Forgot your password?
typodupeerror
Security Businesses Apple

Apple Closes iSight Security Hole 213

Posted by CmdrTaco
from the nobody-wants-to-see-me-naked dept.
Gruber Duckie writes "Apple's security update 2006-008, posted yesterday, is a little more interesting than it sounds. According to information (and a demo!) posted at Macslash the "information leak" mentioned in Apple's advisory actually makes it possible for a web site to send whatever your (isight) web cam sees up to the server. I'm glad they fixed this quickly."
This discussion has been archived. No new comments can be posted.

Apple Closes iSight Security Hole

Comments Filter:
  • by Billosaur (927319) * <wgrother@optonlin[ ]et ['e.n' in gap]> on Wednesday December 20, 2006 @10:24AM (#17312036) Journal

    Or cleverly disguised attempt to monitor people by the Department of Homeland Security? You be the judge!

    • by D-Cypell (446534) on Wednesday December 20, 2006 @10:37AM (#17312188)
      You be the judge!

      Can I be the clandestine military tribunal?
    • Re:Security Hole? (Score:5, Interesting)

      by TheRaven64 (641858) on Wednesday December 20, 2006 @10:46AM (#17312298) Journal

      In his book, 1984, George Orwell proposed the idea of television screens that also acted as camera and allowed a remote viewer to monitor whatever was going on in front of them.

      In the year 1984, Apple Computers released an advert for the first Mac with the slogan 'Why 1984 won't be like 1984.'

      In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

      • by peragrin (659227)
        I believe it's apple but it could be another company but someone has a patent for inserting a photo receptor along side of LCD color pixels.

        by using software to combine the image the screen could literally be the camera.

        Good for video conferencing, useful for general security(bars and vegas could suddenly have more camera's at various angles at their disposal), totally 1984.

      • Re: (Score:2, Funny)

        by Billosaur (927319) *

        In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

        And in the year 2011, iMacs and iPods will join together in a cyber-network to battle the ultra-powerful PS3 collective. Oops... you weren't supposed to know about that...

        • by geobeck (924637)

          And in the year 2011, iMacs and iPods will join together in a cyber-network to battle the ultra-powerful PS3 collective.

          "Those helmets weren't designed to handle this level of rock'n'roll!" -PS3 (Plankton, Sheldon the Third)

          C'mon, we all know the iPods will win with music, right?

      • Tape War (Score:5, Funny)

        by bill_mcgonigle (4333) * on Wednesday December 20, 2006 @12:21PM (#17313598) Homepage Journal
        In the year 2005, Apple Computers released the new iMac, a device with a display screen and integrated camera which allowed a remote viewer to monitor whatever was going on in front of it.

        Your Orwellian society is defeated by a piece of tape.
        • by Yvan256 (722131)
          Your Orwellian society is defeated by a piece of tape.
          And some CD DRM is defeated by a Sharpie marker.

          Isn't technology great? In the future, Red Green [redgreen.com] is going to rule the world!
        • Re: (Score:3, Informative)

          by rahrens (939941)
          Once they get the camera pixel patent into production, and the entire screen surface is the camera lens, that won't work! (unless you just don't wanna watch TV!)
    • Re: (Score:3, Funny)

      by forkazoo (138186)
      Or cleverly disguised attempt to monitor people by the Department of Homeland Security? You be the judge!


      I dunno about DHS, but I do know that this report has made me cancel the Christmas orders I had placed for Mac Laptops to give to hot chicks...
  • by Timesprout (579035) on Wednesday December 20, 2006 @10:26AM (#17312058)
    A fat sweaty bearded geek sitting in his parents basement scoffing pizza and jolt while on a raid with his guild is a security issue how exactly?
  • by elrous0 (869638) * on Wednesday December 20, 2006 @10:29AM (#17312090)
    They didn't update QUITE fast enough. I've already seen you in your underwear.

    It's not a pretty sight, folks.

    -Eric

  • by 8127972 (73495) on Wednesday December 20, 2006 @10:30AM (#17312096)
    ..... Able to see cute college co-eds prancing around in their dorms half (of if we're lucky, totally) naked.
    • Wrong demographic for Mac...if you wanted to see male liberal arts majors with rectangular-lensed glasses watch Futurama reruns on bean-bag chairs I think you'd be happier.
    • by 99BottlesOfBeerInMyF (813746) on Wednesday December 20, 2006 @12:21PM (#17313602)

      One day I wandered into the closest Apple store and was playing with the latest version of OS X to see if I wanted to upgrade. They all had internet connections and isight cameras and I thought it would be fun to play with them. So I made up a new ichat account and added a few people I knew at the time with a camera on their system to the buddy list to see if they were online. The person available just happened to be a cute college co-ed dating one of my buddies. She's one of those skinny little redheads guys always seem to fall for. Anyway, after I got to try out the video chat feature I took off and thought no more about it.

      The next time I talked to her she told me I had brought her a lot of entertainment and some embarrassment. It seems people in the store also wanted to try out the video chat, and since there was an account set up with her on the list, they kept sending her chat requests. This was the entertaining part. The embarrassing part was the first time someone did that, she assumed it was me again, and was not quite fully dressed at the time. She said the guy seemed pretty shocked, but nice enough after she jumped out of the camera's line of sight and pulled on a robe.

      • by TheLink (130905)
        So she doesn't mind you seeing her "not quite fully dressed"?

        Hmmm...
        • So she doesn't mind you seeing her "not quite fully dressed"?

          Not everyone is a prude :) Besides, I'm living with her old roommate, who is cuter yet, which puts me in the "safe" category as far as most women are concerned.

      • Re: (Score:3, Funny)

        by Woy (606550)
        ... Looking back, most industry executives agreed that the singular moment that propelled Apple to its current 97% marketshare was a lone post on what was then just another Internet forum, and not the brain center for the world government it is today: "The post from '99 [99BottlesOfBeerInMyF] really just got things started," says Steve Jobs, "Up until then we were kind of sitting around wondering how to sell all those shiny computers. We knew about girls and cameras, but we didn't think of putting the two t
  • I personally am disappointed. Imagine the YouTube videos that would have been possible with just a month's worth of such video. I mean, yes, 90% of it would be unshowered nerds with bad posture, but that 10% would have been gold!
  • Darn. (Score:5, Funny)

    by Grendel Drago (41496) on Wednesday December 20, 2006 @10:36AM (#17312168) Homepage
    And Mac users are lithe, sexy art types, too. I know, because the ads tell me so.
  • by Jah-Wren Ryel (80510) on Wednesday December 20, 2006 @10:43AM (#17312256)
    There are a few websites out there that will tell you your IP address, browser type, OS type and even guess at your general geographic location based on things your browser tells it. Some of these sites do it to "shock" people into realizing they are NOT anonymous on the net.

    What a great enhancement it would be for such websites to display a picture of the user at his computer! "We know you use a Mac, Live in California and Look like THIS!" Just one visit such a site would go a LONG way to instilling a useful level of caution.
    • You can still do this [oreillynet.com].
      • Oops, no, you can't - I just went and plugged in the webcam to check. Seems that any and all QCs that use the 'video input' or 'audio input' are now "unsafe, and cannot be viewed in WebKit", though you only get that warning when linking straight to the .qtz. Well, that's no fun!

        You know, people can get audio and video through the Flash player too and nobody's gone hogshit.
      • by Firehed (942385)
        That freaked me out when it came up in MacHeist. It continues to freak be out because it's not blocked by my freshly installed NoScript extension.
  • by UnknowingFool (672806) on Wednesday December 20, 2006 @10:44AM (#17312264)

    [Stops dancing wildly in front of computer]
    Nobody saw that, right?

    • by Lars T. (470328)

      [Stops dancing wildly in front of computer]
      Nobody saw that, right?

      No, but we felt the earth move.
  • Am I the only one (Score:5, Interesting)

    by LittleBunny (1021415) on Wednesday December 20, 2006 @10:48AM (#17312328)
    Am I the only one who wishes that the laptops with the built-in iSight had a way to manually close the shutter, like the standalone iSight? I always keep mine closed when I'm not using it, but the lack of such a shutter on the laptops makes me profoundly uncomfortable at the thought of owning one. Maybe this sort of thing will serve as a wakeup call?
    • Re: (Score:3, Funny)

      by Orthodork (975038)
      Duct tape will manually close the shutter. And a tinfoil hat will keep those nasty thoughts out of your head a little better.
      • Re: (Score:2, Funny)

        by LittleBunny (1021415)
        I've tried the tinfoil hat, believe me. Multiple layers, even. It seems to have no discernable effects on nasty thoughts. But then, maybe I just haven't given it enough time.
    • by Sierran (155611)
      Heh. You're not the only one. Despite fears of being called a paranoiac, and despite assurances that the 'in use' LED would warn me, I have this nice little stuffed penguin, see...and when I place him atop my iMac, his beak fits just precisely over the camera lens.


      Now all those unscrupulous bastards at DHS need to do is realize that my cat is a) home all day and b) bribable with kibbles and I'm *screwed*.

    • by soft_guy (534437)
      There are inexpensive third party covers for the built-in iSight that stay on real well and don't damage the computer/camera.
    • And you're going to miss the honking great green "in use" light? If you can't see that while looking at the screen, I'd have your eyes checked. Mine on my Macbook Pro is actually quite distracting when it's on. Yes, I use it for IM occasionally.
  • ...move along. ;)
  • by daveschroeder (516195) * on Wednesday December 20, 2006 @10:57AM (#17312434)
    Of course, an application running on your local machine can do anything it wants. So it's not surprising that a malicious Java applet/application could, well, do malicious things.

    For those who don't know, a Quartz Composer composition saved as a QuickTime movie can display the iSight image locally. Since QuickTime movies can be embedded in web pages, you can create a movie that displays the *local* iSight image back to the person, locally. Nifty, right?

    But is interesting is that via Java hooks in QuickTime for Java, a Java applet could be used in conjunction with this Quartz Composer movie to do anything that a Java applet could instruct QuickTime to do - including take a shot of whatever is being displayed in the QuickTime movie - and then do anything else a Java applet could be designed to do - in this case, potentially send that image somewhere.

    So, this could be done on any platform with a camera, since all it is is malware running to perform a specific task.

    But what's more interesting is:

    - All Mac OS X systems will always have QuickTime, and thus always have the capability to run such a composition
    - All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)

    The ubiquitousness of iSight camera is what makes this little trick interesting. It also raises issues such as: why didn't Apple offer an option to delete the camera (especially for government/military customers, as other vendors, like Palm, do), and why didn't Apple offer a mechanical shutter for the iSight on all models?

    In any case, it's fixed with Security Update 2006-008, but a legitimate Java application, i.e., one you trust, could still do just that. Which stands to reason, of course, since code running on your machine - even if instantiated by a web page - can really do anything that you have permission to do, including delete files. That's the nature of applications.

    One other note: you can indeed disable the iSight by (re)moving: /System/Library/Extensions/Apple_iSight.kext /System/Library/QuickTime/QuickTimeUSBVDCDigitizer .component

    In sum, the reason why this is interesting is because of the ubiquitousness of the Apple iSight on Apple laptops and the fact that it's ready for use. But, someone still has to visit a malicious site and run a malicious Java applet - user interaction: the hallmark of Mac OS X vulnerabilities!
    • by galego (110613)

      - All Apple laptops have cameras that cannot be easily disabled (of course (unless the LED is burnt out) due to the way the iSight is set up electrically, the green light will always be on when in use)

      What .. just like those that save a piece of the packaging to act as a buffer between the keyboard and screen on their laptops... save a piece of tape [duct|electrical|masking] to patch that [security] hole.

      :p
    • by daveschroeder (516195) * on Wednesday December 20, 2006 @12:40PM (#17313888)
      I should also note that, for government/military customers, Apple does have a contractor that can physically disconnect the iSight and internal microphone as part of the procurement process, and meets GSA schedules and requirements for "no-camera" or "no-microphone" environments; additionally, infrared, Bluetooth, and AirPort can also be disabled. This does not void any waranties. That contractor is:

      Holmans [holmans.com]
      6201 N. Jefferson Ave
      Albuquerque, NM 887109
      Tony Greiner
      505 343 3529
      tgreiner@holmans.com

      GSA schedule GS-35F-0341N
      DOE authorized (LLNL and LANL)
      DOE "L" clearance personnel

      For individual customers, any Apple Authorized Service Provider [apple.com] can disconnect any or all of the above components, and are happy to accommodate such requests. Such requests also do not void warranties.

      Again, these components can all be disabled by software means in managed environments where physical disconnection/removal of the device(s) is not a requirement.

      I should note that this trick could technically be done any any platform with a camera: run malicious software designed to send imagery from an attached camera somewhere. But in the case of Mac OS X on Apple hardware, it becomes interesting because Apple has already done all the work to drive the camera and display within QuickTime (via Quartz Composer, the integrated camera and drivers, and so on), and then QuickTime for Java can be used via a malicious Java application or applet (which still has to be run, of course) to send images remotely. After Security Update 2006-008, a Java applet (unless it is a signed applet that is specifically allowed by the user) can no longer make such such calls to QuickTime for Java.
  • by delire (809063) on Wednesday December 20, 2006 @10:58AM (#17312440)
    Got to love the idea of using an OS whose scope of security vulnerability need to be 'leaked' to be known.

    Fsck that..
  • by Deep Fried Geekboy (807607) on Wednesday December 20, 2006 @11:07AM (#17312580)
    If Cmdr Taco had actually read the friggin' MacSlash article he links to, and scrolled down to the comments, he'd see that the 'exploit' is not fixed by this patch and what's more, doesn't send info to the server. Fer feck's sake.
    • Re: (Score:3, Informative)

      by annodomini (544503)
      And if you had read the Security Advisory [apple.com], you would have seen that the problem they were fixing was about data being sent to the server and was fixed. They did not remove quartz composer functionality from Quicktime movies, so the movies you can download that show you to yourself, possibly with some effects added, still work (and are still a little creepy), but they only display the picture locally. What they did was remove the functionality from unsigned Java applets to embed such movies, because those ap
      • by 99BottlesOfBeerInMyF (813746) on Wednesday December 20, 2006 @12:08PM (#17313450)

        What they did was remove the functionality from unsigned Java applets to embed such movies, because those applets could take the image produced by Quicktime and send it back to the server, which was a real problem.

        Yeah, too bad Sun announced yesterday [sun.com] a flaw in all their runtime environments that allows untrusted applets to access data from trusted applets. I don't think Apple has squashed that one, so there is still some potential for mischief.

  • just like flash? (Score:2, Informative)

    by zen611 (903428)
    Doesn't flash do this already? As a "feature"?
  • Sun (Score:3, Funny)

    by BenjyD (316700) on Wednesday December 20, 2006 @11:23AM (#17312836)
    I guess this kind of thing is why Sun put a mechanical lens cover on their webcams.
  • by 0100010001010011 (652467) on Wednesday December 20, 2006 @11:38AM (#17313034)
    In Soviet Russia, websites look at you!
  • by ezzewezza (84083) on Wednesday December 20, 2006 @11:50AM (#17313204)
    Just makes me think:

    It is pitch black. You are likely to be eaten by a grue.
  • /View mode (Score:3, Interesting)

    by dpbsmith (263124) on Wednesday December 20, 2006 @12:21PM (#17313610) Homepage
    Back in the late 1980s and early 1990s, Compuserve's "CB simulator," Delphi, and other services provided text-based multiway services of the kind now known as "chat."

    It was fairly common for someone to make a joking about how they were or were not dressed. A common reply was for someone else to type something like /view mode on

    and tell the group that he or she could now verify whether or not first speaker had been telling the truth. Occasionally the first speaker would be naive and gullible enough to believe it.

    Little did I know that /view mode would actually be implemented within my lifetime.
  • Some versions of SunOS had /dev/audio set with permissions that anyone could access it. So someone would just have to telnet into the computer with a non-root account and dd if=/dev/audio of=/export/home/joeschmoe/capture and get a dump of anything being said in that room.
  • Give me a break (Score:4, Insightful)

    by CODiNE (27417) on Wednesday December 20, 2006 @01:16PM (#17314356) Homepage
    So all the high rated posts I see talk about how terrible Apple's security was, 1984 comes true, blah blah blah.

    Did any of you bother to try out the exploit? I just did... know what it does? It turns on that bright green LED right next to the camera, the one that tells you when it's on. It's pretty bright and when it turns on all of the sudden, you NOTICE. It then proceeded to crash my browser. Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.

    True with proprietary software one just never knows for sure, but honestly let's see someone figure out how to take a picture or make a movie without the light coming on, THEN we can start calling Apple Big Brother. Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.
    • Re:Give me a break (Score:4, Interesting)

      by 99BottlesOfBeerInMyF (813746) on Wednesday December 20, 2006 @03:13PM (#17315874)

      So all the high rated posts I see talk about how terrible Apple's security was, 1984 comes true, blah blah blah.

      I don't see that as the character of the highly rated posts here.

      Well it may be possible that Apple carefully designed their hardware in such a way that the LED is software controlled and the camera is capable of invisibly monitoring people, there is no evidence to back those claims.

      I strongly suspect that the LED is hardwired to the camera. That would be easy to do and makes sense from a design perspective. I'd be happier, however, if Apple provided some confirmation of this, rather than leaving us all to hope that is the case.

      ... but honestly let's see someone figure out how to take a picture or make a movie without the light coming on, THEN we can start calling Apple Big Brother.

      I think that would make them lousy designers, not big brother, unless there is also evidence that they are doing something with that anti-feature. I'm not happy, however, about assuming all is well unless it can be proved otherwise. I like openness in this regard rather than relying upon obscurity.

      Honestly if that were possible then I'd dump this laptop in a heartbeat since it would require purposely designing it with that in mind.

      That's not necessarily so. It could be they bought an off the shelf component without an indicator and wanted to tie its operation to the LED, but the interface was such that you couldn't just string it inline with the power without detrimental affects. So they put them both in and tied them in firmware or software and are hoping no one will figure out that it can be bypassed. That would explain their silence on the topic, although it could just be that no one who knows has realized people want to know or have doubts. I rarely use the iSight on my laptop and I did not pay for it anyway. If I feel it is a threat a small square of metal and some electrical tape will take care of it.

  • If you check out the iSight section [apple.com] of Apple's online store, the iSight itself is nowhere to be found. I noticed this a few days ago, thinking it may just indicate an update was coming at the next MacWorld event a couple weeks from now. However, I'm starting to think this issue may well be a factor toward its seemingly sudden disappearance from Apple's website.
    • However, I'm starting to think this issue may well be a factor toward its seemingly sudden disappearance from Apple's website.

      I doubt it. I suspect that they are waiting to release a new version. They pulled it from their european stores a while ago when the new import rules went into place and have not yet started selling a compliant redesign. Since they are now built-in on all laptops and imacs, there is less demand for these and it probably just is not a priority. They could even just add them as a bu

  • by MobyDisk (75490) on Wednesday December 20, 2006 @02:37PM (#17315426) Homepage
    People who think Apple is safe by design need to take a hard look at this vulnerability.

    Description: Java applets may use QuickTime for Java to obtain the images...
    This is just like the classic Microsoft/ActiveX type of problems. They exposed a control to web pages then realized, after the fact, that the control could do things they didn't intend. It's just like how MS Office was exposed via VBScript/JScript. And just like how Firefox exposed XUL commands. So now Apple exposed native controls via Java.

    Apple's solution is the same as Microsoft's. Only "signed" applets can access this control now. The fundamental problem though, is that unsigned applets shouldn't be able to access anything outside of the standard Java classes. They need to stop making blacklists and whitelists of what controls are safe, and instead, make it so that no controls are safe.

The only thing cheaper than hardware is talk.

Working...