3

Let's assume for this question that it is possible for hackers to gain access to your iSight camera, is it possible for you to check to see if such an incident has occurred by accessing the activity logs of the device?

That being said, does your iMac even keep activity logs of your camera and if so, how does one go about accessing them?

Improve this question
1
  • 1
    Which iSight camera specifically do you think hackers have access? On which hardware? There are some very old ones that are less secure and some new ones that are highly secure.
    – bmike ♦
    Commented Nov 18, 2019 at 3:04

2 Answers 2

Reset to default
2

On recent hardware with the T2 chip and new macOS - the camera is controlled in firmware and Apple makes it clear when it's engaged.

Look for a product like MicroSnitch to let you know when recording is happening - whether it's a legitimate program or a covert one.

As long as you are on El Capitan or newer, I have seen zero cases where this isn't a solid detection mechanism.

Improve this answer
2
  • Thanks. But does your Mac store any activity files of its own?
    – Jhon Doe
    Commented Nov 18, 2019 at 4:14
  • 1
    @JhonDoe There wouldn’t be an app that monitors the system state if we could tail a simple log file, would there?
    – bmike ♦
    Commented Nov 18, 2019 at 4:38
2

You can find such information in the system log.
Enter the following command in the Terminal app:

sudo log collect --last 1d

This will create a system_logs.logarchive file in the current directory containing all log entries for the last day. Open the file with the Console app and search for "camera".

Example log events:

[guid:0x1234] Post event kCameraStreamStart
[guid:0x1234] Post event kCameraStreamStop
 Granting PID[36096] access to kTCCServiceCamera via entitlement 'com.apple.private.tcc.allow'

Then you can also search for the PID to determine which process was granted the camera access.

Improve this answer
1
  • In the search, make it case-insensitive.
    – WGroleau
    Commented Mar 9, 2021 at 21:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .