Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Security Update 2006-008 Available
- Thread starter MacRumors
- Start date
- Sort by reaction score
i guess this isnt relevant to codes like this :
http://homepage.mac.com/cancermac/dyerhaus/images/hi.mov
too bad , those freak me out , ha
http://homepage.mac.com/cancermac/dyerhaus/images/hi.mov
too bad , those freak me out , ha
I just wish Remote Desktop had the ability to view the iSight image. In a lab situation, I can already watch what they have on the screen, let me see who is sitting at it.
That's a pretty cool idea, but I think most users would find it a bit too Orwellian.
I googled a tool that does this a while ago. It has the light lit for just one second and it took a good picture. I could imagine a tool that takes your picture only when you're not actively using your computer. Imagine a screensaver that uploads the iSight input once in a while.
That should be pretty easy to do for them since the new iChat in 10.5 will have a similar functionality.
I see your point, most computer labs already have cameras, so this is just another. It is still a little creepy though to think someone could be looking at you...face on from 3 feet away.
Applied the security update and the O'Reilly page
http://www.oreillynet.com/lpt/wlg/7409
STILL captures my web cam, not an iSight. Live video, not just a still.
iChat is not running and no images on my desktop.
Using a DV Camcorder as web cam.
Not only that, but it captures the live video output of my BlackMagic video capture card when I'm not using a camera!!
http://www.oreillynet.com/lpt/wlg/7409
STILL captures my web cam, not an iSight. Live video, not just a still.
iChat is not running and no images on my desktop.
Using a DV Camcorder as web cam.
Not only that, but it captures the live video output of my BlackMagic video capture card when I'm not using a camera!!
Hehe... Scary bug.
Oh, and it's 2,7 MB on my iMac G5, and you need to restart!
My iMac doesn't have an iSight so I won't be doing this. My uptime is 16 days on the iMac and 21 days on the MacBook so I won't be doing this. I couldn't give a damn if someone watched me on my MacBook anyway. They'd see my office and that's about. Occasionally the side of my head.
My girlfriend doesn't like the black dot at the top (the actual isight) so she covered hers up with a white sticker.
The O'Reilly blog does not show the actual exploit
Hi. I'm Chris Adamson, the author of the blog you're quoting, and I want to clarify that the blog does not constitute a test of the exploit. It will continue to work even after you've applied the security patch.
The page does one thing: it shows that a Quartz Composer composition can turn on your camera. This is not a security issue in and of itself, because the image from the camera is only used locally (ie, shown in the web page). This example uses the QuickTime plug-in to put the Quartz Composer composition, saved as a QuickTime "movie", in a web page.
The actual exploit uses a second technology, QuickTime for Java, to load the Quartz Composer movie into a Java applet. Once it does this, the applet can then get the image from the camera and then upload it to a server.
Apple's security fix only disallows this combination. It prohibits "unsigned" applets (those that don't assert the identity of their authors and ask for insecure access to the system) from loading Quartz Composer compositions. Therefore, the applet cannot load the movie that turns on your camera. Note that signed applets, and full-blown double-clickable QTJ applications, are assumed to have full access to your system and thus can still load QC compositions.
So now you know. And knowing is half the battle.
--Chris
Hi. I'm Chris Adamson, the author of the blog you're quoting, and I want to clarify that the blog does not constitute a test of the exploit. It will continue to work even after you've applied the security patch.
The page does one thing: it shows that a Quartz Composer composition can turn on your camera. This is not a security issue in and of itself, because the image from the camera is only used locally (ie, shown in the web page). This example uses the QuickTime plug-in to put the Quartz Composer composition, saved as a QuickTime "movie", in a web page.
The actual exploit uses a second technology, QuickTime for Java, to load the Quartz Composer movie into a Java applet. Once it does this, the applet can then get the image from the camera and then upload it to a server.
Apple's security fix only disallows this combination. It prohibits "unsigned" applets (those that don't assert the identity of their authors and ask for insecure access to the system) from loading Quartz Composer compositions. Therefore, the applet cannot load the movie that turns on your camera. Note that signed applets, and full-blown double-clickable QTJ applications, are assumed to have full access to your system and thus can still load QC compositions.
So now you know. And knowing is half the battle.
--Chris
So now you know. And knowing is half the battle.
--Chris
GI-JOE
i had to
i hope that all of this will make apple to make OS X more secure. the bad is that some one could use this before apple has released a patch for it. but its good to se apple did do something with this one as soon as they could. the only thing that worries me of this is a security update breaking something and or not allowing OS X to properly function or boot up. but all seems good so far that apple is on top of things. i dont have a iSite but i do have a web cam.
I agree in principle. "100%" statements are NEVER true.
But....the LED is one of the last things that will fail in your computer. LEDs -- operated under proper electrical conditions -- have absurd lifespans. The electrolytic caps on your mobo will fail decades before that LED burns out.
Edit: I'm using IE7 here at work to post this....For some reason when you select text in IE7, it expands your selection to the right, and whenever I'm editing a QUOTE block it chops of the "[/" of the closing tag. This happens on *every* forum I read because they all use the same markup syntax....its so annoying. I'm constantly having to edit posts to put those two characters back in.
Hi. I'm Chris Adamson, the author of the blog you're quoting, and I want to clarify that the blog does not constitute a test of the exploit. It will continue to work even after you've applied the security patch.
The page does one thing: it shows that a Quartz Composer composition can turn on your camera. This is not a security issue in and of itself, because the image from the camera is only used locally (ie, shown in the web page). This example uses the QuickTime plug-in to put the Quartz Composer composition, saved as a QuickTime "movie", in a web page.
The actual exploit uses a second technology, QuickTime for Java, to load the Quartz Composer movie into a Java applet. Once it does this, the applet can then get the image from the camera and then upload it to a server.
Apple's security fix only disallows this combination. It prohibits "unsigned" applets (those that don't assert the identity of their authors and ask for insecure access to the system) from loading Quartz Composer compositions. Therefore, the applet cannot load the movie that turns on your camera. Note that signed applets, and full-blown double-clickable QTJ applications, are assumed to have full access to your system and thus can still load QC compositions.
So now you know. And knowing is half the battle.
--Chris
Thanks for clearing that up, Chris. I was about to, but I guess its a bit more authoritative coming from you
The first time I got problems from a security update (I assume it's the update that's doing this):
a) Computer doesn't sleep anymore; the fans keep spinning and the computer doesn't respond to anything.
b) Volume control buttons don't function anymore. The system recognizes if they're pressed (visual sign), but they don't do anything.
DAMNIT!
a) Computer doesn't sleep anymore; the fans keep spinning and the computer doesn't respond to anything.
b) Volume control buttons don't function anymore. The system recognizes if they're pressed (visual sign), but they don't do anything.
DAMNIT!
Thanks for clearing that up, Chris. I was about to, but I guess its a bit more authoritative coming from you
NP. I thought it was an interesting exploit, so I tried to duplicate it, and posted source on a new O'Reilly blog, along with a pretty exhaustive explanation.
This update really sucked. It wiped out the iSight camera off my MacBook! At first I was about to panic and everything but I had to do an SMC reset to get it back.
