Slashdot Mirror
Apple Closes iSight Security Hole
Gruber Duckie writes "Apple's security update 2006-008, posted yesterday, is a little more interesting than it sounds. According to information (and a demo!) posted at Macslash the "information leak" mentioned in Apple's advisory actually makes it possible for a web site to send whatever your (isight) web cam sees up to the server. I'm glad they fixed this quickly."
Of course, an application running on your local machine can do anything it wants. So it's not surprising that a malicious Java applet/application could, well, do malicious things.
/System/Library/Extensions/Apple_iSight.kext /System/Library/QuickTime/QuickTimeUSBVDCDigitizer .component
For those who don't know, a Quartz Composer composition saved as a QuickTime movie can display the iSight image locally. Since QuickTime movies can be embedded in web pages, you can create a movie that displays the *local* iSight image back to the person, locally. Nifty, right?
But is interesting is that via Java hooks in QuickTime for Java, a Java applet could be used in conjunction with this Quartz Composer movie to do anything that a Java applet could instruct QuickTime to do - including take a shot of whatever is being displayed in the QuickTime movie - and then do anything else a Java applet could be designed to do - in this case, potentially send that image somewhere.
So, this could be done on any platform with a camera, since all it is is malware running to perform a specific task.
But what's more interesting is:
- All Mac OS X systems will always have QuickTime, and thus always have the capability to run such a composition
- All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)
The ubiquitousness of iSight camera is what makes this little trick interesting. It also raises issues such as: why didn't Apple offer an option to delete the camera (especially for government/military customers, as other vendors, like Palm, do), and why didn't Apple offer a mechanical shutter for the iSight on all models?
In any case, it's fixed with Security Update 2006-008, but a legitimate Java application, i.e., one you trust, could still do just that. Which stands to reason, of course, since code running on your machine - even if instantiated by a web page - can really do anything that you have permission to do, including delete files. That's the nature of applications.
One other note: you can indeed disable the iSight by (re)moving:
In sum, the reason why this is interesting is because of the ubiquitousness of the Apple iSight on Apple laptops and the fact that it's ready for use. But, someone still has to visit a malicious site and run a malicious Java applet - user interaction: the hallmark of Mac OS X vulnerabilities!
Apple reserves blocks of CVE numbers in advance, without necessarily having a problem report that matches up. They were told about this on 01 December.
.sig: file not found
Yes I realise I just had an RTFA parse error..
If Cmdr Taco had actually read the friggin' MacSlash article he links to, and scrolled down to the comments, he'd see that the 'exploit' is not fixed by this patch and what's more, doesn't send info to the server. Fer feck's sake.
I'm not wrong. You haven't thought about it hard enough.
Doesn't flash do this already? As a "feature"?
Psst, hey anonymous troll. MS used to release patches at random intervals as soon as they were ready as well. They did that for many years. Their huge corporate clients asked them to consolidate the patches to a regular interval so that their tech staff could test and roll them out in synch, saving tons of time testing all their regular and custom built in-house apps with each patch that MS released to make sure nothing broke, then rolling them out to thousands of machines, then testing all their stuff again 3 days later when another patch rolled out, then 5 days later when another patch rolled out, etc, etc.
Patch Tuesday was because of customer requests. This isn't 'competition' against patch tuesday.
Dude, this was on a Mac... no games. duh
/me waits for "one button mouse" comment/
Ignorance, or humor? It's so, so hard to tell. And besides, I could always boot the thing into Windows if I wanted. But by all means, don't let actual facts get in the way of your ignorance and/or joke.
Some security holes are reported to the public by security researchers, etc. But lots of them are security holes MS finds themselves, or are reported to them in private by security researchers (giving them a fair amount of time to fix them before they would be made public).
When MS releases a patch to fix one of those MS-only-new-about holes, hackers do quick diffs, etc between them and the original files to find out what exactly the hole was that MS was patching. They then write an exploit for it and release it on the net (to take over machines for bot-armies, do corporate espionage, etc). This happens within a day or a few days of the patch release. If a company doesn't bother testing and rolling out those patches until a bunch of them accumulate, they are going to leave a nice big window of attack for the bad guys.
Once they get the camera pixel patent into production, and the entire screen surface is the camera lens, that won't work! (unless you just don't wanna watch TV!)
"Money is truthful. If a man speaks of his honor, make him pay cash." Notebooks of Lazarus Long, Robert A. Heinlein
Actually, Photoshop (for the Mac) is compiled for a PPC processor. On an Intel Mac it runs through Rosetta (the PPC emulator built into OS X). For now, Photoshop users would be better served by keeping their PPC Macs.
The Beta of CS3 was released on Friday as a Universal binary.
Jesus was a compassionate social conservative who called individuals to sin no more.
I've run into a few, usually their "proof" revolves around there being no widespread viruses and malware out in the wild for the Mac like there is for Windows.
When the camera was turned off, the shutter closed.
Actually you opened or closed the shutter by rotating the front lens (a physical interlock, so it was impossible to open the shutter in software).