iSeeYouDisablingtheMacBookWebcamIndicatorLED.pdfVIP

?iSeeYou: Disabling the MacBook Webcam Indicator LED Matthew Brocker Johns Hopkins University Stephen Checkoway Johns Hopkins University Abstract—The ubiquitous webcam indicator LED is an important privacy feature which provides a visual cue that the camera is turned on. We describe how to disable the LED on a class of Apple internal iSight webcams used in some versions of MacBook laptops and iMac desktops. This enables video to be captured without any visual indication to the user and can be accomplished entirely in user space by an unprivileged (nonroot) application. The same technique that allows us to disable the LED, namely reprogramming the ?rmware that runs on the iSight, enables a virtual machine escape whereby malware running inside a virtual machine reprograms the camera to act as a USB Human Interface Device (HID) keyboard which executes code in the host operating system. We build two proofs-of-concept: (1) an OS X application, iSeeYou, which demonstrates capturing video with the LED disabled; and (2) a virtual machine escape that launches Terminal.app and runs shell commands. To defend against these and related threats, we build an OS X kernel extension, iSightDefender, which prohibits the modi?cation of the iSight’s ?rmware from user space. I. INTRODUCTION At the beginning of the 2008 school year, the Lower Merion School District provided a MacBook laptop to each enrolled student. These laptops came pre-loaded with the LANrev remote administration tool (RAT) which allowed school district of?cials to, among other things, capture images from the MacBooks’ built-in iSight webcam. During the following 18 months, of?cials captured more than 30 thousand images from these webcams [5, 6]. The ?rst indication that images were being captured was every time the software took a picture, the green indicator LED would brie?y illuminate [5, 6, 40]. Some teachers were so concerned by this they they covered the lens of the webcams on their own laptops [6]. Here, the ind