Most people might assume that they’re safe from being surreptitiously recorded as long as their webcam LED remains unlit. After all, manufacturers implement safeguards at the firmware level to ensure that if a webcam is being used to stream or record, then its light will be on. Unfortunately, that’s only half the story.
Former NSA employee Patrick Wardle is presenting data at Thursday’s Virus Bulletin conference that demonstrates it’s possible for a nefarious party to install malware on a Mac that will monitor for legitimate webcam usage and then steal the video stream for its own purposes. Doing so would provide no visual indication of the attack, and so victims would have no reason to limit their activities accordingly, as 9to5Mac reports.
Wardle is director of research at Synack, a company that describes itself as a “global team of ethical hackers,” and his conference talk will focus on techniques being developed to monitor for such “secondary” attacks. Wardle has released a free tool that lets users know when such an attack is underway, meaning that you can end that sensitive business video conference or private conversation with your significant other and save yourself some loss of privacy or financial loss.
This isn’t Wardle’s first time at bat when it comes to discovering Mac security flaws. He discovered a method by which malware could get around Apple’s Gatekeeper security feature and inject itself into a system merely by placing code in the same folder as an authorized app. He also identified a trivial workaround that an attacker could use to leverage the Rootpipe vulnerability even on Macs updated with Apple’s patch aimed at addressing the issue.
To safeguard your Mac from attackers who might be stealing your webcam video, you can download and install Wardle’s tool, called OverSight, on any Mac running MacOS 10.10 or later. The small app will monitor the mic and webcam and let users know when a piece of malware has accessed the microphone or webcam. You can then choose to allow or block the process.
Wardle cautions that like all security tools, OverSight is not immune to circumvention by dedicated attackers. Malware running at the lowest levels of a system could possibly access the microphone and webcam without being detected by a tool such as OverSight, And so, the possibility remains that an attacker could be accessing your audio and video regardless, leaving all of us to feel just a tiny bit less secure.
