Slashdot Mirror
Apple Closes iSight Security Hole
Gruber Duckie writes "Apple's security update 2006-008, posted yesterday, is a little more interesting than it sounds. According to information (and a demo!) posted at Macslash the "information leak" mentioned in Apple's advisory actually makes it possible for a web site to send whatever your (isight) web cam sees up to the server. I'm glad they fixed this quickly."
Or cleverly disguised attempt to monitor people by the Department of Homeland Security? You be the judge!
GetOuttaMySpace - The Anti-Social Network
A fat sweaty bearded geek sitting in his parents basement scoffing pizza and jolt while on a raid with his guild is a security issue how exactly?
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
It's not a pretty sight, folks.
-Eric
SJW: Someone who has run out of real oppression, and has to fake it.
..... Able to see cute college co-eds prancing around in their dorms half (of if we're lucky, totally) naked.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
The internet is full of ladies and they all surf practically naked, I know this because this is what they tell me in chatrooms and other socialising sites.
I personally am disappointed. Imagine the YouTube videos that would have been possible with just a month's worth of such video. I mean, yes, 90% of it would be unshowered nerds with bad posture, but that 10% would have been gold!
It breaks my pluginses, my precious!
And Mac users are lithe, sexy art types, too. I know, because the ads tell me so.
Laws do not persuade just because they threaten. --Seneca
There are a few websites out there that will tell you your IP address, browser type, OS type and even guess at your general geographic location based on things your browser tells it. Some of these sites do it to "shock" people into realizing they are NOT anonymous on the net.
What a great enhancement it would be for such websites to display a picture of the user at his computer! "We know you use a Mac, Live in California and Look like THIS!" Just one visit such a site would go a LONG way to instilling a useful level of caution.
When information is power, privacy is freedom.
[Stops dancing wildly in front of computer]
Nobody saw that, right?
Well, there's spam egg sausage and spam, that's not got much spam in it.
Am I the only one who wishes that the laptops with the built-in iSight had a way to manually close the shutter, like the standalone iSight? I always keep mine closed when I'm not using it, but the lack of such a shutter on the laptops makes me profoundly uncomfortable at the thought of owning one. Maybe this sort of thing will serve as a wakeup call?
...move along. ;)
-- Rastignac was here.
Of course, an application running on your local machine can do anything it wants. So it's not surprising that a malicious Java applet/application could, well, do malicious things.
/System/Library/Extensions/Apple_iSight.kext /System/Library/QuickTime/QuickTimeUSBVDCDigitizer .component
For those who don't know, a Quartz Composer composition saved as a QuickTime movie can display the iSight image locally. Since QuickTime movies can be embedded in web pages, you can create a movie that displays the *local* iSight image back to the person, locally. Nifty, right?
But is interesting is that via Java hooks in QuickTime for Java, a Java applet could be used in conjunction with this Quartz Composer movie to do anything that a Java applet could instruct QuickTime to do - including take a shot of whatever is being displayed in the QuickTime movie - and then do anything else a Java applet could be designed to do - in this case, potentially send that image somewhere.
So, this could be done on any platform with a camera, since all it is is malware running to perform a specific task.
But what's more interesting is:
- All Mac OS X systems will always have QuickTime, and thus always have the capability to run such a composition
- All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)
The ubiquitousness of iSight camera is what makes this little trick interesting. It also raises issues such as: why didn't Apple offer an option to delete the camera (especially for government/military customers, as other vendors, like Palm, do), and why didn't Apple offer a mechanical shutter for the iSight on all models?
In any case, it's fixed with Security Update 2006-008, but a legitimate Java application, i.e., one you trust, could still do just that. Which stands to reason, of course, since code running on your machine - even if instantiated by a web page - can really do anything that you have permission to do, including delete files. That's the nature of applications.
One other note: you can indeed disable the iSight by (re)moving:
In sum, the reason why this is interesting is because of the ubiquitousness of the Apple iSight on Apple laptops and the fact that it's ready for use. But, someone still has to visit a malicious site and run a malicious Java applet - user interaction: the hallmark of Mac OS X vulnerabilities!
Got to love the idea of using an OS whose scope of security vulnerability need to be 'leaked' to be known.
Fsck that..
Apple reserves blocks of CVE numbers in advance, without necessarily having a problem report that matches up. They were told about this on 01 December.
.sig: file not found
If Cmdr Taco had actually read the friggin' MacSlash article he links to, and scrolled down to the comments, he'd see that the 'exploit' is not fixed by this patch and what's more, doesn't send info to the server. Fer feck's sake.
I'm not wrong. You haven't thought about it hard enough.
Doesn't flash do this already? As a "feature"?
I guess this kind of thing is why Sun put a mechanical lens cover on their webcams.
In Soviet Russia, websites look at you!
Just makes me think:
It is pitch black. You are likely to be eaten by a grue.
In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.
Your Orwellian society is defeated by a piece of tape.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
One day I wandered into the closest Apple store and was playing with the latest version of OS X to see if I wanted to upgrade. They all had internet connections and isight cameras and I thought it would be fun to play with them. So I made up a new ichat account and added a few people I knew at the time with a camera on their system to the buddy list to see if they were online. The person available just happened to be a cute college co-ed dating one of my buddies. She's one of those skinny little redheads guys always seem to fall for. Anyway, after I got to try out the video chat feature I took off and thought no more about it.
The next time I talked to her she told me I had brought her a lot of entertainment and some embarrassment. It seems people in the store also wanted to try out the video chat, and since there was an account set up with her on the list, they kept sending her chat requests. This was the entertaining part. The embarrassing part was the first time someone did that, she assumed it was me again, and was not quite fully dressed at the time. She said the guy seemed pretty shocked, but nice enough after she jumped out of the camera's line of sight and pulled on a robe.
Back in the late 1980s and early 1990s, Compuserve's "CB simulator," Delphi, and other services provided text-based multiway services of the kind now known as "chat."
/view mode on
/view mode would actually be implemented within my lifetime.
It was fairly common for someone to make a joking about how they were or were not dressed. A common reply was for someone else to type something like
and tell the group that he or she could now verify whether or not first speaker had been telling the truth. Occasionally the first speaker would be naive and gullible enough to believe it.
Little did I know that
"How to Do Nothing," kids activities, back in print!
So all the high rated posts I see talk about how terrible Apple's security was, 1984 comes true, blah blah blah.
Did any of you bother to try out the exploit? I just did... know what it does? It turns on that bright green LED right next to the camera, the one that tells you when it's on. It's pretty bright and when it turns on all of the sudden, you NOTICE. It then proceeded to crash my browser. Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.
True with proprietary software one just never knows for sure, but honestly let's see someone figure out how to take a picture or make a movie without the light coming on, THEN we can start calling Apple Big Brother. Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.
Cwm, fjord-bank glyphs vext quiz
Apple's solution is the same as Microsoft's. Only "signed" applets can access this control now. The fundamental problem though, is that unsigned applets shouldn't be able to access anything outside of the standard Java classes. They need to stop making blacklists and whitelists of what controls are safe, and instead, make it so that no controls are safe.
Golly! I have an audience to play to?
Do not mock my vision of impractical footwear
... something? Is the marketing department sleeping?