Hacker News Reader

Comment by milhous | Hacker News Reader

I thought the same as well. An LED in series with the circuit powering the CMOS sensor is all that would be needed. No amount of reprogramming is going to bypass a physical circuit.

This is disappointing, and I expect Apple will redesign the cameras because of it.

View on HN

The LED is wired up directly to light up in the opposite state of the standby signal (i.e. off control) to the camera module. However, the camera module has a programmable setting to ignore its standby pin, and the microcontroller can be programmed to do whatever it wants with the (now ignored) standby pin.

The fact the camera controller could be reprogrammed from user space and then used to emulate a keyboard or mouse and bypass security / a virtual machine particularly devious, and shows how hard it is to trust even known hardware.

It's not really the camera controller that can be reprogrammed, it's the USB controller - there is a setting that the USB controller changes in the camera chip, but there is a nontrivial amount of logic done on the USB controller.

Still, it's a very, very cool hack: they reprogram a microprocessor to send commands to another microprocessor and configure it in such a way that it enters a state where the pin that the LED is connected to is irrelevant.

> This is disappointing, and I expect Apple will redesign the cameras because of it.

The article mentions that authorities have tools to bypass the LED. I would guess that the complexity is on purpose and wasn't supposed to be used by the general public. I bet the same is true for sound.

Reply on news.ycombinator.com