How a MacBook Camera Can Spy Without Lighting Up

New submitter ttyler writes "It turns out a MacBook's built-in camera can be activated without turning on the green LED. An earlier report suggested the FBI could activate a device's camera without having the light turn on, and there was a case in the news where a woman had nude pictures taken of her without her knowledge. The new research out of Johns Hopkins University confirms both situations are possible. All it takes are a few tweaks to the camera's firmware."

Comments

It's pretty simple

[bhcompy]

It's pretty simple: if you have a device with a camera, just cover the camera with a little black tape and tada, no more spying

Re:It's pretty simple

[rtb61]

Far simpler for the manufacturer to wake up to what is going on and provide a sliding lens cover and that means you, you big screen smart TV designers.

Re:It's pretty simple

[Anonymous Coward]

You're assuming it's not by design.

Re:It's pretty simple

[GameMaster]

If they cared even remotely enough to do that, then they would have already hardwired the indicator light to the same power source as the camera so that one couldn't be run without the other regardless of the firmware.

Re:It's pretty simple

[wrp103]

It's pretty simple: if you have a device with a camera, just cover the camera with a little black tape and tada, no more spying

I use a Post-It, with the non-sticky part over the camera hole.

That way, when I actually do want to use the camera, I simply bend the paper back and expose the camera. When I am done, I fold it back. Replacements are pretty simple. One pad should last you a long time. ;^)

Re:It's pretty simple

[weilawei]

Spoke to an Apple tech just now. It used to be, according to them. They say it isn't anymore.

Re:It's pretty simple

[Anonymous Coward]

Apple shills, ASSEMBLE! Quick, a story about Apple's hardware spying, divert attention to Microsoft!

Re:It's pretty simple

[geekoid]

People don't want that.
Or more specifically, most people don't want to deal with the extra step.

Re:It's pretty simple

[Anonymous Coward]

Oh, the manufacturers know perfectly well. That's why their enterprise-grade teleconferencing cameras (targeted toward senior executives) have sliding lens covers. But when it comes to products for regular peons, their privacy isn't worth the extra 2 cents in parts.

Re:It's pretty simple

[exomondo]

X-Bone? I get its some derogatory xbox one thing but what is it supposed to mean? And surely xb1, like ps4, is quicker to type.

Re:It's pretty simple

[Austerity Empowers]

I made this modification to my macbook pro on the first day. I don't want a camera, and it stands to reason if someone can install keyloggers on my machine, they can compromise any hardware... Unfortunately there's not much to be done for the mic without voiding warranty.

I don't want either of these features, or at least i'm willing to buy special hardware for it if I need it.

Re:It's pretty simple

[hawguy]

It's pretty simple: if you have a device with a camera, just cover the camera with a little black tape and tada, no more spying

What about the microphone?

Re:It's pretty simple

[UnknownSoldier]

Agreed.

That's what one of my colleagues did. I thought he was being maybe just a little *too* much paranoid but admired that he actually did something about it a few months back (instead of just bitching about it.) Looks like he was simply being prudent !

Re:It's pretty simple

[Darinbob]

The camera seems the most useless part of a macbook anyway. Just paint over it in black, scuff it with sandpaper, etc. I don't want to see a video of you talking, and you definitely don't want to see a video of me.

Re:It's pretty simple

[weilawei]

Okay, Mr. I've-Got-All-The-Answers. How is a small child going to do this? How are you going to guarantee that their parents will know? How are you going tu guarantee it doesn't happen when someone stops actively using the computer, but doesn't shut the lid? This should NOT be possible, in the first place. Requiring a technical workaround or constant checking is NOT a solution.

Re:It's pretty simple

[hawguy]

I just check if the firmware has changed.

Sticky notes? tape? Slashdot - News for mediocre office workers.

I wrote my Malware with a hook into the operating system that detects when you're reading the camera firmware to see if it's changed, then it feeds you the unaltered firmware. Plus, I only load my firmware when I want to spy on you, the rest of the time I load up the old firmware.

Re:It's pretty simple

[csumpi]

One of them geniuses? And he pulled out the schematics, or showed you the traces on the pcb? Care to share the proof?

Re:It's pretty simple

[owl57]

Or more specifically, most people don't want to deal with the extra step.

Why make the step extra? Opening the cover should just launch some app by default. A launcher can even have some image recognition capability to decide if the user's more likely to tweet a picture of his cat or enter some corporate videoconference.

Re:It's pretty simple

[weilawei]

You're entirely right--you shouldn't trust hearsay. But additionally, if you look back through my post history, you'll find that I'm not in the habit of making unsubstantiated claims. The truth of the matter is that the guy (a repair tech, with long-time electronics experience, whom I trust to work on my own machines) had to go home. It's that time of the evening. But you're right, don't trust hearsay. Unfortunately, you'll have to wait on the schematics/pictures, whereas, you could probably pop open the machine yourself and take a look see if you're competent enough to understand them in the first place. I suggest you do this if you're skeptical. Heck, you might do us a favor and post them.

Re:It's pretty simple

[Anonymous Coward]

The original Apple iSight (external web cam) was built this way. The camera part was built in an aluminum tube and came with a set of pivot arms for mounting it to a display. The front section of the tube could rotate (like a focus ring) and actually closed a mechanical iris in front of the lens. I think the manual actually described that as a privacy feature.

Re:It's pretty simple

[Jherek Carnelian]

Far simpler for the manufacturer to wake up to what is going on and provide a sliding lens cover and that means you, you big screen smart TV designers.

There are a ton of 3rd party sliding covers out there for under $10 a piece, google will find them for you no problem.

But what I haven't seen yet is one that doesn't just black out the camera, but instead puts a photo in front of the camera. Imagine a camera slide that forces anyone spying on you to see goatse.cx instead. Just deserts.

Re:It's pretty simple

[smash]

So you mean 2 extra steps then? One to open the cover, and another step to close the default app when I want to use something else instead?

Re:It's pretty simple

[smash]

I'm sure that will work well with the VOIP I use the machine for.

Re:It's pretty simple

[weilawei]

Get a transparency sheet (to allow light through, but not in any real detail), scale it down, and paste it over. Cheaper than $10 for 10 minutes of your time.

Re:It's pretty simple

[weilawei]

So go ahead and wire in your own switch.

Re:It's pretty simple

[Hamsterdan]

Like they had on the original iSight? or on my 13 year old Logitech?

What's mind boggling though is it would probably *less* expensive to just hardwire the LED with the camera itself. If it's being used, light the LED.

Re:It's pretty simple

[Hamsterdan]

If it doesn't involve Duck tape and tie-wraps, it's not geeky enough (trying to integrate popsicle sticks in it would be really cool :p

Re:It's pretty simple

[Jherek Carnelian]

I bet it is easier for automated testing. This way they don't need to connect any external equipment to measure if the LED works, just ask the microcontroller in the camera to run an internal diagnostic that checks the the voltage level on the lines to the LED.

Re:It's pretty simple

[weilawei]

How would the *insert three-letter-agency here* spy on you then?!

Re:It's pretty simple

[TheGeneration]

You'd think they'd actually save money if they just hard wired the LED into the camera's power source. If the camera has power, the LED is on. I'm sure that would cost them less, not more.

Re:It's pretty simple

[ChunderDownunder]

On January 24th, Apple Computer will introduce Macintosh. And you'll see why 1984 won't be like "1984".

30 years on, how times have changed!

Re:It's pretty simple

[mrbester]

My i5 ASUS laptop has a sliding lens cover, so it's not as if this is a radical new idea...

Re:It's pretty simple

[bill_mcgonigle]

Yep, and they used to call this out. I've even got an iSight with a manual lens cover iris ring. Something[body] convinced Apple to stop protecting its users' privacy. I'd put a buck down on Bull Run and spin the wheel.

Re:It's pretty simple

[M. Baranczak]

Get an external mic and plug it in when you need it. And you'll probably get better sound than the built-in.

Re:It's pretty simple

[fuzzyfuzzyfungus]

Cameras with physical lens covers are thicker than cameras without. That's all it took to convince Apple.

Now, why they have an 8051 hardwired to the USB bus that accepts arbitrary firmware uploads without even having to elevate beyond user permissions, I can only blame stupidity.

Re:It's pretty simple

[antdude]

What about mic(rophone) without voiding?

Re:It's pretty simple

[conspirator57]

1. Most cameras in laptops are USB peripherals, sourced from an OEM.
2. Even if that were done, look up LED persistence of vision, Then ask how long the camera needs to be on to take a picture versus how long it takes before humans notice the LED is lit. Hwo knows, it might be possible to grab a pic before the LED is bouncing photons at all. As a result, it's not as simple as hooking it to Vdd, you'd have to build a capacitor network in that will not allow the camera to turn on until the LED is lit and then won't allow the LED to go out until it's noticeable to the user.
3. Do you think the OEM even thought about privacy? Might wanna rethink that.
4. It's far simpler to put a shutter on the camera (but what about IR?) and/or put a HW switch on the USB Vdd to the camera.

Re:It's pretty simple

[conspirator57]

Is your lens cover opaque over the whole band your camera can sense?

Re:It's pretty simple

[Solandri]

The real point here that this tangent is missing is KISS. Keep It Simple, Stupid. You shouldn't need to look through schematics or take apart your laptop or decompile firmware to figure out if the light cannot be decoupled from the camera, when a simple non-motorized sliding cover would make it indisputably clear to the user that their image is not being surreptitiously captured. That's what people are saying. There are times when complexity needs to be hidden from the user. This is not one of those times because a simple alternative solution that even a 5 year old can understand exists. KISS.

Re:It's pretty simple

[AmiMoJo]

The problem is that manufacturers want to use the camera all the time for facial recognition, gesture detection, auto-on when someone enters the room, even stuff like auto brightness/contrast control. The LED would be flickering like mad all the time.

Also, we need LEDs for microphones.

Re:It's pretty simple

[weilawei]

Definitely. I would LOVE if my microphone had an LED for it being on. Even more so, I'd love it if my microphone actually turned off.

Re: It's pretty simple

[s.petry]

When the people keep making the same bad decisions, you should consider the possibility that it is not just stupidity. Did we not learn a short time ago that agents were planted in companies like this to make back doors? Sure, no evidence or court cases yet... But see. Y first sentence.

Re:It's pretty simple

[exomondo]

Yeah I know all that, but how is "X-Bone" derogatory?

Re:It's pretty simple

[JEGSYDAU]

Samsung does. I've got one of the 2012 model smart TV's. The camera on it rotates on a vertical axis, I assume so that you can point it at the couch more accurately and not chop peoples heads off. If you keep rotating it however, the camera will point back into the TV. There is still the issue of the microphone even with this, but all the NSA would hear is me talking to friends on the phone. I think they have this covered by other means.

Re:It's pretty simple

[brantondaveperson]

A sliding cover to a camera does not adhere to KISS from a user's perspective. It's actually an annoying additional step to using the camera - not to mention another moving part on a laptop that may break and/or jam. Plus it's actually less useful - if the sliding cover is open one probably still wants an LED to indicate whether or not the camera is actually active.

The idea of tying the LED to the power supply to the camera also won't work, at least for modern macbooks, because that camera sensor is in fact always active. It's also used as the ambient light sensor to automatically dim the display in low-light conditions. Of course, they could have used an additional sensor for that, but that would have increased the cost and complexity of the camera hardware.

The real issue here is much more general, which is that it should manifestly not be possible without root privileges to modify the firmware in any of the microcontrollers in a laptop (of which I'm sure there are several).

Re:It's pretty simple

[penguinstorm]

Well, it's pretty clear that your use case is the only one for the entire world so let's go to town!

Re:It's pretty simple

[penguinstorm]

What's the logical path you take from "installing keyloggers on [your] machine" to "comporimis[ing your] hardware?"

A keylogger does nothing to compromise your hardware. It's pure software and has nothing to do with hardware. It's not, in point of fact, even interfacing with hardware: that's happening at the OS level, and the key logging software is picking up the keystrokes.

Re:It's pretty simple

[Zynder]

This will sound absolutely horrible but the evil genius in me just has to say it: That sounds delightfully juicy! Bwahahahahahahahahahahahahhhahahah

Re:It's pretty simple

[AmazingRuss]

I much prefer waggling my penis at it.

Re:It's pretty simple

[AK Marc]

I just edited the firmware until I got an MD5 collision. Set the date and version the same, and the user won't ever know the difference.

Re:It's pretty simple

[SuperKendall]

A sliding cover to a camera does not adhere to KISS from a user's perspective. It's actually an annoying additional step to using the camera

I was going to say the same thing - that it makes the camera annoying to use and would probably confuse a lot of people if you ship it closed (and if you don't ship it closed, why even bother?)

There is one way you could make it covered and still not confuse users - have the sliding door activated by the computer when the camera is active. Then you could see when the camera was active, and the door could hard-wire an LED activation...

It would add cost and complexity though, and it does sound like a system that would be prone to failure rendering the camera useless. So there's still that issue.

Re:It's pretty simple

[RuffMasterD]

Might print myself a BSOD lens cover right now. Next time someone spies on me they need an instant reboot.

Re:It's pretty simple

[Anonymous Coward]

Of course it is by design, Apple will drop any feature if it allows them to shrink the case another mm. That's how they make their margins.

Not to mention there's a single piece of glass covering both the screen and the camera, like Apple would ever ugly that up with some shitty slider.

Re: It's pretty simple

[dbIII]

Fine - I'll file that with building 7 being a planned demolition and your stuff about the crash into into the pentagon being faked.

Re:It's pretty simple

[rnturn]

``just cover the camera with a little black tape and tada, no more spying''

There were rumors that this kind of trick could be done as far back as '08/'09. Black electrical tape was stuck over the webcam lens on my laptop for years.

Re:It's pretty simple

[dbIII]

To a lot of people flashing the BIOS with something nasty fits into "compromising the hardware", so enough physical access to plug in a keylogger could be enough physical access to do something like that.
It's probably better to let all these definitions slide now that so many people think a web browser is an integral part of the operating system and not just something in userspace.

Re:It's pretty simple

[denmarkw00t]

Another problem with the sliding door, which should be even more obvious, is that the majority of consumers will simply not trust Manufacturer because Manufacturer can't "promise" a safe, non-hackable camera. Of course, no one can promise that, but the addition of "privacy cover" implies that there is likely someone out there who can and will use your camera without your permission. While this may be TRUE, the average consumer will certainly see it as a failing of ASUS/Apple/Samsung/etc and not a failing of the government to protect from this (instead of partake in it).

Re:It's pretty simple

[Khyber]

"Spoke to an Apple tech just now. It used to be, according to them. They say it isn't anymore."

Uh, what? Hardwiring the LED in-line with the sensor is the most HORRIBLE idea ever. The introduced noise would make that sensor totally unusable.

Put an LED in-line with a clean audio signal going out to a speaker. That's essentially the sort of power feed you'd be giving the sensor. Pure stupidity.

Re:It's pretty simple

[Khyber]

"You'd think they'd actually save money if they just hard wired the LED into the camera's power source. If the camera has power, the LED is on. I'm sure that would cost them less, not more."

Let me show you why that's a bad idea.

Now imagine that sort of 'filtered' power going to your sensor.

Re:It's pretty simple

[tlhIngan]

If they cared even remotely enough to do that, then they would have already hardwired the indicator light to the same power source as the camera so that one couldn't be run without the other regardless of the firmware.

Except it was, sort of. The camera sensor has a line called STANDBY. When it's high, the camera is off and is not sending data to the USB chip. When it's low, the camera is sending image data. The LED is wired so when it goes low, the LED turns on.

The flaw is that the USB hardware firmware is on disk, so on boot, it's loaded into the controller's RAM. That firmware then configures the sensor. It turns out that there's a register setting that tells the sensor to ignore the STANDBY line. (Could be a debug bit - these camera sensors have tons of registers that are NOT documented - you're already looking at a good 500+ registers, and probably another 500 that aren't documented or whose presence isn't even known).

Ars Technica has a nice technical writeup - http://arstechnica.com/security/2013/12/perv-utopia-light-on-macbook-webcams-can-be-bypassed/

Re:It's pretty simple

[rusty0101]

Fix for the mic would be to either short to ground (tip) the mic lead of a headset plug, or if the macbook checks resistance link a 1k ohm reistor between tip and the mic lead, and make sure that the computer switches to using the external mic when you plug something in that provides a suitable resistance.

This could all be built within a 90 degree 3.5mm plug , or even a 2.5mm plug if necessary. It won't be quite flush with the side of the macbook, and if they use a common plug for speakers and mic, you may need to add a socket for headphones, or build this into a replacement plug for the headphones you prefer. You would likely need a 4 conductor plug for the mic ring.

Optionally pick up a usb sound adapter from a manufacturer in china, and make sure that the computer switches to that as the default audio i/o device, and never plug a mic into the adapter, or plug in a mic that's turned off.

If you want to be annoying to the people trying to listen, find a recording of someone reciting the constitution, and feed that into the mic in jack from an mp3 player on a continuous loop.

Re:It's pretty simple

[davester666]

Then you get charged with distributing hard-core porn to minors.

Re:It's pretty simple

[rusty0101]

Does the computer (or can the computer) support a bluetooth headset?

Re:It's pretty simple

[flyingfsck]

In parallel, not series.

Re:It's pretty simple

[rusty0101]

This is dependent on the computer, as not all computers have an external mic in socket, though there may be workarounds even for them.

Someone above pointed out that for some macbooks there is an ifixit explanation of how to replace the mic, where the suggestion was made to simply disconnect it, and don't put anything new in it's place. If you are worried about this voiding the warrantee here are a few other suggestions.

Check to see if plugging in an external mike capable headset into the audio jack/socket switches the audio in to the headset. If so, you should be able to use the mute switch on the headset to disable the mic by default. If the mic is only disabled if there is a connection from the mic ring on a 4 conductor jack to ground, and only if there is the appropriate resistance, you can make that connection through an appropriate valued resistor. This may need to be done on a cable that supports external speakers if you have a single audio plug that supports both audio out and audio in, presuming you want to hear the audio of your computer.

If you want to be able to make use of the mic on the laptop, you should be able to simply unplug that plug, and the computer (most modern computers in the past 10 years anyway) should switch back to the internal mic. Alternatively switch to a headset that has a mic from the cable that disables the mic. Or if your computer supports a bluetooth phone headset, you should be able to use that for audio.

Another alternative that may automatically disable the internal audio i/o is to plug a usb sound adapter into the computer, or a hub. (Or plug in a usb hub/doc that has audio capabilities.)

You could also plug in a white noise generator, or an mp3 player with a continuous loop of someone providing a boring recitation of the constitution. If the mic port is "available" you could tape an in-ear speaker to the port with one of those feeding it audio. The down side here is that it is possible to 'learn' what you are feeding it, and cancle it out, boost the gain on the rest to recover what people are saying near the computer. You may need to provide a randomized, or mixed feed that goes through a long period between repititions, but changes rapidly. You may need a good random number generator to drive that, but that's a different topic.

If none of those are workable options for you, I'm not sure what to suggest.

Re:It's pretty simple

[viperidaenz]

2. LED's operate at nano to micro second speeds, typically up to the tens of MHz. Persistence of vision helps in making a short burst seem much longer.

Re:It's pretty simple

[unique_parrot]

...you are suspect aswell, let's have a quick look at your expenses...

Re:It's pretty simple

[weilawei]

Pew! Pew! Pew!

That video was unintentionally hillarious.

Re:It's pretty simple

[vidarlo]

If they cared even remotely enough to do that, then they would have already hardwired the indicator light to the same power source as the camera so that one couldn't be run without the other regardless of the firmware.

This is essentially what apple did, according to the report. They connected the LED to the standby signal, which normally has to be disabled to read data from the camera chip. So far, so good.

But the camera chip also has a configuration register - and one of the register options are to disable listening to the standby signal, and go ahead without caring about this signal. So it looks like the designers overlooked that option, or didn't think about it as a serious scenario.

So my impression is that apple has gone further than I've imagined to make a good design, but sadly not a bugfree design. Remember that all designs, hardware or software, may have bugs.

Re: It's pretty simple

[gnasher719]

When the people keep making the same bad decisions, you should consider the possibility that it is not just stupidity. Did we not learn a short time ago that agents were planted in companies like this to make back doors? Sure, no evidence or court cases yet... But see. Y first sentence.

No evidence yet. Not "no proof yet", but no evidence yet. In other words, baseless rumours.

Re:It's pretty simple

[AmiMoJo]

When I get a new laptop I open it up and unplug the mic and camera. I research first to make sure I can do it without going through any warranty seals. It is often quite easy to do if you pick a good model.

Re:It's pretty simple

[rtb61]

A sliding cover does adhere to the KISS principle because it is a matter of choice. Default out of the box would be open, user has absolutely nothing to do to make it work. Now a user that is concerned about their privacy simply has to slid it shut and only open it when they want to, choice, get it. So the sliding cover only affects concerned users and provides them with the assurance of a confirmed infallible block to the camera, which for them obviously would be default shut. For the oblivious idiot who never changes it from the default open, no problem, no complexity and no worries, well at least until the naked ass appears on the internet after watching TV in the buff.

If the end user is concerned they want the manifestly observable nature of a manual sliding cover or other means of visibly securing the operation of the camera.

Re:It's pretty simple

[rioki]

Exactly. On my 3 year old Logitech camera (USB to Desktop) the indicator light is an option, which is currently in the permanently off state. Then again the camera comes fitted with sliding shade, so even if the software activates the camera, the camera can physically not see anything. (The camera mic works fine, though.)

Re: It's pretty simple

[stealth_finger]

the crash into into the pentagon being faked.

What crash?

Re:It's pretty simple

[rioki]

Your post makes no sense. (Is it sarcastic?) A sliding cover is exactly the type of implementation that most users would trust. It is the type of intuitive things, like toggle switches for off buttons. Users used to be afraid that hackers could penetrate their systems though the modem. They knew that the system without power is safe. The more novice users did not trust that the ACPI off rally work and may have heard from "wake on lan" features. The simple solution, put the entire PC on a connector strip with a simple toggle power switch. That switch definitely OFF.

A physical and manual sliding door is exactly this, closed door means camera "off". Since even if the camera is on, all it will see is black. This type of safeguard the users understands intuitively. It is even stupidly simple. It may ruin the cool apple aesthetic though.

Re:It's pretty simple

[stealth_finger]

Yeah I know all that, but how is "X-Bone" derogatory?

Because its easy to make from xbox one - xbone and sounds a little funny. People who hypenate it are twats.

Re: It's pretty simple

[bickerdyke]

Now that you mention it... which retared marketing droid hat the idea of calling the 3rd generation of someting "One" to begin with?

Re:It's pretty simple

[PipsqueakOnAP133]

If I recall, I think the Cypress FX2LP that was mentioned (or something similar) was designed in such a way that firmware upload over USB wasn't something easily disabled.

So, perhaps a bad choice of MCU.

Re:It's pretty simple

[Misagon]

I remember when a co-worker ported a program from Windows to the Mac a few years ago. He had the problem that it made the Mac hibernate every time the program was run.
It took a while to find out why... the answer was that his code had called "Sleep()" with a capital S instead of "sleep()". Apparently, elevated privileges were not required to make the computer go to sleep.

Re:It's pretty simple

[jones_supa]

It is even stupidly simple. It may ruin the cool apple aesthetic though.

Just make it brushed aluminum with rounded ends. Run an advertisement with white background and piano music playing in the background, with someone explaining how privacy has always been important to Apple and how this time they wanted to make it perfect. "It looks very cool, and I was amazed how simple it is. When you slide it, it snaps perfectly in place. I don't have to worry."

Re:It's pretty simple

[mrbester]

No, it can still discern light and dark but with no detail.

Re:It's pretty simple

[marcello_dl]

In fact if the led should tell you when the camera is powered on, manufacturers would opt for electrical solutions instead of getting a dedicated circuit, and relative hardware control. All of which is more expensive so makes no sense in a mass produced item.

When I bought the acer aspire 5200 almost 10 years ago, I saw that early linux cam drivers did not turn the led on. WOW I thought, recalling the very good capability of the mic to get distant sounds, perfect spying device.

Re: It's pretty simple

[dbIII]

He's a prolific conspiracy nut and he's putting his latest of a long chain of conspiracies out there - hence "agents were planted in companies like this".
There's enough bad stuff going on without making stuff up.

Re:It's pretty simple

[jellomizer]

Or just make the Light part of the default wiring, When the part of the camera that records has power the light goes on from that power too. If the LED is off it means there is no power going to the units that record the data.
No Firmware, or software controls, we wire it in directly.

That is assuming these companies really care about our security, and not just use it as an excuse to make fun of the president.

Re:It's pretty simple

[ILongForDarkness]

They'd do that for one version then the next version would have a "more easy to use" camera that comes without the screen.

The funny thing is that the first solution wasn' t just to have the camera hidden and a slot to pop it out when you need it for things like iMacs and laptops (where the user sits relatively close to the device). Going out of your way to make firmware to turn a light on whenever the camera is working regardless of the OS installed sounds like more work than just physically blocking the damn thing when you don't need it (like card readers have the little cover over the slot when not in use in a lot of systems). It seems pretty obvious to anyone with half a brain that the first thing that someone wanting to spy on you will do is look for a way to disable that light. Where as a camera that can't see anything can't spy.

Re:It's pretty simple

[Lumpy]

Brain dead easy to do, put the slider behind the glass, it can be a 0.01mm thick film with a tiny rubber nub to move it. Any 1st year engineering student could figure this out.

Re:It's pretty simple

[Lumpy]

Most do this, it is an apple supplier design that is falling down by cutting a corner. Most webcams do keep the sensor powered down as they generate heat and cause video noise the hotter they get, plus in a laptop it sucks up power.

Whoever designed the old macbook camera was just dumb and used the wrong lead for the LED. OR they did it on purpose if you are a tinfoil hat crowd... Damn Masons and their alien artifacts!

Re:It's pretty simple

[Lumpy]

Opaque white will work and allow it to act as the sensor.

Re:It's pretty simple

[Lumpy]

You need to learn electronics.

Re:It's pretty simple

[Lumpy]

Because ram is cheaper than flash.

Re:It's pretty simple

[Lumpy]

Be sure to hump your xBONE though..... as the ever loving Microsoft will save you.

Re:It's pretty simple

[L4t3r4lu5]

I'd like a hardware switch which disconnects both the webcam and the microphone.

As it is, I make to with electrical tape and playing grindcore through my phone.

Re: It's pretty simple

[s.petry]

So you are claiming that the person speculating "stupidity" is more valid than someone speculating that it's "intentional"? Show me proof of it being stupidity, or that is also baseless rumors.

The point I made is that either view is valid, or did you miss the "consider the possibility" statement?

Re: It's pretty simple

[s.petry]

Just ignore his trolling. If you ask about the 9/11 commission report, this person will tell you that you are blaming the government for the events. They won't actually look at any facts themselves because they believe it dishonors the dead.

Re:It's pretty simple

[_anomaly_]

Sorry, but it's desserts. Think of it this way... you would actually want two desserts, but who wants two deserts?

Re:It's pretty simple

[Austerity Empowers]

A key logger is a piece of software which copies characters entered via a hardware device, captured at the OS level by an interrupt handler then repeated through an event messaging system, to an unintended source on the network.

A video capture malware is a piece of software which copies chunks of data entered via a hardware device, captured at the OS level by an interrupt handler and mapped into an illicit network packet, to an unintended source on the network. In this case the "real" video data is streamed into a ram buffer, that buffer is then mapped in to application space. The cloned packet may have to be copied first, atlhough modern hardware may allow one to place that data directly in the payload of a network packet tx fifo to be sent out w/o a copy. Not having tried to write this, i'm not sure what can be made to work easiest.

A "video logger" is somewhat harder to write, but is very, very similar.

Re:It's pretty simple

[schlachter]

just put a little picture of u looking at the monitor a couple inches from the camera.

Re:It's pretty simple

[Jherek Carnelian]

Sorry, but it's desserts. Think of it this way... you would actually want two desserts, but who wants two deserts?

Haha, sucker! I knew that proper usage would hook someone too supercilious to google it before edumacting me. It always does.

It isn't about dessert - really what kind of dumbass expression would that be? Just dessert? If you don't eat your meat, you can't have any pudding?

No, it is about what someone deserves.

https://en.wikipedia.org/wiki/Just_deserts

Re:It's pretty simple

[deconfliction]

Holy Dear God mod parent up to "+7 Thank You Snowden". And no, I understand _most_ products in the future will still not have the physical slider for the cam, and visually verifiable user facing dip-like switches for mic and main battery power. But the fact that we haven't seen _any_ products on the mainstream (or other?) market like this is what makes the parent post so insightful. The most bloody obvious layer of security is to not give imperfectly secure electronic devices that we keep near us, 24/7 access to input/output devices like mics and cams and speakers, or even their main power supply.

Re:It's pretty simple

[MugenEJ8]

Holy Dear God mod parent up to "+7 Thank You Snowden".

No... I will not thank Snowden. As much as I value some of the things that have come to light due to his leaks, I still feel his actions are treasonous.

On the other hand, consumers need to wake the f*ck up and smell the roses; by the mere fact Apple used to do something very noble to protect their users, and they silently removed that wonderful protection, should warrant an inquiry to Apple with the appropriate responses. I don't need a landing page on Apple's website to inform me every time they remove a feature I've counted on, but some sort of justification from the company for their actions to better let me (the consumer of their devices) decide if I want to purchase their products in the future.

Re:It's pretty simple

[deconfliction]

"No... I will not thank Snowden. As much as I value some of the things that have come to light due to his leaks, I still feel his actions are treasonous. " He was treasonous to worse traitors than he was. That is the truth of the matter. That makes him a true american hero.

Re:It's pretty simple

[_anomaly_]

Wow, thanks for educating me. I guess the pronunciation is what convinced me I was right, but as you point out, if you think about it, it doesn't make much sense. +2 for the Pink Floyd reference.

Re:It's pretty simple

[Jherek Carnelian]

And now you too can go forth and use it correctly knowing that you will catch at least one fish in the same net. Give a man dessert and he eats for a night, catch him in a fish net and he can go trolling for the rest of this life.

Re:It's pretty simple

[bhcompy]

And in a similar situation, that's when Lavabit said fuck you and shut its doors.

Re:It's pretty simple

[Actually, I do RTFA]

I have yet to be in a situation where the camera was anything other than a hindrance. So, that's two use cases right there!

Re:It's pretty simple

[fuzzyfuzzyfungus]

The Cypress parts are actually pretty neat for suitable applications. USB2 interface hardware all done for you, fast-enough-for-bit-shovelling 8051, and you only need a tiny slice of nonvolatile storage to store your VID/PID of choice, to tell the host system what firmware to load on launch.

Quite a few neat little devices, like the Saleae Logic are based on them: relatively cheap, pretty much impossible to 'brick' (since they just reload their firmware when unplugged and plugged back in, makes updates easy); but they seem like a hell of a thing to bake permanently into a non-user-accessible location with permanent access to the USB bus.

Re:It's pretty simple

[fuzzyfuzzyfungus]

If you want to spin 'pressure' flavored conspiracy theories, whose CEO was in the position of being a really shitty organ donor candidate; but needed a new liver, fast, if he felt like not dying?

Re:It's pretty simple

[GameMaster]

"you could probably pop open the machine yourself and take a look see if you're competent enough to understand them in the first place. I suggest you do this if you're skeptical. Heck, you might do us a favor and post them."

So, now you're assuming I own an x-ray machine? Were they supposed to come free with every apply computer and I just didn't get mine? That would certainly explain the excessive price for the hardware...

Sorry, I don't actually feel that way but just felt like jumping on the snark train for a bit ;-) . Actually, the point I was trying to make is that if the camera and/or indicator light are mounted on a multi-layer PCB then there is a good chance you can't visibly see the power traces with the naked eye. You also would have to know which of the camera pins was the power pin.

Re:It's pretty simple

[Chelloveck]

And any 2nd year engineering student could figure out that by putting a slot in the glass and a void behind it you're reducing the structural integrity of an already thin, brittle material. But before that happened a 3rd year industrial design student would slap it down because the little rubber nub would destroy the sleek minimalist look that Apple prizes so much.

Re:It's pretty simple

[j-beda]

In the most simple model of circuit behaviour, electrical components wired in parallel are independent of each other. Adding a low resistance pathway does not effect the higher resistance parallel pathway (provided the voltage of the circuit is not effected). Certainly the camera package designers are competent enough to have the LED put in the circuit along with the appropriate resistance (and impedance and capacitance for that matter) so that it would not unduly impact the CCD sensor.

Being able to use the camera sensor as a sight meter without having to turn on the LED might be impractical though.

Re:It's pretty simple

[cyn1c77]

A sliding cover to a camera does not adhere to KISS from a user's perspective. It's actually an annoying additional step to using the camera

I was going to say the same thing - that it makes the camera annoying to use and would probably confuse a lot of people if you ship it closed (and if you don't ship it closed, why even bother?)

There is one way you could make it covered and still not confuse users - have the sliding door activated by the computer when the camera is active. Then you could see when the camera was active, and the door could hard-wire an LED activation...

It would add cost and complexity though, and it does sound like a system that would be prone to failure rendering the camera useless. So there's still that issue.

That would be like connecting a gun safety to the trigger, so that the safety is released as the trigger is pulled!

Re:It's pretty simple

[Khyber]

"In the most simple model of circuit behaviour, electrical components wired in parallel are independent of each other"

Do I need to get to my parallel LED board, with a driver that will power all ten LEDs (in parallel) and show you that only two or three will light up? You don't get much more simple than that, sir.

" Certainly the camera package designers are competent enough to have the LED put in the circuit along with the appropriate resistance (and impedance and capacitance for that matter) so that it would not unduly impact the CCD sensor."

Having repaired tons of laptops both professionally and personally, and replaced the webcams in many (and fix the broken ones) I can tell you for certain that almost no manufacturer is willing to spend that expense when it's simpler to just have two separate circuits controlled by firmware. That's from experience repairing the board components directly, by the way. (Like I said, I refurbish the cameras myself. That's how I now have a sweet multi-cam rig for my guitar.)

Would you like to continue to argue with a person that does this daily? I can bring out many more examples of why you don't use an LED in-line with anything sensitive all day long, sir.

Re:It's pretty simple

[mdielmann]

There is one way you could make it covered and still not confuse users - have the sliding door activated by the computer when the camera is active. Then you could see when the camera was active, and the door could hard-wire an LED activation...

Only on slashdot would this be given as an alternative to a camera and LED being set on a single circuit during a discussion involving the KISS principle.

Re:It's pretty simple

[j-beda]

"In the most simple model of circuit behaviour, electrical components wired in parallel are independent of each other"

Do I need to get to my parallel LED board, with a driver that will power all ten LEDs (in parallel) and show you that only two or three will light up? You don't get much more simple than that, sir.

I really am confused. Maybe we are talking across each other. Are you saying you have a "parallel LED board, with a driver that will power all ten LEDs (in parallel)" and yet when you use it only two or three LEDs light up? Why would you call that "a driver that will power all ten LEDs"? I would call it "a driver that will power two or three LEDs". I really am curious how that fits into what is being discussed.

Would you like to continue to argue with a person that does this daily? I can bring out many more examples of why you don't use an LED in-line with anything sensitive all day long, sir.

I might have mistyped, or you may have misread or something else is causing problems, because again I don't see how that matters. "In-line" would seem to be implying "in-series" whereas I thought we were talking about putting an LED (or LED plus appropriate resistance or other fancy stuff to keep the current to the desired level) in parallel to the CCD, but attached on the correct side of the switch that turns on the CCD. Thus the LED would be a true indicator of when the CCD is getting power.

Now, I have no idea how much current the CCD or the LED would "draw" from the power source, or the effects of that power draw on the voltage that the power source can maintain, and it may well be the case that significant filtering might be required on one or both legs of this parallel arrangement due to one leg effecting the voltage the source can supply, but complaining about using a parallel circuit because the voltage is too high or the resistance is too low in one or the other leg and then telling people to take a real electronics course before speaking nonsense is a bit like yelling at someone who suggests using a lubricant to decrease chaffing because petroleum jelly causes dry skin.

Indicator lights have been in uses for a long time, and the vast majority of them do not require a microprocessor with attendant firmware to be switched on or off with the power.

Re:It's pretty simple

[rpstrong]

That would be like connecting a gun safety to the trigger, so that the safety is released as the trigger is pulled!

You mean as Glock does with its "safe action" system?

http://us.glock.com/technology/safe-action

Re:It's pretty simple

[liquidrocket]

Could be a debug bit

No, it's a perfectly normal feature. This is a general-purpose image sensor that has many different applications. Some of them benefit from using the STANDBY line, others don't. So, naturally, the image sensor will give the designer the choice of whether to use it or not.

The important point here is that the STANDBY line was never meant to be a security feature (most likely it has to do with power saving). The people who designed the laptop and chose to use it in such a way either didn't think it through or simply didn't care enough.

Re:It's pretty simple

[Khyber]

"Why would you call that "a driver that will power all ten LEDs"?"

The voltage and current are of the proper levels to power all of the LEDs, any experienced person would think that because that is what implied. All LEDs test 100% working on individual. But only two or three light up (depends on blue or red. Red tends to light three, blue only two.)

" "In-line" would seem to be implying "in-series" "

Along the same power rail. Either in series or parallel it doesn't matter.

"CCD or the LED would "draw" from the power source"

~6V for CCD, roughly 3.3V for CMOS sensor, and between 2.4-4V depending on LED color. All of those built-in webcams are USB, which provides 5V, and of CMOS design almost 100% of the time. That means you're not powering sensor + LED in series from USB, as the lowest combination possible still exceeds the maximum voltage of the power supply. Trying to run two different voltage devices off the same power line in parallel is not smart. You're going to burn one or the other, or one or the other will underperform, or just not perform at all.

YOU MUST RUN SEPARATE POWER LINES AND CONTROL WITH FIRMWARE.

I would seriously consider going back to whomever taught you your EE and demand a refund. Basic math alone is all that's necessary for this exercise, not even a full understanding of electricity.

Re:It's pretty simple

[j-beda]

"Why would you call that "a driver that will power all ten LEDs"?"

The voltage and current are of the proper levels to power all of the LEDs, any experienced person would think that because that is what implied. All LEDs test 100% working on individual. But only two or three light up (depends on blue or red. Red tends to light three, blue only two.)

We clearly are having some language issues. Or I am just stupid. I'll grant that is quite possible.

I don't know what this means: "All LEDs test 100% working on individual."

If the "voltage and current are of the proper levels to power all of the LEDs", why would only two or three light up? It seems equivalent to saying "She had enough money to buy ten apples, but she was only able to buy two or three". If all 10 are wired in parallel, then they all get the same voltage (since the ends of each component are at the same electrical potential as they are physically connected by conductors to the same points). If ten identical components are each attached to identical voltages, wouldn't their behaviour be identical? I would expect that either they would all light up, or none of them would light up. Which two would light up?

My understanding of electronics and circuit design is admittedly very rudimentary, but there are some fundamental ideas that I do not think are widely violated in even the most sophisticated designs. Things like "V=IR" and sum(I_in)=sum(I_out).

Why do you say "Trying to run two different voltage devices off the same power line in parallel is not smart. You're going to burn one or the other, or one or the other will underperform, or just not perform at all."? The whole freaking system is running off of one power line - the one coming in from either the wall plug or the system battery.

I would seriously consider going back to whomever taught you your EE and demand a refund. Basic math alone is all that's necessary for this exercise, not even a full understanding of electricity.

That may well be true. It would seem that the problem is clearly on my end since you tell me that what I understood is incorrect, and yet I am still unable to understand why that is so. Let me try to lay out what I think I understand and you can correct my flaws.

I have a 5V supply via the USB, clearly I can't run a CCD from that since you state it takes ~6V, so it looks like this camera will be a CMOS sensor, but we need some sort of resistor to drop the voltage (or limit the current if you would) to that needed by the CMOS sensor, so we string an appropriate resisteance in line with the CMOS sensor and then tie that to ground. Meanwhile, our indicator LED would tie into that same 5V supply, also with a current limiting resistor in series, and again tied to ground. This seems to be the "Camera sensor in parallel with the LED" that flyingfsck was suggesting: when the 5V is supplied, both turn on, when the 5V is cut off, both cut off. The only way I can see this design not working is if somehow the current through the CMOS sensor path plus the current through the LED path are greater than whatever the USB spec maxes out at (500mA ?) - is this why you don't think it is feasible? Is the CMOS current demand so variable that it induces unwanted jitter in the 5V supply that cannot be simply filtered?

Please use simple language, cause clearly I am a bit slow.

Re: It's pretty simple

[stealth_finger]

I was implying that no plane crashed into the pentagon. Most conspiracies are bullshit but that is one.

Tape it.

[pubwvj]

Hmm... I stuck a piece of black electrical tape over mine when I got the MacBook.

Re:Tape it.

[Anonymous Coward]

I put a backwards mirror over mine so they thought I was spying on them.

Re:Tape it.

[hawguy]

I put a backwards mirror over mine so they thought I was spying on them.

I make sure I'm naked any time I'm within range of the camera -- anyone that makes the mistake of spying on me will not do it again.

Re:Tape it.

[Anonymous Coward]

I put a backwards mirror over mine so they thought I was spying on them.

I make sure I'm naked any time I'm within range of the camera -- anyone that makes the mistake of spying on me will not do it again.

Don't be so hard on yourself. You have a lovely body.

Re:Tape it.

[weilawei]

Your co-workers must really love you.

Re:Tape it.

[antdude]

What if they find you attractive? That wouldn't work then. :P

Re:Tape it.

[clockwise_music]

I put a backwards mirror over mine so they thought I was spying on them.

LOL, whoever wrote this is a genius.

Re:Lens covers were standard in 1990's

[nurb432]

Drive a sharp nail into the mic port should solve one of your problems.

Good work, JHU guys. Apple, not so much.

[jeffb (2.718)]

I was pretty convinced that I didn't have to put a post-it over my MacBook camera. Guess I'll go ahead and do it after all.

Re:Good work, JHU guys. Apple, not so much.

[jeffb (2.718)]

No, I'm faulting them for leading everyone to believe that the light was tied to camera activity with a hardware interlock that couldn't be defeated in software.

Speaking as someone who's been a Mac owner continuously since 1985, I have to say that you aren't casting the user community in a very flattering light.

Re:Lens covers were standard in 1990's

[Iniamyen]

A lens cover would not be compatible with the Apple Aesthetic (TM)

Firmware

[ClaraBow]

Surely firmware can not be updated/modified without user knowledge, am I wrong?

Re:Firmware

[jader3rd]

Surely firmware can not be updated/modified without user knowledge, am I wrong?

Click here to view videos of cute kittens!!!!!!

Re:Firmware

[weilawei]

Suuuuuure. You just keep believing that.

Re:Firmware

[countach]

You wouldn't think so, but in fairness to Apple, these were pretty old machines, which means they had pretty old versions of OS-X. My guess is Apple closed this bug a long time ago, which is why the researchers had to use old Macs.

Re:Firmware

[tlambert]

Surely firmware can not be updated/modified without user knowledge, am I wrong?

The article used a virtual machine which required privilege to install, and then called it "firmware modified from user space", but actually it was "firmware modified from user space by first escalating privilege".

If you are willing to escalate privilege, you can pretty much do what you want to any USB devices firmware, assuming it's not in ROM and not hardware fused to make it non-updateable.

Re:Firmware

[drinkypoo]

If you are willing to escalate privilege, you can pretty much do what you want to any USB devices firmware, assuming it's not in ROM and not hardware fused to make it non-updateable.

I believe the assumption here is that it's not difficult for TPTB to get their firmware onto your computer. In an enterprise it's slightly tricky to do it without risk of being caught. Where individual users are concerned there is little risk in leaning on the OS vendor to deliver to you and you alone an additional payload right in a signed patch package.

Re:Firmware

[Anonymous Coward]

You wouldn't think so, but in fairness to Apple, these were pretty old machines, which means they had pretty old versions of OS-X. My guess is Apple closed this bug a long time ago, which is why the researchers had to use old Macs.

THIS IS WHAT APPLE USERS ACTUALLY BELIEVE!

Re:Firmware

[tibman]

Pretty sure that's not how the FBI does it : )

Re:Firmware

[Anonymous Coward]

Click here to view videos of cute kittens!!!!!!

OMG, where? You forgot your link!

Re:Firmware

[neonmonk]

Haha, Apple closing a security bug before it's been broadcast all over the internet, for months. Good one. You should write for Leno.

Re:Firmware

[Hamsterdan]

ASUSupdate is able to flash the BIOS without giving it admin rights, so It could be used silently I guess (on Windows XP at least last time I did it).

For other systems (*NIX including Mac OS), just make it part of a system update.

Re:Firmware

[AmiMoJo]

Apple did actually try to fix this problem by requiring firmware updates to be encrypted. They fucked it up though and leaked the keys via the firmware update apps, so anyone could write their own battery pack malware that literally causes your laptop to catch fire.

Re:Firmware

[sjames]

Yes, you are, If the attacker can elevate privilege. Some devices have the driver copy the firmware in from a file on the host when it initializes. Other devices have a command that can be issued that will reload firmware on an internal flash.

Re:Firmware

[viperidaenz]

ASUSupdate would be talking to a driver that you previously installed.

Re:Firmware

[gnasher719]

The article used a virtual machine which required privilege to install, and then called it "firmware modified from user space", but actually it was "firmware modified from user space by first escalating privilege".

No, they had two attacks. One involved a VM, but the VM had to have permission to access the camera in the first place, which VMs usually don't have. The other involved running an untrusted program. Programs coming through the app store would usually not be able to do this because they don't have appropriate access (and if they have access to the camera, they would hopefully be reviewed more carefully, plus the deed falls fully into anti-hacking laws that would put you into jail if found out).

The author of the article also developed a kernel extension which prevents all of this unless an app has root privileges, and if you have malware with root privileges, you have lost anyway.

Re:Firmware

[squiggleslash]

In an enterprise it's massively easier to do it without being caught, as long as you're in Tech Services, which is one of the groups most likely to want to make use of this hack...

As in "HR here, We suspect John Doe is snorting cocaine at his desk when nobody's looking, is there any way you could secretly record what he's doing?"

Dont forget about Sound

[bobjr94]

Since built in mics have been around much longer than built in webcams, no doubt they were hacked a long time ago. They have no way of alerting the users if they are active or not. Im sure many laptops, tablets, phones, game systems, cars electronics (like onstar & bluetooth) and even smart tv's have government spyware to record/monitor conversations and looking for keywords. Besides attaching a psychical switch yourself to a mic, not much you can do, a piece of tape wont help much.

Re:Dont forget about Sound

[whoever57]

Are the mics good enough to allow encryption to be broken by listening to the CPU?

Re:Dont forget about Sound

[weilawei]

Yep, my T60, even with the mic disabled in BIOS, will still record audio. Was messing with it one day and realized that Audacity would happily record from it anyway when supposedly "disabled", albeit with much lower gain.

Re:Dont forget about Sound

[hey!]

If this is in linux, this might have something to do with ACPI. The firmware has a table called the DSDT (Differentiated System Description Table) which basically tells the operating system how to turn integrated peripherals like network cards off and on when going to sleep or waking up.

One peculiarity of the DSDT is that the ACPI specification allows it to include different instructions to different operating systems, and this is a common source of problems in linux installs. Some manufacturers (Toshiba) deliberately sabotage non-Windows operating systems in their DSDTs. Others simply deliver DSDTs that are untested and potentially buggy in non-windows operating systems.

Anyhow, an OS can switch devices off an on itself using ACPI, so I think ACPI may trump BIOS settings. One way to test this is to boot with ACPI turned off. If this fixes the problem of the mic being available even when disabled in BIOS, then you have and ACPI/DSDT problem. If not, then it is a design flaw in the machine's design (e.g. turning the mic off in BIOS simply turns the gain to 0) and you wasted your time reading this post.

Re:Dont forget about Sound

[weilawei]

I was curious, after reading your comment, (this is Debian testing) so I rebooted, and went into BIOS. Well, no ACPI option. I did disable the microphone, as well as every power option I could find (along with anything else I could disable). I also booted with "acpi=off". I then fired up Audacity, and... it still records. Just like before. I think my time was not wasted reading your post, despite it still not disabling the microphone.

Re:Dont forget about Sound

[Runaway1956]

That is interesting. Thinking back, I've had some machines that behaved as expected when I turned things off in BIOS. Others - behaved oddly. You've got me thinking. The machine I'm on currently, Linux knows that I have an audio chip onboard, despite the audio being turned off. When I turn off the ethernet, Linux doesn't see that network interface. Never gave this any real thought before - I guess I'm just not paranoid enough. Cameras are not an issue, because it's a desktop, with no cameras attached. If/when I feel the need for a camera, I walk to the next room, rifle the drawers, pick up the camera, and bring it back to the computer, and plug it in.

One day soon, I need to do some testing to see what that audio board is capable of when it is disabled. Of course, there are no speakers attached to it, so it probably can't record anything.

Re:Dont forget about Sound

[140Mandak262Jamuna]

Wasn't there a virus that was using the speaker and ultrasound to communicate and replicate? They had a clean room and an airgap still the viruses got in through the speaker and mic,

Re:Dont forget about Sound

[weilawei]

There were claims, and then there was a POC, but I don't recall (I could be wrong!) the original claim being independently verified.

Re:Dont forget about Sound

[viperidaenz]

communicate, not replicate.

Re:Is your MacBook from before 2008?

[jeffb (2.718)]

I see nothing in the article to indicate that later models are any more secure. This particular software may not work with them, but I have no confidence that they can't be hacked the same way.

Same power source

[Anonymous Coward]

Weren't people claiming macbook camera light indicator was on the same power source as the camera itself and that it was thus impossible to turn on the camera without turning on the light indicator? That's obviously not the case. Glad I stuck a postit in front of the lens. And people were calling me paranoid.

Re:Same power source

[Em Adespoton]

Weren't people claiming macbook camera light indicator was on the same power source as the camera itself and that it was thus impossible to turn on the camera without turning on the light indicator? That's obviously not the case. Glad I stuck a postit in front of the lens. And people were calling me paranoid.

That's the 2009+ Macbooks; the older ones did it all in software.

Re:Same power source

[weilawei]

Interesting. I just had an Apple tech (that I trust, potentially trusted now) tell me that they used to be wired directly to the DC supply (didn't specify how far back) and aren't anymore. If you can get me a citation for that, I'm getting a new tech. Now I'm really interested.

Re:Same power source

[Em Adespoton]

That's interesting too... I suspect that your tech is likely correct and my sources aren't... let's see if I can pull up some takeaparts and isolate how these things are actually wired in in various models. Feel free to beat me to the punch.

Re:Same power source

[liquidrocket]

It's right there in the paper referenced in the summary. Figure 2 (also available here) shows you the diagram for 2008 and earlier models, where the LED is connected to the STANDBY line, which normally gives you what you expect but can be disabled in software, which is what they did.

It was at one time

[Anubis350]

A lens cover would not be compatible with the Apple Aesthetic (TM)

I have an external iSight from way back, it actually does have a close-able lens

So you are saying

[geekoid]

that if you change the software that controls the light you can change the behavior! Shocking!

Re:So you are saying

[AHuxley]

The expected "behaviour" was that the led would shine when the camera was working i.e. hardware function not software.
Some smart code would show the malware results of allowing a camera to be on with no visual feedback.
This was unexpected as the many people seem to think a US brand would have kept the hardware to camera working light link - suggested in an early external firewire model.
http://www.washingtonpost.com/business/technology/2013/12/06/352ba174-5397-11e3-9e2c-e1d01116fd98_story.html
"...overtly activate a computer’s camera — without triggering the light that lets users know it is recording — for several years"

That's not a bug, it's an NSA feature

[WillAffleckUW]

Remember, the family that is spied on together, stays together in Stasi Germany ... uh, Soviet Amerikkka ...

Seriously, this spying on Americans stuff is getting way out of hand.

Re:That's not a bug, it's an NSA feature

[WillAffleckUW]

second cousins, actually.

nice try, but I was in intel before you were in diapers.

This has been known for years

[koan]

I worked for Apple, their education department had an uproar when one school district was found to spying on the students via the iSight, the light never went on.
The school admitted they set it up that way.

They were spying on them at home, I wonder how many little kids got undressed in front of their iSights while someone watched.

http://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District

Re:This has been known for years

[Anonymous Coward]

"Students were particularly troubled by the momentary flickering of their webcams' green activation lights, which several students reported would periodically turn on when the camera wasn't in use, signaling that the webcam had been turned on.[8][22][24][47] Student Katerina Perech recalled: "It was just really creepy."[24] Some school officials reportedly denied that it was anything other than a technical glitch, and offered to have the laptops examined if students were concerned."

Sounds like the indicator light came on as it was supposed to, which is how they were caught spying on the kids.

Re:This has been known for years

[kmg90]

Wow, never heard about that till now. It's amazing how unscathed Apple's image was with this revolving around their hardware. I didn't even see any mention of this around the time the NSA leaks were creating uproar.

Re:This has been known for years

[weilawei]

Did you read Slashdot then? Because it sure made Slashdot and was even followed by an update or three.

Re:This has been known for years

[koan]

That was a lot of effort.

This is news?

[BurfCurse]

There are a lot things you can do with "small tweaks to firmware".

Should be illegal

[Anonymous Coward]

Handheld digital cameras make a shutter noise, mandated by law, last I heard. In the case of webcams, the LED *should* be hardwired to the power supply for the camera. What happens when it goes on without notice and starts capturing nude photos of people, potentially minors? Yes, this IS the "think of the children" argument--but if it's going to be used, it might as well be used to the benefit of everyone (except those engaging in illegal surveillance).

Re:Should be illegal

[wonkey_monkey]

Handheld digital cameras make a shutter noise, mandated by law, last I heard.

If you record video, does it have to play the sound of 8mm film clacking through a noisy gate?

Re:Should be illegal

[weilawei]

I think it should have a klaxon for that. ;)

Re:Should be illegal

[Hamsterdan]

That would be really cool, even cooler if the case looked like this and paired with either one of those

http://www.mobileshop.com/blog/mobile-phone-blogs/retro-ise-the-hell-out-of-your-nokia-n97-with-the-cityman-450/

http://www.amazon.com/Native-Union-MM01H-B-1-Black-Handset/dp/B003DKL4JA/ref=pd_sim_cps_4
http://www.thegreenhead.com/2012/08/iphone-cb-radio-handset.php

Re:Should be illegal

[mysidia]

Many handheld digital cams make a shutter noise. Mine has an option to swittch that off completely, or adjust the volume louder or quieter of the sound effect.

Re:Should be illegal

[squiggleslash]

Only if it's sub-VGA. 720P cameras are required to play the sound of a Bolex 16 Reflex camera in operation. 1080P cameras need to sound like an Edison Kinetograph, not so much for history's sake, but because the IP lobbying he did was so significant they're still passing bills Edison lobbied for after his death. The Kinetograph patents require a 59c per camera payment to his estate, and are due to expire some time in 2063.

Re:Lens covers were standard in 1990's

[koan]

It is a conspiracy, to make your laptop cheaper by getting rid fo rarely used doo dads (like mic switches)
The only other thing I would add is if you're not clever enough to figured out how to disable then you aren't doing anything the NSA cares about.

Not by accident

[Anonymous Coward]

The big companies do as they are told. They are either owned by extremely evil sociopaths (like Bill Gates), who believe that they are fundamentally more 'elite' than powerful politicians, bankers, generals, religious leaders, etc, or they are owned by people who know the cost of doing business at such a level means 'playing ball' with those that hold real power and influence.

In an age when Bill Gates spent TENS OF BILLIONS buying the state-of-the-art depth sensor companies that eventually gave Microsoft the ability to design and build the military grade 'time-of-flight' sensor used in the Kinect 2, all at the behest of NSA full surveillance ambitions, fiddling the software and hardware so the LED that accompanies the CCD camera is controlled in a completely independent way seems like comparing the achievement of an air-craft carrier with a pea-shooter.

However, it is all a never ending program of attacks against us, the general population. You are a serious sex criminal if you put a 'hidden' camera in the room used by your 'au pair', but when the government itself specifically distributes laptops at a high-school, so spyware can video your children in their own bedrooms, NO CRIME has been committed. They push to see how far they can go, and mainstream media outlets like Slashdot encourage you to offer no resistance, no matter how horrible their abuses become.

Normally, society works by EQUILIBRIUM. They push. We push. At some point, both forces are equal. Since the time of Tony Blair, all this has changed. Now so-called civilised nations in the West are supposed to INCREASE the amount they push each and every year, and each and every year we are supposed to walk backwards another mile. Notice the Blairite propaganda for the need for ever more laws, and the need for ever greater punishments for existing laws.

Tony Blair (the 'Putin of the UK, but far more powerful and influential than Putin) travels the world, calling for more state surveillance, more censorship, more laws, more severe punishments, far more organised religion in the lives of ordinary people, and far more military actions. Blair is 'god' for Gates, Obama, and other happy members of the actual far-Right, and the pseudo-liberal far-right.

To Team Blair, we are literal CATTLE, to be controlled, manipulated and used in whatever ways best suit the needs of those that call themselves the 'elite'. Does a farmer hesitate to practice full surveillance methods over his livestock when useful? Of course not.

The combined influence of the British and Americans over the rest of the planet is terrifying. If the British and Americans put on a united front, and say to the world "spy on your sheeple as far as your funds and technology allows, and gain and lasting better control over them in this way", not one nation will stand up and say "no, this is fundamentally evil". If, in the 19th century, Britain and the US had stood together in favour of slavery, Human slavery would be more widespread today than at any previous moment in Human History.

Blair knows how far the legacy of Britain's impact on recent Human events across these last centuries goes. He knows that as I type, all across Asia, Africa, the Middle East and East Europe, despotic regimes are saying "we can get away with this, because they do the same things today in the UK and USA".

Social engineering is now happening on a scale unthinkable even a decade back. Your children are subject to waves of abusive propaganda that would have made Winston Smith think he lived in a paradise of freedom by comparison. You are now told that it is fundamentally WRONG to allow people with non-state-approved opinions to be heard in public forums. The current front page of Digg is BOASTING how science forums on Reddit only allow Tony Blair approved opinions on matters of scientific 'fact'. And yet science, by definition, is the one area where the truth needs no sociological protection, so long as individual scientific voices are not suppressed. The scientific method requires debat

Re:Not by accident

[weilawei]

TL;DR: The laws don't apply to people in power/with lots of money. The little guy is screwed and keep getting more screwed every day.

Re:Not by accident

[weilawei]

Donating a lot of money and being a sociopath are by no means mutually exclusive. Nor does donating a lot of money to charity indicate altruism. There are still potential gains to be made. Please, however, do not jump to conclusions and take this comment to mean that I agree with either of you. Frankly, it's not worth my time or effort to go verifying that.

Re:Not by accident

[Anonymous Coward]

Now hold up. He gives a lot of money, yes, but apparently it is to eugenics companies. Seems he's like a lot of the antisocial slashdotters who are always complaining there are too many people on earth who are gonna drink up all the water and breathe all the air. He's trying to "fix" that problem and no, I'm not gonna google it for ya. It's made /. multiple times.

Re:Not by accident

[dave420]

I'm sure you think it's made slashdot, but as it hasn't happened, I doubt that. Get a grip. Reducing the population does not mean killing people - it means improving healthcare and quality of life for poor people.

Re:Lens covers were standard in 1990's

[Ungrounded Lightning]

Why can't I buy a webcam with a lens cover and no microphone, or a physical on/off switch for the microphone anymore?

I wouldn't trust the switch to actually turn off the microphone any more than I trust the switch that supposedly turns off the WiFi and Bluetooth to actually do so (rather than tell the software to not use them - for the normal stack.)

Even if it DID physically turn off the Microphone, remember that the speakers built into a typical laptop can also act as microphones. If the chip driving them is designed appropriately it can have a stealth listen-through-the-speakers mode.

Re:Lens covers were standard in 1990's

[weilawei]

Nope, because stupid people incapable of fully understanding technology never do anything that would get them in trouble, even if it were morally/ethically correct (see whistleblowers). And also, the NSA would only *ever* spy on people were Terrorists and Child Molesters. They'd never collect information on every American citizen they could.

Re:No no

[hawguy]

My HP doesn't have a built in camera. My mics are filled with caulking. When I need either, I plug in external.

But that's only the mics you know about. One of those things that looks like a capacitor on your motherboard is actually a secret NSA microphone. It's wired in with one of the inside-layer traces on the motherboard so no one has detected it yet.

Re:No no

[Em Adespoton]

My HP doesn't have a built in camera. My mics are filled with caulking. When I need either, I plug in external.

But that's only the mics you know about. One of those things that looks like a capacitor on your motherboard is actually a secret NSA microphone. It's wired in with one of the inside-layer traces on the motherboard so no one has detected it yet.

...and then there's the ultrasonic emitter built right into the SoC with the baked-in communications and execution firmware....

Re:No no

[ColdWetDog]

That's OK. You know that filling you had replaced last year?

Re:No no

[weilawei]

Why go with that when you can embed a cell modem into the CPU?

According to the NSA (OS X camera security)

[Anonymous Coward]

You should uninstall the camera's drivers/kernel modules.....
Same thing for USB and FireWire....

http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml
https://ssl.apple.com/support/security/guides/docs/SnowLeopard_Security_Config_v10.6.pdf

To remove kernel extensions for video hardware:
1 Open the /System/Library/Extensions folder.
2 To remove support for the external iSight camera, drag the following file to the Trash:
Apple_iSight.kext
3 To remove support for the built-in iSight camera, Control-click IOUSBFamily.kext and
select Show Package Contents.
4 Open the /Contents/PlugIns/ folder.
5 Drag the following file to the Trash:
AppleUSBVideoSupport.kext
6 Open Terminal and enter the following command:
$ sudo touch /System/Library/Extensions
The touch command changes the modified date of the /System/Library/Extensions
folder. When the folder has a new modified date, the Extension cache files
(located in /System/Library/) are deleted and rebuilt by Snow Leopard.
7 Choose Finder > Secure Empty Trash to delete the file
8 Reboot

Re:According to the NSA (OS X camera security)

[weilawei]

That'll totally stop an attacker from putting in their own exploit. ;)

Re:Firmware security

[Hamsterdan]

*I'ts not like you could hang the LED off of the sensor's power line.*

You could if the silicon was designed to allow it (ie: like in old webcams)

Yeah, but...

[Overzeetop]

Yeah, but you can't hear boobies. Useless hack.

Re:Lens covers were standard in 1990's

[koan]

Stupid people should be caught is the message I'm sending.

Why are people naked in front of their PC?

[damn_registrars]

I can't really think of a time when I would want to be naked in front of my PC. While that doesn't excuse the invasion of privacy, it does suggest that some people are lacking in common sense. People generally wouldn't walk naked in front of a window with the blinds drawn, why do it in front of a powered-on PC?

Re:Why are people naked in front of their PC?

[eWarz]

Pffft...I'm naked right now! j/k...or am i? ;)

Re:Why are people naked in front of their PC?

[Mix Master Nixon]

That's where the porn lives.

Re:Why are people naked in front of their PC?

[DarwinSurvivor]

Many people, especially younger people, have their desks in the same room where they sleep, and incidentally change their clothes or partake in other activities.

Re:Why are people naked in front of their PC?

[N1AK]

Many people, especially younger people, have their desks in the same room where they sleep, and incidentally change their clothes or partake in other activities.

This. You're a student or a late teen kid at home. Chances are you have a laptop and use it in your 'room' the single room in the house or student accomodation that is yours. Unless you always shutdown your laptop before getting changed, coming back from a shower etc then invariably you're going to wind up undressed in the same room as a device with a camera. Sure you could always turn your laptop to face away but wouldn't it be nice if we could do something to stop the risk entirely rather than force everyone to be mega-paranoid about everything.

Re:Why are people naked in front of their PC?

[coofercat]

Really? What else won't you walk naked in front of? How about your fridge? Your alarm clock? Or maybe your TV?

Why *wouldn't* you feel free enough to walk about naked anywhere you damn well like in your own home? You have an expectation of privacy there, and you are perfectly reasonably not to expect a Telescreen to be recording your every move and relaying it back to persons unknown.

Re:Why are people naked in front of their PC?

[Hatta]

I can't really think of a time when I wouldn't want to be naked in front of my PC.

Re:Why are people naked in front of their PC?

[Chelloveck]

Pffft...I'm naked right now! j/k...or am i? ;)

You are. But what you're wearing is actually worse. Seriously, some bodies are just *not* suited to the leather-and-latex scene.

Re:Lens covers were standard in 1990's

[weilawei]

Should be? Why should a whistleblower be caught (this implies punishment) if they make a mistake? I wish I'd made my comment without the word "stupid" in it. In fact, read it again, without that word.

Two words.

[roc97007]

Duct. Tape.

And also: "and there was a case in the news where a woman had nude pictures taken of her without her knowledge". Heh heh. Those zany FBI analysts...

Re:Two words.

[__aajfby9338]

I used to put electrical tape over the camera lens on my work laptop, because I'm caring enough to save those poor IT security guys from having to see pictures of me picking my nose. I used blue tape, not black, because that was the first thing I grabbed off the shelf in the lab. One day I found that the camera could still see a blurry image of the room through the blue electrical tape. So, whatever kind of tape you use, do a quick test to make sure it's actually opaque enough. I now use copper foil tape, which we also happen to have in the lab. Aluminum foil tape should also work as well, and that should be commonly available in hardware stores.

Re:Two words.

[unique_parrot]

...let's see if he has a facebook account?! no, now, that's very interesting, let's have a look at his expenses...

Re:This is going in the wrong direction

[roc97007]

My previous laptop had an actual hardware killswitch that physically broke the connection between the camera and the USB bus, and a similar one for the wifi. My current one doesn't, it just has a key combination that disables the camera, presumably in software. This is stupid.

I'm actually wondering why this (a physical kill switch) isn't a required thing by businesses such as, oh, gyms, and companies concerned about corporate espionage. Awhile back there was a push in some companies to only issue company phones without cameras, but that seems to have fallen by the wayside.

Re:Lens covers were standard in 1990's

[koan]

"Nope, because people incapable of fully understanding technology never do anything that would get them in trouble, even if it were morally/ethically correct (see whistleblowers). And also, the NSA would only *ever* spy on people were Terrorists and Child Molesters. They'd never collect information on every American citizen they could."

Well there's still that part about "incapable of fully understanding"

So...
""Nope, because people never do anything that would get them in trouble, even if it were morally/ethically correct (see whistleblowers). And also, the NSA would only *ever* spy on people were Terrorists and Child Molesters. They'd never collect information on every American citizen they could.""

And now it just seems silly and a waste of time.

Godwin

[Any Web Loco]

We need a Godwin equivalent for when people use the "Think of the children" argument in an online discussion.

Re:Godwin

[koan]

Who did that?

Re:Godwin

[Zynder]

Well you know who else thought of the children dontcha?

Re:Godwin

[konohitowa]

But, "I call Any Web Loco on that." doesn't have the same ring to it.

Re:Godwin

[squiggleslash]

Well, in the same way as "You know also stirred up racial tensions to an extreme in order to achieve political power?" might be a legitimate use of a Hitler analogy, there are occasions a "Think of the children" comment is also legitimate. As in most parents here are a tad concerned about the idea that little Jessica's MacBook could be used by perverts to take pictures of her.

We need a variant of Godwin's law about people who react to any analogy involving a specific thing as being an abuse of that analogy..

Re:Lens covers were standard in 1990's

[weilawei]

Do you fully understand the ramification of every component, in every piece of technology you use? You may, but can you guarantee that everyone else does? Do you hire Chipworks to dissect every chip you intend to use?

Goatsx

[Registered Coward v2]

Why not just modify the code to return goatsx instead of blocking the ability to turn on the camera?

Obligatory

[CohibaVancouver]

Pics or it didn't happen.

Re:Lens covers were standard in 1990's

[Runaway1956]

Let us consider that for a moment. Some dude wants to bomb a target. He is approached by one or more unknown persons, who question him about bombs, question his desire to bomb the target, offer to supply the bomb(s), offer to supply the vehicle, offer training in setting the bomb(s) off, and offer assistance in getting away after the bomb is set. When he drives the vehicle with the faux bombs to the target, he is arrested by those unknown persons, and fifty other FBI, ATF, and local police officials.

Clever? I don't think so.

Re:Lens covers were standard in 1990's

[anagama]

Your's is an annoying attitude for a couple reasons. First, if a person is going to have a really deep technological sophistication, it will be limited to a very narrow area -- each discrete component in a computer probably requires intense all consuming years long study -- that's why you end up with people who focus on one single thing and the person who is fully expert on video drivers may be really inept regarding hard drive technology. Honestly, I think anyone who believes they fully understand every aspect of a laptop is just setting himself up to get totally hosed.

Secondly, it is not a sign if being unintelligent for a person to have a vague understanding of computers. If everyone had a deep understanding of computers, nobody would have the time to become dentists, mechanics, veterinarians, etc. etc. Seriously, pick some random difficult topic about which you know nothing -- does your lack of knowledge in that area make you stupid? Of course not. Because it is not possible to know everything there is to know.

Re:No no

[weilawei]

We need a new mod, +1 Paranoid. ;) (Yes, I know you're joking, but someone modded your comment underrated, rather than funny.)

Cams can see through black plastic

[raymorris]

Many IR receivers and transmitters, such as on remote controls, are covered by opaque black plastic. That black plastic is opaque to visible light, but transparent in infrared. CMOS cameras are very good at seeing in infrared. Therefore, a factory installed cover could APPEAR opaque but actually be transparent for spying purposes.

When I was a licensed private investigator I may have taken advantage of that fact.

Re:Cams can see through black plastic

[Imrik]

You could even make one that was polarized and get visible light through while maintaining the appearance of a black plastic cover.

Re:Cams can see through black plastic

[bickerdyke]

Light from common lightsources is unpolarized, but that does NOT mean that it is not polarized, That means, it containes a mix of light polarized in every possible direction. So even if your cover lets through some specific polarization, this wil be visible and the cover would not appear opaque.

Stick with the IR wavelengths...

Re:Cams can see through black plastic

[Imrik]

That is only true if there is a light source behind the cover. Without a light source inside, some light will get through to the camera, but it won't get back out, giving the appearance of black plastic.

Re:Cams can see through black plastic

[bickerdyke]

Doesn't the reflection from most materials remove any polarization? But I agree, very little light would be reflected back then.

Re:Cams can see through black plastic

[Lumpy]

unless the camera is designed without an IR filter, that trick does not work. And I would not use a black slider but an opaque white one. let it extend to the edge of the LCD to collect light from the screen and completely pollute the visual area of the camera sensor along with being opaque it will eliminate any trickery while being super cheap to put in place. less than $1.00 each in quantity.

Re:Cams can see through black plastic

[sootman]

Many -- probably most -- digital cameras do not have IR filtering. All you need is a remote control to test. Turn on your camera, point the remote at the lens, and press a button on the remote. On the iPhone 5S, you can point the remote at the main camera and you won't see its light, but if you point it at the front camera, you will. I've been using digital cameras to test remotes and their batteries for years. Here is a pic I just took with the built-in camera on a 2011 MacBook Pro.

Also, any DV camera (remember those?) with "night mode" depends on that. Put them into night mode and a bright IR LED lights up the scene, letting the camera "see" in perfect (human) darkness.

Re:Cams can see through black plastic

[Lumpy]

Incorrect. MOST have an ir filter. Please research this, it takes you less than 3 minutes on google. if they did not have the IR filter they would easily get overwhelmed, it's why they are put in there and why people REMOVE them for astro-photography and other low light or IR light work.

I have been inside hundreds if not thousands of usb cameras as well as other cameras, even DSLR's have a IR filter on them. Specifically to remove the IR filter so that they are sensitive to the IR range. then you use a specific filter to block visible, I tend to use unexposed but developed 35mm film for my free source of IR pass visible blocking filters.

Re:Cams can see through black plastic

[sootman]

OK, fine. Most have SOME amount of IR filtering because yeah, you need to filter IR to get good pics in natural light, but some have more, some have less. Speaking of things that take 3 minutes to research, I just tested with my iPhone 5S: Shining a remote into the back camera, literally as close to the lens as I could get, I see nothing. With the front camera, the light is visible from over a meter away. (Phone in one hand, remote in the other.)

The OP's point was, plastic that "looks" black to humans can, in fact, let IR light through. (It's the stuff they mold onto the ends of remotes to make them look nice -- they've been doing that for over 20 years.) And many digital cameras can pick up that light. Every point and shoot I've owned, from 1.3 (in 1997) to 8MP, and many cameras on laptops and phones, including BOTH cameras on the iPhone 4, could do that trick of seeing remote lights. So yeah, all cameras might have SOME amount of IR filter, but I don't do astronomy. For me, the distinction is "enough filter to block a remote's light, or not." Or, to work with the IR illumination LED that came with my 10-year-old Sony DV camcorder.

Re:Cams can see through black plastic

[toddestan]

Most cameras, unless there is a filter installed, can definitely see the IR light through the black plastic. You can confirm this easily by pushing buttons on the remote while pointing it at the camera. You're right though, there would have to be a pretty bright IR source to light up a room well enough to see through the plastic..

Black Tape?

[Jack Griffin]

Does it have to be black tape? I have a roll of grey tape, and some blue tape too, will these suffice?

Do I have to type a heading in each reply?

[Jack Griffin]

Becasue XBone sounds a bit rude, like boner. Or if you bone someone you fuck them over. so even though XBone itself doesn't mean anything bad on it's own, if you take it as "X" "Bone" instead of "XB" " One" it sort of implies some negative association (I guess).

Re:Do I have to type a heading in each reply?

[exomondo]

Becasue XBone sounds a bit rude, like boner.

oh...i see.

Re:Do I have to type a heading in each reply?

[AK Marc]

How do you distinguish the third X-Box from the first? They have overlapping namespace. MS just prefers to pretend the first didn't happen, but consumers aren't as stupid as MS asserts.

Re: Do I have to type a heading in each reply?

[k2r]

> Becasue XBone sounds a bit rude, like boner

I guess that's true if one's still living in your mothers basement...

It has ALWAYS been firmware.

[Khyber]

Let me demonstrate why you don't run an LED in-line with a sensor.

Now that *WAS* a pure clean audio signal before the LED was introduced. Notice the distortion? You're about to get something like that for your sensor. I've got rectification on the other side before it hits the speaker.

Anyone saying it would probably be more cost-effective and easier to do by hardwiring led and sensor to work at the same time (implying running in series) should go right ahead and try it. I hope you didn't pay much for your sensor.

I've got several different laptop webcams right here. Every LED has its own dedicated circuitry. Two from Macbooks, two from HPs, and a Toshiba.

Bet you 10:1 this has already been tried. If it worked, it would be the norm by now just for the extra bottom line.

Re:It has ALWAYS been firmware.

[flyingfsck]

Wire it in parallel you dum dum.

Re:It has ALWAYS been firmware.

[Khyber]

>implying camera sensor and LED run off the same voltage

Re:It has ALWAYS been firmware.

[TeknoHog]

>implying camera sensor and LED run off the same voltage

Because it's obviously impossible to have any circuitry with the LED (such as a series resistor) to match the voltage requirements.

Re:It has ALWAYS been firmware.

[TeknoHog]

More generally, there are plenty of ways to have the LED always on with the camera, using _hardware only_ so that firmware hacks won't work around it. Of course, you can hack around hardware too.

I haven't taped over my laptop's camera for a number of reasons. For example, there are probably other cameras in there, besides the obvious one with the LED...

Holographic Goatse Lense Covers

[flyingfsck]

I think whoever makes a holographic Goatse lense cover will make a fortune.

Re:Lens covers were standard in 1990's

[rusty0101]

It's that stupid raised piece, or notch to allow someone to move it with a finger or thumbnail. Logitech has the pattent on one, Radio Shack the other, or perhaps it's Acacia and Tessera, or... No Prenda was copyrights... and Apple refuses to license either. So Apple calls them ugly.

And they thought I was paranoid...

[FuegoFuerte]

...when I put a piece of black electrical tape over the webcam on my laptop and tablet. Ok, maybe I was being paranoid, but as we've all seen now: "Just because we're paranoid doesn't mean they're not out to get us." Sometimes I hate being right.

Users and firmware.

[Ihlosi]

The whole point of calling something firmware is that the user shouldn't even know it's there and it's actually a piece of software and not hardwired electronics.

So how should the user have knowledge that something he shouldn't have knowledge of is being modified?

$5 solution

[101percent]

https://supporters.eff.org/shop/laptop-camera-cover-set

Certification of Privacy?

[Comen]

I have always felt like someone should create a Privacy stamp of approval or a way to certify that a product adheres to certain hardware specs regarding privacy.
Being approved by this group would allot you to stamp your product was found secure by a 3rd party group like this.
A product would have to use a mini relay or something like that to physically disconnect the connections from the camera and microphone of any device when its not in use, and when in use show that the connections are made with a LED light that is hard wired to the same relay, with no way to bypass in software.
You may use a physical shutter for the camera and some way to disconnect only the microphone, but have a 3rd party certify this would go a long way to have open security cameras in a room in my house etc, something I would never do with a security company able to watch you 24/7, but if when they watched a red light lit up very bright and could not be bypassed might work.

First Apple webcam did feature mech. obturator...

[Herve5]

The first Apple webcam did feature a mechanical obturator, that closed the diaphragm in a very visible way (also shutting off the LED).
That was at the time cams were external and big (even though Apple's was twice smaller than the rest).

Now, Apple's way of doing is close to the tablets way: the cam just should not even be visible, and not bother me.
And I agree with that.

I'm not paranoid about the cam light being shut; I even sincerly think anyone spending time about this is wasting a time that would better be used to think about open source and linux alternatives to Apple.

Tell me about Mint vs Ubuntu, not about minuscule cam-LED features, I'll follow you more carefully...

Where's DRM when you need it?

[mounthood]

Remember that DRM is for controlling people, not protecting them.

imperfect ir filters are common, point blank range

[raymorris]

If you point an IR light source, such as a remote control, at the camera from a few inches away it'll be visible DESPITE the IR filter. By analogy, dark sunglasses might filter out 80% of visible light, but that doesn't make the a flashlight invisible through sunglasses.

Every digital camera I've ever checked has an IR filter coating. Often, a cotton swab dipped in acetone can be used to wipe away the coating.

Maybe

[Mephistophocles]

I'm not an electronics engineer, but I dunno. That seems a little harsh on apple; the camera and led could have different power sources for any one of many innocuous reasons. That said, if you're paranoid (like me), a nail and jeweler's hammer will make quick work of the camera, and then power sources don't matter much. If you don't want to damage it permanently, some electrical tape works great too.

Re:Maybe

[deconfliction]

actually I've been doing the electrical/duct tape thing for years. But it is disingenous to say that it 'works great too'. A penny's worth of plastic would provide a greatly enhanced user experience in comparison (for the slider). A quarter's worth of physical user facing switches for the mic, speaker, and main power would also provide a great deal of optional security, with a far better user experience than a homebrew mcguyvering will do. The conspiracy here is the NSA encouraging the public, including it's own citizens, to believe that these devices were more fundamentally secure than they were for years. I honestly believe the conspiracy also physically and psychologically harmed many individuals over years to keep the public miseducated and disinformed about the real security risks these devices pose in the long term. (Kompromat, vulnerability of the databases to variously motivated insider threats, of which Snowden was the absolutely best case scenario, though incredibly doubtfully the only successful obsconder of that top secret database).

Re:Maybe

[Mephistophocles]

No argument with any of that, and great points re: NSA's deceit and the fact if Snowden could make off with such a database, it was likely child's play for most governments with an interest in it. However, expecting Apple to actually follow through with installing privacy controls like what you've described is probably the height of foolish optimism. I'm perfectly comfortable taking the matter into my own hands, hence the destruction or careful blocking of the camera.

Re:Maybe

[deconfliction]

However, expecting Apple to actually follow through with installing privacy controls like what you've described is probably the height of foolish optimism.

You misunderestimate the heights of foolish optimism I can muster. My real hope is that Apple doesn't, just as you say, but that some competitor comes along and hurts Apple by both designing a more secure product, and convincing the public that it is preferable to the Apple alternative. And even still preferable after Apple copies the ideas, because the current megacorps should all be punished financially into oblivion for their participation, willfully or ignorantly, ... Yeah, I'll have committed suicide long before that happens.

Old News

[dewrox]

This is old news. If you were not aware that a camera could be turned on without the indicator light saying it is on then you are not as big of a geek, nerd or whatever you thought you were. For example the Logitech sdk has had the ability to control the indicator light for at least 13 years Check the doc here This does not really meet the newsworthy standard to me... although it proves that many don't know or have forgotten.

Re:imperfect ir filters are common, point blank ra

[Lumpy]

do you notice how dim the IR remote looks on the camera? you do realize that that ir remote is blasting a LOT of light so it is the same as if you can take a 3Watt flashlight and blast your face with sunglasses and see a dim light. they block 90-98% of the light. Go ahead, get a piece of Unexposed but developed 35mm film in front of your webcam and show me how it can see clearly, it cant not without a LOT of light in the room or you remote the IR filter.

Laptop cameras

[phorm]

I remember a few laptops having cameras with a feature like this. The camera had little clip which could slide a cover across the camera lense, similar to the closed lense on a digital camera.

Re:imperfect ir filters are common, point blank ra

[sootman]

I just tested more with my iPhone 5S. With the back camera, literally as close to the lens as I could get, I see nothing. With the front camera, the lights are visible from over a meter away. (Phone in one hand, remote in the other.)

My first digital camera was a 1.3MP unit in 1997. The last point-and-shoot I got was an 8MP one about 4 years ago. Those, and all in between, showed IR light as I describe. As did all iPhones before the 4S.

So all digital cameras might have *some* IR filtering, but some much more than others. To me, "IR filter" means does it filter out just enough to make pics look good in natural light, or do they also filter out strong IR beams.

Anyway, the OP's point was, plastic that "looks" black to humans can, in fact, let IR light through. (It's the stuff they mold onto the ends of remotes to make them look nice -- they've been doing that for over 20 years.) And many digital cameras can pick up that light. THAT is what we are discussing here.

The facts are fine but you ignore them

[dbIII]

Your suggestions were the ones that dishonoured the dead and whichever branch of the US government you think murdered all of those people and planted aircraft wreckage on the site.

Re:The facts are fine but you ignore them

[s.petry]

By your logic anyone that questions an investigation is dishonoring the dead. Your logic is broken, not mine.

Re:The facts are fine but you ignore them

[dbIII]

Please stop pretending that you are not taking me a vast distance out of context. Your disgusting conspiracy theory was the thing that dishonoured the dead and suggested that the US government had murdered thousands of civilians on 911.

Re:The facts are fine but you ignore them

[s.petry]

There is no "my conspiracy" you liar! What I pointed you to ages ago was a group of architects and engineers who state, with scientific certainty, that what the 911 commission put out can not be true. They provide scientific models, experiments, mathematics and physics to back that position on nearly every event dealing with the 9/11 attacks. The thousands of architects and engineers, nor myself, claim to know what really happened, therefor your claim of conspiracy is a pure fabrication. The request from the scientific community is that the case be reopened to find "who done it".

You refused to review any of the scientific data, and lied repeatedly during the discussion with such gems as "we have no other plane crash data to compare the 9/11 attacks to" then refused to look at exactly that data because you claimed "it dishonors the dead to investigate".

Not only do you refuse to read and study facts, you change the definition of "conspiracy" to maintain your delusion. Now go fuck yourself and stop trolling my posts!

Re:The facts are fine but you ignore them

[dbIII]

Bullshit - you gave me all kinds of crap about fake engines and buildings on fire having steel of far greater strength than hot steel has. You tried to use your HR granted title of leading hand of a bunch of coders as justification for knowing about civil engineering. You are just adding to the huge pile utter contempt I have for your ravings.

Re:The facts are fine but you ignore them

[s.petry]

You were asked to quote anything I stated where I implicated anyone. You never could, you maintain a lie. Just like you resort continually to ad hominem instead of addressing the point. If you wish to show where ae911truth.org is wrong with scientific data I'll listen. You won't look at it, because it "dishonors the dead". Now fuck off troll.

Simple Change is all that is needed

[metaforest]

From the TFS' last link --> camera.pdf at the end of the abstract.

The LED driver could be altered so that it is driven through a buffer from the strobe line on the data bus. (not shown in block diagram) The buffer then is AC coupled to the LED. When the data strobe is toggling (data is being transferred) the LED lights up. When data is not being transferred the LED goes dark. Add a small parallel capacitor and the output drive of the buffer will easily keep the LED lit at 100% even if the strobe has a very low duty-cycle in it's active state.

This approach cannot be defeated since the data strobe (often referred to as dclk in the camera controller documentation) is a required active signal while the camera is active, and is static(not toggling) when no data is being transferred.

A similar trick can be used to indicate that the internal mic is active. Internal mics have a simple form of phantom power that is turned off when the mic is not in use. A simple transistor can be used to detect the presence of the mic power, and light an LED. Typically mic power is turned off in the hardware audio CODEC when the mic is not set as the source for input. Not doing so wastes power, and creates an undesirable source of noise at the input multiplexer of the audio CODEC.

This kind of security flaw is a consequence of the product engineer(s) not considering security at all when looking at the implementation. The project lead also didn't take a careful look at how STANDBY was implemented in the camera controller to see that it COULD be bypassed, as the camera controller device was designed to allow a free-running mode that ignores STANDBY.

prove it

[moophus]

Pics or it didn't happen

that's interesting, same device one much more

[raymorris]

That's interesting that the two cams on the same device would be so different. One, a very effective IR filter and little to no filter on the other.

Re:How about a physical switch?

[RockDoctor]

These "switch" devices that you talk of are too complex for Apple users.

Re:Lens covers were standard in 1990's

[jamstar7]

Let us consider that for a moment. Some dude wants to bomb a target. He is approached by one or more unknown persons, who question him about bombs, question his desire to bomb the target, offer to supply the bomb(s), offer to supply the vehicle, offer training in setting the bomb(s) off, and offer assistance in getting away after the bomb is set. When he drives the vehicle with the faux bombs to the target, he is arrested by those unknown persons, and fifty other FBI, ATF, and local police officials.

Clever? I don't think so.

Funny how that turns out, eh? Even stranger, I read someplace that the only reason cells of the Communist Party in the US survived the 50's was because of the paid informers that infiltrated it were the ones paying dues to keep it running. Obviously, so they'd have something to report. NFI how true that is. Cool rumor, though...