8

In OS X 10.8 it is possible to log in via SSH and get access to hardware input devices like microphone and iSight camera. Thus it is possible to remotely record audio and video of other users sitting in front of the machine. I consider this a severe security issue!

How to exploit this issue

Luckily, I didn't have to face a microphone exploit yet, but this question on Stack Overflow shows a little python script which enables you to capture pictures using the iSight camera from the command line. I don't think it is much harder to capture video.

Question

One can disable the microphone using

sudo kextunload /System/Library/Extensions/AppleHDA.kext

…unfortunately this also disables all audio output.

The same applies for the iSight camera by unloading IOUSB.kext, which most certainly might break all devices connected via USB, if not even causes a kernel panic.

How can I disable the microphone and iSight camera in an iMac (late-2012) under OS X 10.8.5 without breaking other system services?

  • 1
    I think "severe security issue" is an overreaction. If someone is logged into the computer, it's generally assumed that they're allowed to access the computer. I know Linux can be configured to deny remote users access to some hardware but it's uncommon and I'm not sure if it even extends to webcams. – gabedwrds Dec 6 '13 at 17:14
3

To disable iSight and other cameras, use:

sudo kextunload /System/Library/Extensions/AppleCameraInterface.kext

(tested on 10.9)

I'm not aware of a way to disable audio input without affecting output. It's the same hardware so unloading/removing the kext probably won't work. One step you can take is to turn the input volume down to zero in your sound preferences, but of course anyone who's able to log in will be able to turn it back up.

  • 1
    Is it possible to reenable the camera when it´s deactivated once? Tried it by using "kextload", doesn´t work. – user68037 Jan 20 '14 at 11:31
2

I think you can specifically target your iSight camera by (re)moving /System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component

According to this: http://www.macosxhints.com/article.php?story=20070323094959262

The link does mention that it is 10.4 specific and I haven't tried it under 10.8/10.9 but it's a good place to start.

1

You want to check out isight-cli, which basically changes the permissions on the necessary drivers as suggested here and here.

isight-cli is based on original applescript isight-disabler.

  • Does this work with macOS Sierra? – Winterflags Sep 21 '16 at 15:01
1

An update for OSX 10.11.6

Enable/disable the camera

  1. First of all, you need to disable SIP by rebooting your mac in recovery mode (hold "Alt" key while rebooting then open the term.app and run csrutil disable and finally reboot).
  2. I'm not a huge fan of file deletion in sytem folder. Use the power of Unix by changing changing the access rights of your selected files/folders/component. (secure if you have a decent admin password).
  3. In a terminal, type the following commands for disabling the camera:

    sudo chmod a-r /System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component/Contents/MacOS/QuickTimeUSBVDCDigitizer
    sudo chmod a-r /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC
    sudo chmod a-r /System/Library/PrivateFrameworks/CoreMediaIOServices.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC
    sudo chmod a-r /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC
    sudo chmod a-r /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera
    

chmod a-r removes the read right (-r) for all groups and users (a).

  1. Launch Quicktime/PhotoBooth or any other app which uses the camera. Everything's gonna be as no webcam is installed on your mac.

Enable/disable the mic

I'm still looking for a way to disable the mic without disabling the audio output.

To be continued...

0

Unfortunately removing the Digitizer component only disables Quicktime access to the camera. Command line utilities can still gain access. Your best move is to paint over the camera lens. That is what I did.

I also painted over the microphone holes.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.