microsoft/ActiveX type of problems. They exposed a control to web pages then realized, after the fact, that the control could do things they didn't intend. It's just like how MS Office was exposed via VBScript/JScript. And just like how Firefox exposed XUL commands. So now Apple exposed native controls via Java.

Apple's solution is the same as Microsoft's. Only "signed" applets can access this control now. The fundamental problem though, is that unsigned applets shouldn't be able to access anything outside of the standard Java classes. They need to stop making blacklists and whitelists of what controls are safe, and instead, make it so that no controls are safe.

Re:Fundamental design problem

[ItsYourNickel]

They need to stop making blacklists and whitelists of what controls are safe, and instead, make it so that no controls are safe.

This seems to me a place where rather than using the blacklist/whitelist method, something akin to Privilege Separation like OpenBSD uses in several places (most notably in OpenSSH) might be in order. Yes, this requires quite a bit of additional coding to do, and it's not completely analogous, sure, but it's more the concept of the separation of permissions instead of generally exposing the controls/functions and trying to control access through methods that are proving themselves to be less-than-robust.

Nothing is going to provide perfect insurance against the unexpected, but it does seem to be a fairly solid method for mitigating risk.

Re:Fundamental design problem

[mandelbr0t]

By default, no controls are considered safe. Sure, the applet can access all the Java classes that are in the classpath of the JRE used as the Java plugin, but it can't read/write the filesystem or connect to a network host other than the one the applet was obtained from without being given explicit permission to do so (by modifying the local Java policy). If the JVM isn't run with admin privileges, there's very little an applet can do unless it's signed. Even accepting an unsigned applet is reasonably safe, as the unsigned applet can't read your hard drive and send data back to the host. At any rate, why are you accepting an unsigned applet from someone you don't know?

mandelbr0t

Re:Fundamental design problem

[argent]

Now now, the Java security model is a wee bit shonky, though a bit less so than it would have been if I hadn't brought up the way it messed up with proxies on the Firewalls list back when they were putting it together it would have been a good deal more shonky...

But comparing it with ActiveX?

If it weren't for ActiveX I'd be bucking at the traces rather than using Java, but it's so much the lesser risk that I can't get exercised about it. It's like worrying about washing your hands after petting a dog when there are zombies wandering around the neighborhood.

Well I for one...

[Anonymous Coward]

welcome our new webcam-snooping overlords!

windows

[bussdriver]

The built-in iSight I have has an attached LED that is on when the camera is on; it appears to be wired into the camera. I don't think they'd be able to turn it on without me noticing.

The firewire iSight has no indicator.

Flash 6-9 has had web cam and audio support for MAC and WINDOWS, a hack to flash to bypass the security warning (which if you recall was a problem back in 6, the feature was undocumented I believe.) So anybody with flash could potentially be listening or watching you. On new iSights, there is a light--- but for AUDIO there is NO indication on any computer.

Re:windows

[aedan]

I have a Firewire iSight and there is a wee green LED on the top. It also has a shutter.

Well maybe but

[One Track Mind]

the problem is bigger than that. I have a macbook wich has an integrated camera on it, and the exploit works with it. This cam has no lead light indicating use and no lens cap, so as long as it stays on my desk my privacy can be violated. My browser did crash when I hit the back button but that could be anything, most people wouden't be alarmed by it and even if they wer, well it would be to late. Interesting points: Well take a look at this slashdot story from yesterday about a face recognition and search engine software http://yro.slashdot.org/article.pl?sid=06/12/19/19 23259. This exploit could prove pretty usefull to people using the new product. I pitty all those girls in porn picts that will be exposed to all their friends and familly members when they use this new service. It's a java and quicktime exploit so it's not eclusive to the mac platform.

Re:Well maybe but

[aristotle-dude]

Sorry but your macbook does indeed have an LED underneath the plastic. The exploit nolonger works if you updated last night with the patch.

Re:Well maybe but

[One Track Mind]

Hmm guess mine is defective, but if that little hole next to the lens is it, I don't think I would be looking at it while surfing the net as it is set pretty high on the frame and it is realy small. Dosen't change the fact that by the time I noticed it,it ould be too late and this exploit isin't just for isight. Thx for the tip though I'll look into the non responsive LED.

next time that happens...

[artifex2004]

Next time you hear an Apple salesman say that, ask if he minds being quoted, and get his name and note the time and location. Then submit it here, or to a Mac site, and see what happens.

Steve's the only one allowed to serve kool-aid. :)

well....

[sh3l1]

I do enjoy lounging in the nude while on my computer... so I am glad this was fixed

Re:well....

[FishWithAHammer]

Trust me, we're more glad.

0-Day Apple iSight Hack - Fix it for $0.01

[maybenot]

Saw this on digg a few minutes ago. 0-Day Apple iSight Hack - Fix it for $0.01 http://digg.com/apple/0_Day_Apple_iSight_Hack_Fix_ it_for_0_01 Tired of hackers looking at you in your underwear with Apples built in iSight? This can fix it for good.

Re:0-Day Apple iSight Hack - Fix it for $0.01

[aristotle-dude]

Or you could have just run software update yesterday when the patch for this was released.

Re:Tape War-what about the mic?

[Nefarious Wheel]

Seriously, how can anybody be sure that everything you have ever done on your computer, since the advent of the internet, hasn't been recorded and cached somewhere, for later analysis...

Golly! I have an audience to play to?

Oh say, can you see...?

[Anonymous Coward]

Speak for yourself.. I'm a fat sweaty geek sitting in a basement scoffing pizza and Pepsi while on a raid with his guild (WoW for OSX). No beard though, and it's my basement.

You could have just said you were living the American Dream. This is Slashdot, we would have understood what you meant.

Shouldn't that read "iHole in iSecurity" or ....

[aix tom]

... something? Is the marketing department sleeping?

scoffing pizza

[Foerstner]

Pizza! What a pathetic excuse for a food!

Important ISight security advice:

[Anonymous Coward]

When the iSight camera is on, a little green light shines next to it.
When the light is on, don't do rude shameful things that your mother wouldn't like in front of the computer.

A more fundamental design problem

[argent]

This is just like the classic Microsoft/ActiveX type of problems.

Except that it *is* possible to fix it without breaking half the software in the system, and it *is* possible to fix it without being the vendor. The Jackson trial made it abundantly clear what happens if you disable the HTML control... disabling Quicktime for Java, or using Gecko without invoking XUL, these are actually possible.

Oh, and you're making the same mistake as Microsoft and Apple:

The fundamental problem though, is that unsigned applets shouldn't be able to access anything outside of the standard Java classes.

A more fundamental problem is that whether an applet is signed or not shouldn't matter. The application should be making the determination as to what rights the applet has, and if it's an application intended to display untrusted content it shouldn't be granting ANY rights to ANY applet.

Re:A more fundamental design problem

[MobyDisk]

It sounds to me like many people don't understand the Microsoft/ActiveX problem I alluded too. Let me explain why it is the exact same problem Apple had: I can write Javascript, VBScript, or Java and place it inside an HTML page.

In Internet Explorer, that code is then allowed to access any ActiveX controls that are marked as "safe" by the operating system. That means that these sandboxed languages are permitted to call outside of their sandbox. This caused problems for Microsoft because the Office ActiveX control can do more than just display spreadsheets and documents, such as reading/writing files.

In Safari, Java code is allowed to access specific controls that Apple added to their Java runtime. This means that these sandboxed Java applets are permitted tocall outside of their sandbox. This caused problems for Apple because the Quicktime objects can do things other than play videos, such as access your camera.

Except that it *is* possible to fix it without breaking half the software in the system, and it *is* possible to fix it without being the vendor. The Jackson trial made it abundantly clear what happens if you disable the HTML control... disabling Quicktime for Java, or using Gecko without invoking XUL, these are actually possible. In both cases, the fix was to add the offending control (QuickTime or MS Office) to the blacklist so that the sandboxed language cannot access it unless it is signed. It did not require breaking half the software in the system, and in both cases the fix required vendor involvement. And it didn't require disabling the HTML control.

A more fundamental problem is that whether an applet is signed or not shouldn't matter. The application should be making the determination as to what rights the applet has, In both cases, this is what actually happens. The application is the one that determins if the script is signed or unsigned, and gives rights to the script:

On Windows, you can write a program that executes VBScript or Javascript, and you can tell the script engine what rights the script has. In the case of Internet Explorer, that application allows signed scripts to have access to different things than unsigned scripts. It also looks at "trusted" sites and stuff like that. You can easily configure that in IE by telling it not to allow scripts to access that stuff, even if they are signed. At which point it does what you said: It won't grant ANY rights to ANY applet.

On OS X (or Windows, or anything) you can write a program that executes the Java runtime, and you can tell the runtime what rights the java applet/classes have. In the case of Safari, that application allows signed scripts to have access to different things than unsigned scripts. Internet Explorer does the same thing with Java. Firefox does the same thing too. The Java Runtime actually takes care of prompting the user to allow the Java applet to have higher priveledges.

Apple is late to the game....

[McFly777]

As I recall, with Back Orifice, this could be done on MS windows years ago. ;-)

Proof that closed source is evil

[GWBasic]

Apple's delay in fixing the security bug is proof that closed source is evil. If OS X was open source, we'd be able to download a fix within hours of its discovery.

(This is intended to be a joke)

Good Old Artie!

[LKM]

the mac zealots out there (those who believe it was the perfectly secure OS, but even patched it shows that what some zealots were saying before was an absolute steaming pile of something - there's a Mac user in the office 50 ft from me, i'm going there now to laugh)

Oh, you mean Artie McStrawman? Yeah! Let's laugh at that sucker! HAHA!