During Jacob Appelbaum’s talk about how he suspected that Apple might be colluding with the NSA to enable the agency to spy on people, he spoke about how they could take control of your cell phones, saying “They would be able to break into this phone, almost certainly, and turn on the microphone” and that the NSA builds fake cell phone towers to grab and store data. One of the things that Edward Snowden revealed was that the NSA had the capability to remotely turn on the cameras in people’s computers so that they could spy on them.
All this triggered a memory that I have been toying with the idea of writing about for some time. A little over two three years ago, my MacBook Pro started behaving oddly. The light that signified that the camera was on would come on without warning even though I was not using anything that required it. It sometimes went off on its own, at other times I would have to put the computer to sleep mode or shut it down to turn it off.
Needless to say, this was both annoying and disconcerting. I thought it may be a hardware problem since the computer was old and showing some of the quirky features that sometimes indicate a coming crash. As I was due for an upgrade, I got a MacBook Air and transferred all my old stuff to the new machine via my Time Machine backup.
I was surprised when the light problem immediately started happening on the new machine. The people at the Apple store tried wiping the disk and reinstalling the operating system but the light problem remained and they confessed themselves baffled and suggested that I contact Apple directly since it was still under warranty. So I did and explained the problem to the person whom I got on the line. After some failed attempts at trying to solve it, they transferred me to someone higher up.
The amazing thing was that I got some higher-level engineer who took a keen interest in my problem, saying that he had never heard of this before. He gave me his direct email address and phone number so that I could bypass the voicemail system, and over a period of weeks he got me to try out various things to help diagnose the problem. The main thing I had to do was to note exactly what I was doing when the light came on and report it to him and then implement whatever suggestions he offered based on that information. But we could not find a consistent identifiable trigger that caused the light to come on. Since I had to wait for the light to come on to report to him, days would sometimes go by without us communicating.
Then two things happened almost simultaneously. The light stooped appearing and when I told him after some time that the light seemed to be not coming on anymore, I got no reply and have never heard from him since. The light problem has never reappeared.
So was I being spied upon? It seems so unlikely that I was specifically targeted. I am not important enough to warrant it and not paranoid enough to feel that I am under constant observation. If it was not a hardware or software glitch that corrected itself and was actually NSA spying, I was likely just randomly selected to try out the system.
Of course, if for some reason my computer was being commandeered, then in order to keep their spying secret the NSA should also prevent the light from coming on. But I am wondering if what I experienced was an early attempt at spying before they figured out how to stop the camera light from coming on.
But whatever the reason, I now have a piece of masking tape covering the camera lens.
It wasn’t the NSA! It was the Chinese!!! At least, that’s what the FBI has been saying for years, and there’s no reason they’d lie about something like that.
Depending on exactly how it works, that may not be possible in software.
BTW, it’d be much more likely that a student would spy on you.
Teachers (especially if they collect assignments electronically) are pretty susceptible to phishing attacks, and there’s an obvious motive for wanting to get into a faculty member’s machine.
Then there’s the various other possibilities relating to non-state actors… For example, it’s not unheard-of for hackers to try and capture non-consensual porn via webcams on hacked machines.
Yea, the light might be a little tricky to turn off compared to turning the actual camera on (there’s very simple remote commands to activate cameras, you don’t need complete control of the system to do so). Low-level hackers are capable of that sort of thing, especially two years ago, but switching computers and such does suggest something more targeted. And not to make you too paranoid, but covering the camera does not stop the internal mic.
Do you have a lot of foreign contacts? Because if you were targeted it would probably be because of who you know and who they know.
Sounds pretty strange.
@#3,
Marcus, it is unlikely to be a student because in my current position I teach course for faculty and during the time this happened I was not giving grades to students.
@doublereed #5,
I would not say I have many foreign contacts. I have relatives scattered over the globe that I correspond with from time to time about family stuff. I also have friends from my college days and we keep in touch and reminisce about the past and discuss things like cricket.
Hardly the stuff that is worth spying upon …!
If there is anything that might make me a target, it is the stuff that I write on this blog which is where I express most of my political views.
As for the microphone, I have always wondered exactly where it is. It seems well-disguised.
@#4 Dunc,
If it was being hacked by non-state actors and this is a well-known phenomenon, I would have thought that the Apple engineer would have been aware of it. The fact that this intrigued him suggests that this was something out of the ordinary.
http://blog.erratasec.com/2013/12/how-to-disable-webcam-light-on-windows.html#.Uzwd6cepp94 says it is possible to diable some of the lights.
Maybe your contact was actually debugging the light-disabling code in the NSA’s spyware.
Do you have a telephone? If so, the NSA was spying on you.
Turning on phones remotely is easy to detect. Phones are designed to save every drop of charge whenever they can. Any extra activity will soon eat the battery.
“Maybe your contact was actually debugging the light-disabling code in the NSA’s spyware.”
The NSA would run such tests in their own lab. So it would have been a Chinese spy who had found the NSA backdoor. OMG!!1!!
I think it should be a law that the camera LED be wired directly to the power supply for the camera. Same for the mic. It should be impossible for software to disable these indicators.
I have yet to see an image sensor (the chip itself) that controls an activity LED. The LED, if any, is controlled by the microcontroller managing the (USB, IEEE1394) bus connection, at least on external cameras. For cameras embedded in a laptop, tablet, or phone, it could also be done this way or also managed more directly by the main processor. But in any case, there’s no hardware reason why the LED activates if and only if the camera is active. It’s just software that keeps these two things in sync, and software can fail or be subverted. A physical lens cover is a good idea if you want to be sure image capture is disabled.
Here’s an example of disabling the LED, or just making it arbitrarily blink irrespective of what the camera is actually doing:
http://www.raspberrypi-spy.co.uk/2013/05/how-to-disable-the-red-led-on-the-pi-camera-module/
Do you think it is possible that the higher-level engineer who took an interest in your problem then vanished when your light problem went away could have been working for someone other than Apple?
@Mary Jo,
The thought had never occurred to me, since I first reached him through Apple. I don’t see why he should have not been an Apple employee. As I said, I doubt that I am worthy of any deep subterfuge.