Slashdot Log In
Apple Closes iSight Security Hole
Posted by
CmdrTaco
on Wed Dec 20, 2006 09:22 AM
from the nobody-wants-to-see-me-naked dept.
from the nobody-wants-to-see-me-naked dept.
Gruber Duckie writes "Apple's security update 2006-008, posted yesterday, is a little more interesting than it sounds. According to information (and a demo!) posted at Macslash the "information leak" mentioned in Apple's advisory actually makes it possible for a web site to send whatever your (isight) web cam sees up to the server. I'm glad they fixed this quickly."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Security Hole? (Score:5, Funny)
Or cleverly disguised attempt to monitor people by the Department of Homeland Security? You be the judge!
Re:Security Hole? (Score:5, Funny)
Can I be the clandestine military tribunal?
Parent
Re:Security Hole? (Score:5, Interesting)
In his book, 1984, George Orwell proposed the idea of television screens that also acted as camera and allowed a remote viewer to monitor whatever was going on in front of them.
In the year 1984, Apple Computers released an advert for the first Mac with the slogan 'Why 1984 won't be like 1984.'
In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.
Parent
Tape War (Score:5, Funny)
Your Orwellian society is defeated by a piece of tape.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Funny)
Golly! I have an audience to play to?
Re:Security Hole? (Score:4, Informative)
Patch Tuesday was because of customer requests. This isn't 'competition' against patch tuesday.
Parent
Re: (Score:3, Interesting)
While what you're saying might well be true, I really don't understand the logic. If MS released patches continuously as they were completed, how would this stop major corporations from testing and deploying them on a regular cycle? Couldn't the corporation equally well still have a "patch Tuesday" where the collect all the current, undeployed patches and begin the process of testing and deploying them? All patches that became ready later than that would be processed in the next cycle. If MS released p
Re: (Score:3, Informative)
When MS releases a patch to fix one of those MS-only-new-about holes, hackers do quick diffs, etc between them and the original files to find out what exactly the hole was that MS was patching. They then write an exploit for it and rele
Re:Security Hole? (Score:4, Insightful)
You know, it's funny. The ONLY people I ever see who say "perfectly secure" or "bulletproof", are people like you. Maybe you just don't read clearly and you think Mac folks actually are saying it, or maybe you're just an AC trying to stir up discussion. So are you ignorant, or are you lying?
Parent
Re:Security Hole? (Score:4, Interesting)
So no - I heard this from an actual Apple employee that OSX is "perfectly secure".
To be honest they only people I've heard this claim from are Apple sales people and Apple employees at conventions (I work for a software developer).
Parent
Re:Security Hole? (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
I dunno about DHS, but I do know that this report has made me cancel the Christmas orders I had placed for Mac Laptops to give to hot chicks...
And images of (Score:5, Funny)
Nonsense (Score:5, Funny)
Parent
Re:And images of (Score:5, Funny)
As is well known, we users of MacOSX are all tall with athletic bodies.
Parent
Re:And images of (Score:4, Funny)
Speak for yourself.. I'm a fat sweaty geek sitting in a basement scoffing pizza and Pepsi while on a raid with his guild (WoW for OSX). No beard though, and it's my basement.
Parent
Re:And images of (Score:4, Funny)
Parent
Re:And images of (Score:5, Funny)
Parent
Re: (Score:3, Informative)
Actually, Photoshop (for the Mac) is compiled for a PPC processor. On an Intel Mac it runs through Rosetta (the PPC emulator built into OS X). For now, Photoshop users would be better served by keeping their PPC Macs.
The Beta of CS3 was released on Friday as a Universal binary.
Re: (Score:3, Informative)
Ignorance, or humor? It's so, so hard to tell. And besides, I could always boot the thing into Windows if I wanted. But by all means, don't let actual facts get in the way of your ignorance and/or joke.
Too late, Taco! (Score:4, Funny)
It's not a pretty sight, folks.
-Eric
I guess we won't be..... (Score:4, Funny)
Amusing Anecdote (Score:5, Funny)
One day I wandered into the closest Apple store and was playing with the latest version of OS X to see if I wanted to upgrade. They all had internet connections and isight cameras and I thought it would be fun to play with them. So I made up a new ichat account and added a few people I knew at the time with a camera on their system to the buddy list to see if they were online. The person available just happened to be a cute college co-ed dating one of my buddies. She's one of those skinny little redheads guys always seem to fall for. Anyway, after I got to try out the video chat feature I took off and thought no more about it.
The next time I talked to her she told me I had brought her a lot of entertainment and some embarrassment. It seems people in the store also wanted to try out the video chat, and since there was an account set up with her on the list, they kept sending her chat requests. This was the entertaining part. The embarrassing part was the first time someone did that, she assumed it was me again, and was not quite fully dressed at the time. She said the guy seemed pretty shocked, but nice enough after she jumped out of the camera's line of sight and pulled on a robe.
Parent
Re: (Score:3, Funny)
As Someone Who Doesn't Own A Mac... (Score:4, Funny)
Darn. (Score:5, Funny)
Would make for a GREAT security wake-up website (Score:5, Interesting)
What a great enhancement it would be for such websites to display a picture of the user at his computer! "We know you use a Mac, Live in California and Look like THIS!" Just one visit such a site would go a LONG way to instilling a useful level of caution.
Why didn't anybody tell me? (Score:5, Funny)
[Stops dancing wildly in front of computer]
Nobody saw that, right?
Am I the only one (Score:5, Interesting)
Re: (Score:3, Funny)
Re:Am I the only one (Score:5, Funny)
So you're using a Linux patch for your Mac vulnerability?
Parent
Why this is interesting (Score:5, Informative)
For those who don't know, a Quartz Composer composition saved as a QuickTime movie can display the iSight image locally. Since QuickTime movies can be embedded in web pages, you can create a movie that displays the *local* iSight image back to the person, locally. Nifty, right?
But is interesting is that via Java hooks in QuickTime for Java, a Java applet could be used in conjunction with this Quartz Composer movie to do anything that a Java applet could instruct QuickTime to do - including take a shot of whatever is being displayed in the QuickTime movie - and then do anything else a Java applet could be designed to do - in this case, potentially send that image somewhere.
So, this could be done on any platform with a camera, since all it is is malware running to perform a specific task.
But what's more interesting is:
- All Mac OS X systems will always have QuickTime, and thus always have the capability to run such a composition
- All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)
The ubiquitousness of iSight camera is what makes this little trick interesting. It also raises issues such as: why didn't Apple offer an option to delete the camera (especially for government/military customers, as other vendors, like Palm, do), and why didn't Apple offer a mechanical shutter for the iSight on all models?
In any case, it's fixed with Security Update 2006-008, but a legitimate Java application, i.e., one you trust, could still do just that. Which stands to reason, of course, since code running on your machine - even if instantiated by a web page - can really do anything that you have permission to do, including delete files. That's the nature of applications.
One other note: you can indeed disable the iSight by (re)moving:
In sum, the reason why this is interesting is because of the ubiquitousness of the Apple iSight on Apple laptops and the fact that it's ready for use. But, someone still has to visit a malicious site and run a malicious Java applet - user interaction: the hallmark of Mac OS X vulnerabilities!
Re:Why this is interesting (Score:5, Informative)
Holmans [holmans.com]
6201 N. Jefferson Ave
Albuquerque, NM 887109
Tony Greiner
505 343 3529
tgreiner@holmans.com
GSA schedule GS-35F-0341N
DOE authorized (LLNL and LANL)
DOE "L" clearance personnel
For individual customers, any Apple Authorized Service Provider [apple.com] can disconnect any or all of the above components, and are happy to accommodate such requests. Such requests also do not void warranties.
Again, these components can all be disabled by software means in managed environments where physical disconnection/removal of the device(s) is not a requirement.
I should note that this trick could technically be done any any platform with a camera: run malicious software designed to send imagery from an attached camera somewhere. But in the case of Mac OS X on Apple hardware, it becomes interesting because Apple has already done all the work to drive the camera and display within QuickTime (via Quartz Composer, the integrated camera and drivers, and so on), and then QuickTime for Java can be used via a malicious Java application or applet (which still has to be run, of course) to send images remotely. After Security Update 2006-008, a Java applet (unless it is a signed applet that is specifically allowed by the user) can no longer make such such calls to QuickTime for Java.
Parent
Re:Why this is interesting (Score:4, Interesting)
And actually, this has nothing to do with "integrating all (?) its OS components with the web browser". It has to do with QuickTime movies being able to be embedded in a web page, which is perfectly appropriate, and another supported feature of QuickTime, namely QuickTime for Java, being able to take instructions from a Java applet, like it was designed to do. None of these things are "bugs", but the confluence of them in this circumstance allows a malicious applet to take imagery from the camera via a Quartz Composer composition. This has ZERO to do with "integrating OS components" into the browser. This is all done via QuickTime and QuickTime for Java, which can be accessed via the browser. Oversight? Yes. Now fixed? Yes.
As for how long you think a malicious ad doing *anything* on a major network would survive, let's just say "not long". By that logic, you could make the same claim about things that install malware via browser vulnerabilities on any platform: "But what if you got this on a popular site?!?" Yeah, what if?
Parent
Re: (Score:3, Insightful)
It doesn't have to be long, that's the trick. This isn't a theoretical problem, it has actually happened multiple times with previous browser based exploits. One ad-based attack is estimated to have zombied over a million machines in the span of hours it was live for. This makes sense - ad networks serve millions of impressions per hour, and it can easily take several hours for them to r
Keep their little heads in the sand. (Score:3, Insightful)
Fsck that..
Re: (Score:3, Informative)
No security hole -- RTFrigginA (Score:3, Informative)
Re: (Score:3, Informative)
Re:No security hole -- RTFrigginA (Score:4, Informative)
What they did was remove the functionality from unsigned Java applets to embed such movies, because those applets could take the image produced by Quicktime and send it back to the server, which was a real problem.
Yeah, too bad Sun announced yesterday [sun.com] a flaw in all their runtime environments that allows untrusted applets to access data from trusted applets. I don't think Apple has squashed that one, so there is still some potential for mischief.
Parent
Sun (Score:3, Funny)
Shameful this hasn't shown up yet. (Score:5, Funny)
Closes iSight (security hole) (Score:3, Funny)
It is pitch black. You are likely to be eaten by a grue.
/View mode (Score:3, Interesting)
It was fairly common for someone to make a joking about how they were or were not dressed. A common reply was for someone else to type something like
and tell the group that he or she could now verify whether or not first speaker had been telling the truth. Occasionally the first speaker would be naive and gullible enough to believe it.
Little did I know that
Give me a break (Score:4, Insightful)
Did any of you bother to try out the exploit? I just did... know what it does? It turns on that bright green LED right next to the camera, the one that tells you when it's on. It's pretty bright and when it turns on all of the sudden, you NOTICE. It then proceeded to crash my browser. Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.
True with proprietary software one just never knows for sure, but honestly let's see someone figure out how to take a picture or make a movie without the light coming on, THEN we can start calling Apple Big Brother. Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.
Re:Give me a break (Score:4, Interesting)
So all the high rated posts I see talk about how terrible Apple's security was, 1984 comes true, blah blah blah.
I don't see that as the character of the highly rated posts here.
Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.
I strongly suspect that the LED is hardwired to the camera. That would be easy to do and makes sense from a design perspective. I'd be happier, however, if Apple provided some confirmation of this, rather than leaving us all to hope that is the case.
I think that would make them lousy designers, not big brother, unless there is also evidence that they are doing something with that anti-feature. I'm not happy, however, about assuming all is well unless it can be proved otherwise. I like openness in this regard rather than relying upon obscurity.
Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.
That's not necessarily so. It could be they bought an off the shelf component without an indicator and wanted to tie its operation to the LED, but the interface was such that you couldn't just string it inline with the power without detrimental affects. So they put them both in and tied them in firmware or software and are hoping no one will figure out that it can be bypassed. That would explain their silence on the topic, although it could just be that no one who knows has realized people want to know or have doubts. I rarely use the iSight on my laptop and I did not pay for it anyway. If I feel it is a threat a small square of metal and some electrical tape will take care of it.
Parent
Fundamental design problem (Score:3, Insightful)
Apple's solution is the same as Microsoft's. Only "signed" applets can access this control now. The fundamental problem though, is that unsigned applets shouldn't be able to access anything outside of the standard Java classes. They need to stop making blacklists and whitelists of what controls are safe, and instead, make it so that no controls are safe.
Re: (Score:3, Informative)