Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

https://tech.firstlook.media/macbook-air-broadcom-bcm15700a2-mystery

by jeffo_rulez • 8 years ago

227 77 8 years ago

tech.firstlook.media

In Apple's computers the web cam light cannot be disabled, because the web cam is controlled by a co-processor as demoed here. In the newer Pros with Touchbar Apple uses their own chip for this same function.

On a lot of PC webcams, you can run the camera without the light or visa versa[0].

[0] https://blog.erratasec.com/2013/12/how-to-disable-webcam-lig...

Rebelgecko• 8 years ago

Previous hacks of the iSight cam involved rewriting the firmware of that separate microcontroller. IIRC there was also a delay at one point, so that it was possible to take a picture really fast before the LED turned on.

saagarjha• 8 years ago

Of course, the T-series processors were not a thing back then…

Udo_Schmitz• 8 years ago

Concerned only pre-2009 models or earlier, needed physical access as well. AFAICR.

kabdib• 8 years ago

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know?

You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if you X-ray'd the board. I'm guessing that a similarly stealthy receiver would be noticeable due to required external discrete components (e.g., amplifiers, filter networks).

Plonking down a whole chip for "secret wifi" is likely overkill.

jws• 8 years ago

…something that didn't look too much like an antenna…

The Raspberry Pi Zero W has a perfectly serviceable antenna which is simply a cavity formed between layers of copper and two tiny capacitors which look about like grains of salt.

They are designed by some very clever Swedes. http://www.proant.se/en/news.htm

That second page shows the Raspberry Pi 3B+ whose antenna looks to be just a trace with the aforementioned grains of salt on it.

monochromatic3• 8 years ago

Antenna design is total black magic. Intuition is useless here.

shawn2• 8 years ago

The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer.

The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, you wouldn’t be able to notice anything wrong apart from a slightly reduced total bandwidth.

The value of such a tool is that it can be installed remotely, with no physical presence.

They also have all kinds of gadgets to defeat airgaps. IIRC one of them was a replacement keyboard that looks identical to the normal one, but provides the stealth wifi you mention.

One way to get an idea of what the NSA is up to is to look at their job listings. They can fake everything else, but not those.

cozzyd3• 8 years ago

Why wouldn't an organization fake their job postings to lead people astray? Like if the FSB started hiring string theorists or telekinesthetics positions to waste the NSA's time figuring out why they're doing that.

Cyph0n• 8 years ago

which operates just above the physical layer.

So at the link layer? If so, what you described does not sound like an effective technique to exfiltrate data over the internet, unless the NSA also controls the LAN/internal network the target device is on.

Why? Because any non-standard protocol data will be thrown out by the first switch or router on the path out of the target LAN. In other words, the exfiltrated data will not be forwarded on to the next router or switch, simply because the next router/switch will not have support for the NSA's custom protocol in its network stack.

fooker• 8 years ago

Do you have a source for this claim?

secfirstmd2• 8 years ago

Interesting....source?

jonhendry182• 8 years ago

" They can fake everything else, but not those."

They could hire through front companies, obfuscating the connection to the NSA.

01100011• 8 years ago

You could put the whole thing in a faraday cage and look at the emissions with a spectrum analyzer. There's probably a bunch of wide spectrum noise though, thanks to all those squarewaves running at various frequencies. If you were smart, you might try modulating one of those signals(sort of like the 'spread-spectrum' feature of many BIOSes, but with information doing the modulation and not just noise). You might be able to sneak other signals in amongst all the noise. Hell, spread spectrum signals can sit below the noise floor... I don't really think there's a way you could be 100% certain that the laptop wasn't exfiltrating data.

meredydd• 8 years ago

Transmitting radio waves with a spread-spectrum CPU clock, you say?

Here's a project to turn the Raspberry Pi into an FM radio transmitter using this exact trick:

http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspb...

cesarb• 8 years ago

You could use an already existing wire as an antenna. For instance, many cell phones use the headphone wire as the antenna to receive digital TV.

On a laptop, there are several wires long enough to be used as an antenna. For an obvious example relevant to this article, the wires for the camera.

amagumori• 8 years ago

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

cozzyd3• 8 years ago

Don't you see, they used Kali Linux which contains the specialized lspci hacker tool.

woadwarrior01• 8 years ago

I don't know if you're being sarcastic, but there's nothing specialized or Kali Linux specific about lspci. Every linux distro I've seen comes with the lspci (also, lsusb, lsmem). system_profiler on OSX is probably the closest to all of these and more, rolled into one command line tool.

dsmithatx• 8 years ago

Not sure why you were down voted. The test only showed removing the chip disabled the camera. The chip BCM15700A2 is a WLAN/Bluetooth chip used on Intel 8260 cards and lots of Dell laptops.

There is a Linux kernel driver written for this chip used for 802.11a wireless.

simcop23872• 8 years ago

Got a source for that? I can't find any references to the 15700A2 being on intel 8260 cards.

dogma1138• 8 years ago

The 15700 is a PCIe bridge and PLX chip with some signal conversion capabilities it was never even designated as a wireless chip heck we have apple’s manuals:

338S1186 1 IC,BCM15700A2,S2 PCIE CAMERA PROCESSOR U3900 CRITICAL

5 digit part numbers are Broadcom’s “IP bridge SoC” the BCM15900 on the iPAD pro for example handles the eDP connection with the screen IIRC and the digitizer function.

PhasmaFelis2• 8 years ago

As far as I can tell, the only reason they thought it was a wifi chip is that iFixit labeled it as such and it's made by Broadcom. It could conceivably have a secret wifi chip hidden inside it, but so could any other component from the battery to the USB port; there's no reason to think that they do.

monochromatic3• 8 years ago

there’s no way to conclusively prove what you suggest. This article isn’t about proving that though, it’s about “hey I wonder what this chip is for.”

teh_klev• 8 years ago

This article isn’t about proving that though

Um the article kinda is:

... so we deemed this information reliable and immediately raised some critical questions: Is there a wireless chipset soldered onto the MacBook Air’s logic board that we didn’t know about? If so, is it not actually possible to properly air gap a MacBook Air?

And their methodology is a bit flawed. This made me shudder:

We took out the Air’s logic board to see if we could pry the chip off with a screwdriver. We quickly decided this was a bad idea. We also considered “disabling” the chip by drilling a few holes through it with a Dremel tool or by melting it a bit with a soldering iron.

Jeezo.

garmaine• 8 years ago

Use an RF antenna to see if it is putting out any signal.

simcop23872• 8 years ago

This alone wouldn't be enough sure. But you can get more data to say that it isn't doing any RF by looking at the circuit board and looking for antennas, they've got some fairly distinct shapes to be able to radiate efficiently. Of course they could still be inefficient radiators on purpose to prevent them from being found, but that also then means that they'd have to be even closer to pick up the signal. You can take xrays of the board to confirm the construction matches the schematics you can find from various websites (i don't know them myself, but I know repair shops get them). You can then decap the chip to examine it for any intentional radiators, which you'd need at that scale to be able to get any signal out. All that combined with a metal case, and you're unlikely to sneak in a transmitter that way. It'd be far easier to compromise the wifi firmware which is a binary blob anyway, and just use it to dma data off main ram directly. It's already built to do it, and it's got antennas that are expected already.

Sidnicious• 8 years ago

The cable to the camera could also serve as an antenna.

userbinator• 8 years ago

We’re not sure exactly what the technicians did to remove the chip – heat gun, maybe? – but it came off cleanly and you wouldn’t notice it was missing unless you were specifically looking for it on the board.

Almost certainly, or more precisely, a "hot air rework station". For someone with experience, it only takes a few minutes to remove and replace BGAs with one.

monochromatic3• 8 years ago

And on top of that, it’s just about the only way it can be done non-destructively.

brianpan• 8 years ago

I disagree. Hold my beer...

dfox• 8 years ago

Another (and for large-ish BGAs actually better) way is IR rework station.

eigenloss• 8 years ago

As far as hardware hacking goes, this is tremendously unimpressive work. They didn't even check for PCB antennas, which would have been trivial.

It would probably take six months, minimum, of real work to actually airgap a Macbook (with any level of confidence in its security).

8bitsrule• 8 years ago

This story made me realize: I haven't seen the phrase "tin-foil hat" used much in the past couple of years. Huh.

Which reminded me of a quote:

"For a while you wondered whether the fools were pretending to be fools as some kind of deception, or whether there was a real efficient service somewhere else. Later in my fiction, I invented one. But alas the reality was the mediocrity." — Le Carre

cozzyd3• 8 years ago

The NSA can see through tin now. You must upgrade to superconducting hats.

thepangolino• 8 years ago

Shhhh. Don't tell them. http://web.archive.org/web/20100708230258/http://people.csai...

DonHopkins• 8 years ago

The great Tin Visionary Stewart Butterfield saw the writing on the wall a long time ago. Tin is in his blood, but nary a sheet of tin has rolled of his own production lines in over 30 years.

http://www.businessinsider.com/stewart-butterfield-epic-resi...

toyg• 8 years ago

David Cornwell served in MI5/MI6 in the '50s and '60s, when the game was pretty different from today. Certainly the mediocrity is still present in intelligence agencies at some level (as testified by the Manchester attack), but Snowden proved that their technical capabilities for surveillance are as good as, or even better than, a lot of people feared. This is why casually dismissing the paranoid as tinfoil-hatter is out of fashion. You will likely notice the same happening to Godwin Law right now.

jonhendry182• 8 years ago

It comes up plenty, but more in reference to people who believe in chemtrails and pizzagate.

walrus01• 8 years ago

If you really need an air gapped computer, wouldn't it make a whole lot more sense to build a desktop with some variety of ATX form factor motherboard that you can examine in detail to confirm that it has zero wireless functionality?

A Macbook Air, which is pretty much designed as a wifi-dependent network terminal, would be way down my list of hardware I would choose if I had to build an airgap lab environment.

tonyedgecombe• 8 years ago

Presumably because they wanted something portable?

bo1024• 8 years ago

I would start with a Librem laptop as this is exactly the point of them. Hopefully all you'd have to do is verify the killswitch works as advertised. disclaimer: typing on one now.

mjlee• 8 years ago

This sounded reasonable, so I ventured to the streets of New York City to seek the help of some professionals!

If the author of the article is here - I'd suggest turning to Louis Rossmann of YouTube fame:

https://www.rossmanngroup.com/

https://www.youtube.com/user/rossmanngroup

He has the equipment and skill to repair a logic board, and may have some valuable insights about failure modes of common chips on MacBooks.

Operyl• 8 years ago

Man, oh man can he ever be cynical though. At some point,l I have to believe it’s because he’s playing for the camera. Or, at least, I hope so. I’ve seen him get extremely stressed out over the silliest things.

hhh• 8 years ago

I've never had a negative interaction with Louis personally, nor has anyone I've known. A friend birthed a repair store from his videos, and Louis' personality is very bright. His comments on the style of videos that Linus Tech Tips puts out compared to his own were hilarious.

I really enjoy Louis' videos. His decision of swapping from edited video to raw streams mostly as well is quite nice. Seeing his channel grow, and every trait that he has grow with that has been an interesting process. Maybe this is because I am quite cynical as well, but I have no idea. In 2 years he has grown from 40k subs to 442k, so he's doing something right.

I think everyone can get stressed over silly things.

ryanlol• 8 years ago

https://www.youtube.com/watch?v=tw3-j_RaX74

This guy doesn't seem very bright, but perhaps that was the joke?

y04nn• 8 years ago

If you do some search you can find logic boards PCB layouts and electronic schematics on internet.

Here is a link: https://www.apple-schematic.se/

Edit: And to look at the PCB files I recommend https://openboardview.org/

carlospwk• 8 years ago

Can I just say how beautiful and usable this minimal styling and design on the website is?

madengr• 8 years ago

I suppose looking for the antenna is rocket science.

Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

Related Stories