iSeeYou: Disabling the MacBook Webcam Indicator LED

Show simple item record

dc.contributor.author Brocker, Matthew
dc.contributor.author Checkoway, Stephen
dc.date.accessioned 2013-12-11T20:32:51Z
dc.date.available 2013-12-11T20:32:51Z
dc.date.issued 2013-12-11T20:32:51Z
dc.identifier.uri http://jhir.library.jhu.edu/handle/1774.2/36569
dc.description.abstract The ubiquitous webcam indicator LED is an important privacy feature which provides a visual cue that the camera is turned on. We describe how to disable the LED on a class of Apple internal iSight webcams used in some versions of MacBook laptops and iMac desktops. This enables video to be captured without any visual indication to the user and can be accomplished entirely in user space by an unprivileged (non- root) application. The same technique that allows us to disable the LED, namely reprogramming the firmware that runs on the iSight, enables a virtual machine escape whereby malware running inside a virtual machine reprograms the camera to act as a USB Human Interface Device (HID) keyboard which executes code in the host operating system. We build two proofs-of-concept: (1) an OS X application, iSeeYou, which demonstrates capturing video with the LED disabled; and (2) a virtual machine escape that launches Terminal.app and runs shell commands. To defend against these and related threats, we build an OS X kernel extension, iSightDefender, which prohibits the modification of the iSight’s firmware from user space. en
dc.description.provenance Submitted by Stephen Checkoway (checkoway@jhu.edu) on 2013-12-11T19:25:14Z No. of bitstreams: 1 camera.pdf: 4663933 bytes, checksum: 863e7f68ed17dbfc623ad0ceec99cdf4 (MD5) en
dc.description.provenance Approved for entry into archive by Laura Graham(lgraham@jhu.edu) on 2013-12-11T20:32:51Z (GMT) No. of bitstreams: 1 camera.pdf: 4663933 bytes, checksum: 863e7f68ed17dbfc623ad0ceec99cdf4 (MD5) en
dc.description.provenance Made available in DSpace on 2013-12-11T20:32:51Z (GMT). No. of bitstreams: 1 camera.pdf: 4663933 bytes, checksum: 863e7f68ed17dbfc623ad0ceec99cdf4 (MD5) en
dc.language.iso en_US en
dc.relation.ispartofseries Department of Computer Science, December 2013;Technical Report 13-02
dc.subject camera en
dc.subject MacBook en
dc.subject webcam en
dc.title iSeeYou: Disabling the MacBook Webcam Indicator LED en
dc.type Preprint en

Files in this item

Files Size Format Download
camera.pdf 4.663Mb application/pdf Download

This item appears in the following Collection(s)

Show simple item record