22

Feel free to call me crazy or paranoid, but sometimes I feel like the camera LED turns on briefly (for approximately 0.1 seconds). Maybe it's just odd reflections, or me confusing the LED for the camera itself with my peripheral vision, but it piqued my curiosity; how would I find out if some utility is turning on and off the camera very quickly to snap a picture? Is it even possible to do it that quickly? How would I diagnose this? Does something like this actually exist?

Edit: Note, yes, I do know of the existence of trojans and so on. The point of my question is: as a sysadmin-level user (advanced), how can I perform this diagnostic, hard core? Also, the question about the timing is: when the camera is turned on by any utility, is it possible to turn it on, snap a picture, and turn it off in such a small amount of time? Does the driver allow you such a quick round trip?

2
  • 3
    Could you check to see if Console.app shows any entries for when you see the led flashing? Oct 11, 2011 at 16:21
  • 1
    Mine was because Facetime was open
    – nsilva
    Feb 8, 2016 at 23:10

7 Answers 7

15

If you've ever used Photo Booth, or any other app using your built-in camera as a source, you may know that there's no way anything less than 1 second is fast enough. There is a very obvious warm-up time in order for the camera to actually warm up and provide an image. Although the problem with timing Photo Booth is that it has to open the app, draw the window, then fire up the camera somewhere in there.

As a matter of testing, I opened up Quicktime Player (Quicktime X) and let it settle down, then I hit File -> New Movie Recording. Luckily for me, the image didn't fire up right away because the built-in camera for my laptop was chosen, but I have the lid closed using an external screen also with a built-in camera.

So I changed the input source to the external camera, and pressed start on my stopwatch as soon as the green LED lit up (which was pretty much immediately). The video started displaying at about 1.5 seconds in. That's still certainly within "blink-and-you'll-miss-it" territory, but only barely.

My answer is that I'm suggesting stray light may be reflecting off of area the LED resides in, invoking an "illuminated" feeling, but that nothing may be happening in reality.

However, I don't suggest that you do nothing. Commercial vendors such as Sophos offer Antivirus products of OS X, Lion-compatible and free too in Sophos' case, and I've also used ClamXAV as a one-off scan-on-demand utility when I've had similar feelings (or when I've wanted to check a file for a windows-using friend, etc.).

Note also that OS X does have built-in spyware protection named, "XProtect", that was born out of the "MacDefender" trojan scare. TUAW has many great articles on the subject under the security tag.

6
  • 1
    A reasonable answer. I'll second the likelihood that malware was installed without you knowing, remote to none. Unix based systems don't much allow for the installation of malware without some level of user consent. I'd say if you made it a point to piss of Lulzsec, maybe, but as it stands it's likely you being paranoid.
    – user10355
    Oct 11, 2011 at 17:15
  • 1
    XProtect has been there since Snow Leopard came out. It just became better known, and Apple started updating it more frequently, because of MacDefender. See the release date on Wikipedia, or search for "File Quarantine" on this support page from apple. (Sorry, support page link wasn't working right: support.apple.com/kb/HT4581 )
    – ughoavgfhw
    Oct 11, 2011 at 21:25
  • iharder.sourceforge.net/current/macosx/imagesnap will take a picture about as quick as possible. You should check the various launchd folders: /Library/LaunchAgents/ and /Library/LaunchDaemons/ and ~/Library/LaunchAgents/ as well as launchctl list to see if anything unfamiliar appears. Don’t immediately assume unfamiliar = malware, however. Google will probably tell you what most of them are in a short amount of time.
    – TJ Luoma
    Feb 22, 2014 at 9:42
  • 'time imagesnap foo.png' reports that it takes about 2.5 seconds to record the image. The green light seemed to be on for about 1.5 seconds during that time.
    – Dave X
    May 28, 2015 at 23:59
  • @user10355 The idea that a mac running a unix based OS being safer than a windows computer is bogus - it is a fallacy. Dec 18, 2016 at 15:58
6

To answer your question, yes it is possible to turn the camera on momentarily and take snaps without the user knowing - apps like Hidden take advantage of this to protect your Mac from theft.

4
  • They also require installation. I think he's looking for malware that could have imbedded itself into his system without his knowledge.
    – user10355
    Oct 11, 2011 at 21:46
  • But there are such things as Trojan Horses...
    – Daniel
    Nov 9, 2011 at 3:27
  • @demianturner: Noted that there are generic web cam covers for sale at Amazon that are so thin that you can close the laptop. Call me paranoid, but at $5.95 it could be a wise investment.
    – Gruber
    Oct 17, 2012 at 13:06
  • @Gruber Indeed there are. I got mine from BluTac. Other people use black ElectricTape as that is nigh on invisible and comes off cleanly. If only I could find some BlackTack I wouldn't have to compromise.
    – Max Murphy
    Jan 18, 2016 at 14:33
4

Such things do exist. They are known as Trojans. However, Trojans are rare on Mac OS X, and unless you are an avid downloader of torrents or illegal material, chances are you don't have any. If you're really paranoid, Norton can check for viruses, including Trojans and Bots. As well, if you legitimately believe that your Mac is taking pictures, cover up the camera with a post-it note or something similar when it's not in use.

5
  • 3
    I need more technical information. Oct 11, 2011 at 16:03
  • 1
    +1 on this answer, I'd certainly say it's possible and if you really think the camera is being used without your approval, running a virus scan would be a good idea. Oct 11, 2011 at 16:22
  • 1
    Instead of saying +1, @Jannemans, you can click the up button to actually vote +1.
    – Daniel
    Oct 11, 2011 at 18:21
  • 1
    @StefanoBorini Like what, specifically? Oct 11, 2011 at 21:57
  • @Mahnax: I would have wanted the Mac to come with a piece of draggable plastic that would cover the camera instead of having to fiddle with post-its. And even if one covers the camera, the microphone could be secretly recording any conversations in the vicinity of the Mac.
    – Gruber
    Oct 17, 2012 at 13:03
1

Yes, it certainly is possible. That light is just a UI convenience, so that we users can feel that we know when the camera is on.

Note: My cam LED never comes on in the fashion you describe.

You can disable the camera. Use one of the NSA hardening guides found on this page. Seriously, how often do you use your camera? Just unload the drivers and see where the new error messages show up. Virus scanning is a good idea, so is a clean re-install, but perhaps better to disable the camera and see what else happens.

1

I´ve already posted this answer in this similar question but assume that it is also relevant here:

Today I stumbled across a proper publication regarding this topic: Researches from the Johns Hopkins University recently published the paper "iSeeYou: Disabling the MacBook Webcam Indicator LED", showing that they were able to deactivate the iSight status LED on older MacBooks even without root access by replacing its firmware.

It appears they were able to do so by bypassing the standby signals sent by the USB interface; thus while the LED gets the order to "standby", the camera stays on.

2
  • 3
    While the article makes for sensationalist headlines, it's of note that: "Generality of results. We stress that our main result— disabling the iSight LED — only applies to the first generation internal iSight webcams and we make no claims of security or insecurity of later models, including the most recent (renamed) FaceTime cameras."
    – user10355
    Dec 18, 2013 at 23:27
  • @cksum Sure, maybe I should have put "older MacBooks" in bold, but in general the theory that it's impossible to access the camera without lighting the LED (which is what I was somehow led to believe, too) has now been proven wrong.
    – Asmus
    Dec 18, 2013 at 23:31
0

Yes, my Mac does exactly this thing. Just now, it's looking at me with its green eye while the camera is not supposed to be on. It's not just for 0,1 second, it's more than suspicious. However LittleSnitch shows no network activity.

Both on Lion and Mountain Lion. I suppose this could be remains of some Internet Security software i have tried and uninstalled months ago.

I have killed all the 15 running apps except for Safari and the light is gone. Starting VLC, the LED has blinked for a while so this is might be the prime suspect of aforementioned case.

-3

I agree with thread owner, may be we are spying by Apple, that is not virus from "3rd".

Kasperky has been noticed this, but I really don't beleive. However, I have temporary solution is use any firewall from 3rd like as: HandOff, LitleSnitch, ... to monitor all data transfer through network deny unknow packages.

Just remember when you in network: don't beleive anything/anyone.

1
  • 1
    What evidence do you have?
    – mmmmmm
    Jun 23, 2015 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .