Hacker News Reader

Comment by voctor | Hacker News Reader

"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?

View on HN

I wish we had a physical switch that cut power to the camera and mic...

I worked on some old networking equipment a while back that had a physical fail over switch. If you opened the cover you could watch the connection switch, fun stuff. Also very effective.

The description makes it sound like Apple is using a hardware interlock that I'd assume cuts power to the microphone via a MOSFET when the lid is closed. That's pretty much the same thing, just with a solid state switch instead of a mechanical contact.

That's pretty cool.

It is pretty cool indeed, however keep in mind that's just standard component in circuits to turn signals on and off. It is just a PNP or NPN transistor. Everyone makes use of it.

To be clear too, I'm just speculating about that part. The only thing this document says is that "This disconnect is implemented in hardware alone, and therefore prevents any software, even with root or kernel privileges in macOS, and even the software on the T2 chip, from engaging the microphone when the lid is closed." That implies to me that they are using some form of physical interlock (probably a magnet and Hall-effect sensor), and that they use this to completely disable the microphone. The most obvious way to me to do that in this case would be to cut the power with a transistor, but in principle there are a number of other ways it could be achieved.

I think it makes sense to assume they have a hall-effect sensor and a MOSFET but of course maybe they combined both in a single package.

Thinking how a hall-effect sensor works, perhaps it would be possible to embed it in a wafer with some gates and you're done.

Purism laptops have hardware kill switches for camera/mic and wifi/bluetooth.

https://puri.sm/products/librem-13/

Unfortunately it has much weaker specs. No thunderbolt, only dual core CPU, slow Wi-Fi. They didn't even care enough to tell us the screen resolution, which is at least to me an important thing to know before buying.

Newer Thinkpads have a shutter to cover the camera, but mic still works when covered.

https://www.businessinsider.com/lenovo-thinkshutter-laptops-...

Yeah I got some handy shutters from some conferences, not a bad solution.

They say that "The camera is not disconnected in hardware because its field of view is completely obstructed with the lid closed."

And since the webcam in Macs electrically can't get power without also powering the green notification LED, it's impossible for malicious actors to activate the webcam silently while the lid is open.

Is that still true?

I read some time ago that the LED used to be hardware controlled, but switched to being software controlled at some point.

I wonder how long it will be until someone manages to figure out how to use image processing to read the noise seen by the camera sensor while the lid is closed and turn it into audio.

Kind of like this: http://news.mit.edu/2014/algorithm-recovers-speech-from-vibr...

That's certainly an interesting thought, but do note (from the linked article):

In some of their experiments, the researchers used a high-speed camera that captured 2,000 to 6,000 frames per second..

I haven't checked, but I would be surprised if Apple uses cameras that are capable of that as normal user-facing webcams in their laptops ...

Recovering meaningful audio signal (which usually has lots of data above 1 kHz) from the <100 Hz sampling done by a camera seems difficult, Nyquist and all, right?

From the next paragraph:

In other experiments, however, they used an ordinary digital camera. Because of a quirk in the design of most cameras’ sensors, the researchers were able to infer information about high-frequency vibrations even from video recorded at a standard 60 frames per second.

Does this mean you can't use it in a configuration with say one laptop, two external monitors, and lid closed... and still use the mic?

I don't have a Mac so maybe that isn't a valid use anyway, but I do that with PCs all the time.

I don’t think the audio quality of the mic on a closed laptop is going to be something you’d actually want. Plus it likely only applies when the machine is entering sleep?

Older MacBook Pros had their microphones on the exterior of the laptop, on the left side, so I'd imagine the sound from that would be pretty decent. Newer Macs put it inside the speaker grill, I think, so this wouldn't really work.

Nope, since the first MacBook Pro the dual-microphones have been placed in the grill, with the PowerBooks and iBooks the single microphone was placed in the left side of the display panel in a small hole.

The white/black MacBooks, I believe, placed it near the iSight camera.

The MacBook Pro I'm trying this on, a MacBook Pro (Retina, 13-inch, Early 2015), has the microphones on the left side next to the microphone jack.

The mics are on the left hand side on that model.

https://www.ifixit.com/Guide/MacBook+Pro+13-Inch+Retina+Disp...

…that's what I said?

Has this place become such a cesspit that you can't countenance the possibility I'm simply supporting your position and backing it up with evidence? Perhaps I should have added the word 'yes' as the first word.

And someone felt the need to down vote a reply simply containing evidence that proves a commenter correct? I despair sometimes.

Never knew that countenance could be used like that. TIL

It is a valid use case, and no it seems like it won't work.

TY, interesting.

Granted, I get that for security ... can't be bending the rules or it would just be the method use to circumvent it.

Also, since the mic would be covered by the lid, you probably wouldn't want to use it anyway under this scenario.

>seems like it won't work

Are you speculating here or do you have some kind of insight?

I have a T2-equipped MacBook Pro and when in clamshell mode the input monitor for the mic is dead.

Cracking it open makes it spring back to life.

So yes, the microphone is disabled in clamshell mode if connected to displays.

It is for security reasons, disconnected by hardware when the lid is closed so that not even the T2 has access to it(or any hacker trying to listen in on you). Facetime camera works however, as closed lid essentially prevents it from seeing anything anyways.

I think he is speculating, but any work around to bypass the rules related to the security chip would seem unlikely.

Or maybe we're just reading it too literally and the document actually means "when the computer is asleep" but they said "when the lid is closed", thus creating the confusion? But I guess if it's about "sleep" mode, that's too easy to bypass in software without even attacking T2...

The wording in the document is pretty strong, though. I'd speculate the same.

I wonder what determines whether or not the lid is closed.

Why you need security chip to ensure that?

So no malware can be installed to override a software based interlock. No malware can alter the contents of the T2 chip so code there cannot be changed, altered or mitigated.

The T2 chip is just an ARM CPU running a customized version of watchOS. So in theory malware could take over control of the T2 chip.

I also wonder what implications on features like the mentioned microphone disconnect that'd have. My guess is that the T2 chip which also acts as audio controller, simply doesn't forward audio signals received from the microphone to macOS if the lid is closed.

Edit: Never mind. After reading further it becomes clear that it's really disconnected in hardware:

> This disconnect is implemented in hardware alone, and therefore > prevents any software, even with root or kernel privileges in macOS, and even > the software on the T2 chip, from engaging the microphone when the lid is > closed.

To prevent nefarious software from listening in unknown to you.

Why it needs to go trough security chip?

Laptop closed -> microphone cut off does not need complex logic. It's just simple switch.

Hardware switches are more expensive and less durable.

the NSA/CIA/3LA can't backdoor a physical switch

Why not?

Do you have schematics of your laptop?

I don't think you do, it's just an additional security feature that they put in the T2 PDF for some reason.

If the trigger is mechanical it's ok, but if the trigger is electrical (and handled by some hardware) then the chip is useful.

So Bloomberg has something for a slow news day.

:) !

Because if you don't mention that you've got a hardware switch covering the mic someone will ask you why your security chip has this glaringly obvious hole in it.

I wonder how that works for the Mac Mini. I'm honestly not sure if it even has a microphone built in or not.

The Mac Mini isn't a portable, so not at all?

AFAIK it doesn't. You need to provide your own microphone.

Previous gen didn't, so I doubt the new gen does.

Very interesting indeed.

Reply on news.ycombinator.com