That might make it harder to develop a hack, but one would hope that if the hardware team tied the LED to a hardware signal, it would not matter if the firmware were reflashed.

You need some logic to enforce things like a minimum LED duration that keeps the LED on for a couple seconds even if the camera is only used to capture one brief frame.

I have a script that takes periodic screenshots of my face for fun and I can confirm the LED stays on even if the camera only captures on quick frame.

EDIT: It’s not just a capacitor, it’s a full custom chip, that can’t be software-modified, that keeps the light on for 3 seconds. https://news.ycombinator.com/item?id=42260379

A custom PMIC for what's known as the forehead board was designed that has a voltage source that is ALWAYS on as long as the camera sensor has power at all. It also incorporates a hard (as in, tie-cells) lower limit for PWM duty cycle for the camera LED so you can't PWM an LED down to make it hard to see. (PWM is required because LED brightness is somewhat variable between runs, so they're calibrated to always have uniform brightness.)

On top of this the PMIC has a counter that enforces a minimum on-time for the LED voltage regulator. I believe it was configured to force the LED to stay on for 3 seconds.

This PMIC is powered from the system rail, and no system rail means no power to the main SoC/processor so it's impossible to cut the 3 seconds short by yoinking the power to the entire forehead board.

tl;dr On Macbooks made after 2014, no firmware is involved whatsoever to enforce that the LED comes on when frames could be captured, and no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured.

0: https://www.usenix.org/system/files/conference/usenixsecurit...

[1] https://support.apple.com/guide/security/hardware-microphone...

We have no way of verifying that anything they said in that document is true.

That said, I still use "Nanoblock" webcam covers and monitor for when either the camera or microphone are activated.

https://news.ycombinator.com/item?id=42261730

When people are extorted for these kinds of things it's usually catfishing that leads to sexual acts being recorded. That's not related to cybersecurity.

edit: s/baked/naked/ :D

Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby. But naked images of Abby can head off into the ether and be propagated more or less forever, turn up on hate sites, be detrimental to careers etc.

If your threat model is leaking company secrets then sure, microphone bad, as is anything having access to any hardware on your machine.

So sure, maybe people ought to be more concerned about microphones as well, rather than instead.

> Nobody but Abby and Ben care if Ben is caught admitting he cheated on Abby.

That destroys families, standing within a community, and very often careers.

> chats and email, browsing history, etc are all much more likely to result in harm if leaked than a recording of you innocently in your home.

This is far less of an intrusion for most people than recording what they are actually doing in their own home IRL. People know that information can be hacked, they don't expect and react quite differently to someone actually watching them.

> That destroys families, standing within a community, and very often careers.

Yes, but it doesn't stay on the internet forever in quite the same way.

It's also known that people are not very good at assessing risk. People are more word about dying at the hands of a serial killer than they are of dying in a car crash or slipping in the shower. I feel you're underplaying the psychological harm of having all of your data crawled through by a creep (that would include all of your photos, sites visited, messages sent, everything).

All I can really say is that if someone gained access to my machine, the camera would be the least of my concerns. That's true in nearly every context (psychological, financial, physical, etc).

I presume the reason behind this is that video is much more likely to be re-shared. Sending bob a zip of someone's inbox is unlikely to be opened, and even less likely to be shared with strangers. But send bob a video of Alice, and he might open it. Heck, he might not know what the video is until he opens it. So even if he is decent, he might still see it. And if he is less decent and shares it, strangers are much more likely to actually view it.

It's not just about nudity and extortion, but someone having access to watch you, whenever they feel like, in your safe space. That sense of violation that people also feel when (for instance) they have been the victim of burglary - the missing stuff is often secondary to the ruined sense of security. There's a vast difference between leaving your curtains open and having someone spying on you from inside your own home.

Is it rational to put this above other concerns? That's a whole different debate and not one I'm particularly interested in. But it explains why people are concerned about cameras over 'mere' data intrusion.

This isn't true at all, even for private citizens. Your friends, parents, children, and colleagues are all likely to care.

I may be the oddball here, but that 3 second duration does not comfort me. The only time I would notice it is if I am sitting in front of the computer. While someone snapping a photo of me while working is disconcerting, it is not the end of the world. Someone snapping photos while I am away from the screen is more troublesome. (Or it would be if my computer was facing an open space, which it doesn't.)

And, of course, covers are an option.

The exploit mitigations to prevent you from getting an initial foothold.

The sandboxing preventing you from going from a low-privileged to a privileged process.

The permissions model preventing unauthorized camera access in the first place.

The kernel hardening to stop you from poking at the co-processor registers.

etc. etc.

If all those things have failed, the last thing to at least give you a chance of noticing the compromise, that's that LED. And that's why it stays on for 3 seconds, all to increase the chances of you noticing something is off. But things had to have gone pretty sideways before that particular hail-mary kicks in.

[1] https://www.businessinsider.com/lenovo-thinkshutter-laptops-...

https://support.apple.com/en-us/102177

- The LED is in parallel, but with the sensor voltage supply, not the chip

- Camera sensor idle voltage = low voltage for the LED (be it with stepping if needed)

- Camera sensor active voltage = high voltage for the LED (again, stepping if needed)

- little capacitor that holds enough charge to run the LED for ~3 seconds after camera goes back to idle voltage.

Good luck hacking that :)

If the LEDs come from a different supplier one day, who is going to make sure they're still within the spec for staying on for 3 seconds?

(And yes, I have long since parted ways with Apple)

Edit:

And to add on: That capacitor needs time to charge so now the LED doesn't actually come on when the sensor comes on, it's slightly delayed!

Agreed, however, that the LED should be controlled by the camera sensor idle vs. active voltage.

You'll pardon us all if we don't really believe you, because a)there's no way for any of us to verify this and b)Apple lied about it before, claiming the LED was hard-wired in blah blah same thing, except it turned out it was software controlled by the camera module's firmware.

The LED being "hard-wired" is a tricky statement to make, and I actually wasn't aware Apple has publicly ever made a statement to that effect. What I can say is that relying on the dedicated LED or "sensor array active" signal some camera sensors provide, while technically hard-wired in the sense there is no firmware driving it, is not foolproof.

Source?

If you successfully compromise the host OS and also the secure enclave firmware, that might be enough to let you turn on the camera (without vsync) and reconstruct the correct image via later analysis... but at that point you have committed tens of millions to the hack (so you'd better not overuse it or it'll get noticed & patched).

> no firmware is involved in enforcing the LED stay on for 3 seconds after a single frame is captured.

https://news.ycombinator.com/item?id=42260379

Maybe enable a pre-charged capacitor to the LED whenever the circuit is activated? A "minimum duty cycle" for the LED might help solve this.

I think it's simpler to assume that most devices can be hacked and the LED indicator isn't infailable than to always keep in mind which device lines are supposed to be safe and which ones aren't.

https://www.tomsguide.com/phones/iphones/iphone-16s-a18-chip...

https://mastodon.social/@_inside/112552696723119626

The LED should be connected to camera's power, or maybe camera's "enable" signal. It should not be operable via any firmware in any way.

The led also has to be connected through a one-shot trigger (a transistor + a capacitor) so that it would light up, say, for at least 500 ms no matter how short the input pulse is. This would prevent making single shots hard to notice.

Doing that, of course, would incur a few cents more in BOM, and quite a bit more in being paranoid, well, I mean, customer-centric.

My current notebook, manufactured in 2023, has very thin bar on top of screen with camera, so I need a thin, U-like attachment for the switch, which is hard to find.

[1]: https://www.printables.com/model/2479-webcam-cover-slider

There is no physical microphone cover there, is it ?

And yeah, if they had access to my webcam, they would just see a guy staring into the screen or walking back and forth in the room.

Nobody who is themselves sane is going to judge another for random crap they say when they think themselves alone.

Also, loudspeakers can act as microphones, too.

In other words, paranoia gets exhausting in modern times.

(And my smartphone has a replacable battery for that reason to at least sometimes enjoy potentially surveillance free time)

I've been using it daily for 3 years for watching movies and main notebook while traveling.

It's not at all abandonware or e-waste.

No shit. How is the current state btw?

I suppose still not ready to be a daily driver to replace my normal phone?

I'd say that depends on your definition of daily driver and/or how much compromises you're willing to take. I occasionally see members at my larger hackerspace running around with those or other seemingly "unfit" hardware and not complain too much about it ;)

As for phone feature, reliability of that depends on reliability of firmware of the modem, which was always shaky.

Apart from the inconvenience it was somehow liberating knowing there is no microphone physically active.

You can also use an LED as a light sensor.

and I also came across a YT vid of a console that used a piezo electric speaker for motion sensing.

I wonder if you could use a track pad to pick up sound.

So a webcam hack that lets them watch my 16 year old daughter study would also let them watch her sleeping, getting dressed, and making out with her boyfriend.

My laptop is in my bedroom in winter, right now, because it's one of the smallest rooms and I can heat it easily. I use it in other parts of the house in the other seasons. I do have a sliding cover on the camera. I bought it years ago. The main issue is the microphone.

The other explanation is one of your contacts who were part of the conversation did things that either directly related to thing X, which you spoke about, or something the algorithm see other people do that relates to X, and you got shown ads based on your affiliation to this person.

I've also worked at FAANG and never seen proof to such claims anywhere in the code, and with the amount of people working there who care about these issues deeply I'd expect this to leak by now, if this happens but is siloed...

People have been making claims like this since at least the early 90s, about TV then, and no one ever credibly claims to have worked on something like this. I've worked with purchased ad data and I've never seen this data or anything that implies that it exists. It seems far more likely that its a trick of memory. You ignore most ads you see, but you remember ones that relate to odd topics that interest you.

It's going to happen sooner or later and people will accept it, just like they accepted training of AI models on copyrighted works without permission, or SaaS, or AWS/PaaS, or sending all their photos to Apple/Google (for "backup").

For this to work hangouts.google.com had to not include the HTTP header to block iframing but thankfully if you make up a URL the 404 page served on that domain does not include that http header.

All phones are suspect. We should go back to only carrying pagers.

I would not be surprised if the same is true for some other manufacturers, too, but I can only speak definitely to Mac.

The issue is that lids close too closely + tightly now, and so anything more than a piece of tape winds up focusing all the pressure applied to the closed lid on that one spot in the glass, since the cover winds up holding the display slightly off the base of the laptop when in the closed position.

Not as pretty as a custom cover but cost-effective and can generally be done in under a minute with common office supplies (post-it + scissors) which has its own advantages.

Possible, I have one IPS monitor with a spot on screen where the color is pale. I had a post-it note there and I guess something bad happened when I tore it off.

I've never tried them on a matte or coated screen though.

There’s been no damage to the screen from the adhesive although occasionally I’ve had to clean the residual adhesive with 70% IPA, but nothing worse than the typical grime that most laptop monitors pick up.

Not a great laptop otherwise, but that was pretty good!

Wiring it in like this is suboptimal because this way you might never see the LED light up if a still photo is surreptitiously captured. This has been a problem before: illicit captures that happen so quickly the LED never has time to warm up.

Controlling the LED programmatically from isolated hardware like this is better, because then you can light up the LED for long enough to make it clear to the user something actually happened. Which is what Apple does -- three seconds.

The only time that isolated hardware approach is benefitial in terms of costs would be when you already have to have that microcontroller there for different reasons and the cost difference we are talking about is in the order of a few cents max.

I don't see why they should be mutually exclusive

Regardless, that's a pretty strong claim. I'd love to learn more if you have a link that can back you up!

  :00 Photobooth window open 
  :03 Camera LED lights up 
  :05 First image displayed

it sounds like Apple is doing something similar to what you suggest.

Firmware programming should require physical access, like temporarily installing a jumper, or pushing some button on the circuit board or something.

(I don't want to suggest signed images, because that's yet another face of the devil).