Is My MacBook Pro Always Listening?

http://brianpress.heroku.com/blog/2012/01/23/is-my-macbook-pro-always-listening/

by brianshumate • 15 years ago

247 105 15 years ago

brianpress.heroku.com

kzrdude• 15 years ago

This is not a real approach at security.

Even with a "mute" checkbox, it stands to reason that a hack that grants access to the mic will also at least attempt to bypass the "mute" setting. So, without a hardware solution, there's no real way to secure the mics on these macbooks.

Personally I'm not that worried, but I can see why this could be a problem for some.

Aqua_Geek• 15 years ago

Exactly. I was going to suggest using something like Soundflower to create a fake sound input device, but at the end of the day it's still a software thing that can be overridden.

If you're really paranoid, you could always remove the mic with a soldering iron... =)

maukdaddy• 15 years ago

That's exactly what's done with cameras and microphones in high-security environments.

janus• 15 years ago

Like always, if you can't trust your machine, you should stop using it and reformat it. The only security comes with a controlled behavior in which software is installed in your computer, which websites you visit, etc.

Any software switch can be overriden by a silent hack. Besides, overhearing conversations is the least of your problems if your computer is compromised. I would worry more about documents and web browser data.

mikecane• 15 years ago

What about putting a wee piece of tape over the mic hole?

incongruity• 15 years ago

Where exactly is that? Apple does a great job of making the mic location non-obvious.

_delirium• 15 years ago

Newer MacBooks don't have a separate microphone hole anymore; the mic is now located under the left speaker grille. You'd either have to tape over the whole thing (it's a pretty big grille), or open up the machine to cover/detach the mic specifically.

samarudge• 15 years ago

Paranoia much? Surely a much better approach to security would be network monitoring, anti-virus and vigilance. This sounds like blacking out the windows because you can't be bothered to close the curtains.

If your tin-hat doesn't feel like enough protection, try downloading and installing Sound Flower (Generally cool app). Basically it lets you 'patch' one audio output on the computer to an audio input, so you could record the output of your computers speakers at near full resolution (Useful for screen-casts/video game play through and probably lots of other things). Activate Sound Flower Bed and select the option along the lines of 'no input'/'no device'. Go into system preferences and select the Sound Flower device as the default input device.

All of that is, however, completely irrelevant since applications can select audio inputs external to system preferences and record the input at whatever volume they like. (E.G. Skype can use a different input to the sys default, Logic Pro can record from all you system inputs at once etc.)

user242• 15 years ago

I'll tell you what else seems to always be listening - the camera on the MacBook Pro, even when the little green light is off.

Cover the camera with your finger or shine a flashlight/mobile phone screen into it, watch the keyboard lights react. It's obviously listening for light level changes.

I just wonder how much data you could collect from the sensor without the green light turning on?

edit: I'm wrong, see my reply to jcromartie

jcromartie• 15 years ago

If you look closely, there's actually another dot next to the camera. That's the ambient light sensor.

user242• 15 years ago

You're right. I thought that was the LED but it's not.

Well now, what am I going to do with this tin foil hat I just made?

jsilence2• 15 years ago

Not sure about this one. Fiddling a little bit, I'd rather say that there is a light sensor left of the camera. Blanking only the camera does nothing, blanking the spot just left of it triggers the backlight dimming.

Argorak• 15 years ago

To be precise: in old macbook pro versions, the sensor was in the speakers. The unibody macbook moved it next to the camera:

http://osxdaily.com/2010/05/22/where-is-the-ambient-light-se...

wladimir2• 15 years ago

Right -- I'm not sure about the MacBook, but in many cases the webcam led is software-directed, not hardware-directed. So a small change to the driver (or firmware) can make it record without enabling the led.

ugh• 15 years ago

In Macs it’s directly wired to the camera. If the camera receives power the LED also receives power.

seclorum• 15 years ago

Yeah .. umm .. and there is no guarantee that your CPU isn't broadcasting every single operation to a top-secret government satellite, either. The technology is there: have you audited your CPU today?

jsilence2• 15 years ago

Use the same laptop RMS is using and read the source. http://richard.stallman.usesthis.com/

petsos• 15 years ago

How would I verify that this source was actually used?

lloeki3• 15 years ago

Would not help against Van Eck phreaking and the likes.

kennywinker2• 15 years ago

Even if the default input device is set to "Line-In" software would be able to get the audio data from any device on the system. The NSA precautions mentioned in the article are superstitious and would likely do nothing to deter anyone who had compromised your system that badly.

eternalban2• 15 years ago

Is "superstitious" a euphemism for misinformation?

kennywinker2• 15 years ago

> Web definitions: showing ignorance of the laws of nature and faith in magic or chance.

It always means misinformation, not just today.

thinkling2• 15 years ago

When you plug a microphone device (e.g. a headphones/mic combo that comes with the iPhone) into the single audio port on a recent Macbook, it will be detected and the control panel will switch to giving you settings for "External microphone".

The internal microphone no longer shows up, suggesting it is disabled as before.

Thus, the simple plug hack should still work.

(I'm running Lion on a MBP8,1.)

Tyrannosaurs• 15 years ago

Suggesting it is disabled isn't the same as it being disabled.

Reducing the input level to zero suggests it's disabled but evidently this isn't the case.

thinkling2• 15 years ago

That's why I phrased it exactly like that. :)

I would imagine (yes, I'm speculating) that the control panel uses a standard OS interface to enumerate audio devices, and when the internal microphone drops off the list in the dialog, that reflects the fact the OS isn't offering it anymore. So an app asking the OS to enumerate audio devices would not find the internal microphone.

It's always possible that there's a lower-level hack to get around that, but then that's always been a concern.

By the way, I forgot to mention that when I turn my input level down to zero, the little blue bars stop showing any signal. The blog post is about 10.6 (Snow Leopard), as mentioned below the Control Panel snapshot. Maybe this is all fixed in 10.7 (Lion)?

derekorgan• 15 years ago

Are you suggesting that my mac book pro is sending this data to some apple server somewhere?

Can you imagine A the traffic that would take and B the amount of useless information that would be recorded. They have millions of computers!

If its not being recorded locally or sent to an external source from a privacy point of view there is no problem. Both of these would be easy to detect by looking for sound files somewhere on the device or monitoring outbound internet traffic.

So is it battery life that you have the problem with?

Karunamon2• 15 years ago

No, rather that "Hmm, this is odd, it seems there is no way to disable the mic"

I didn't read any allegations of remote recording here. Perhaps you clicked on another article by mistake?

dedward2• 15 years ago

still drinking my coffee, but the one odd part was that, on theprefs screen, with mic input all theway down, it was still regisrering audio. something is wrong there....all other arguments about security aside,

i tried this on my mid 2009 mbp, and dont get the same results... turing volume input all the way down should result in muted audio input. nevermind havkers... what if i just want it off for a sec while i say something i dont want someone to hear (mute buttons aside.... and are they working filly if rekying on the same api)

suggest trying on multiple units... and as others have said, those guidelines are just best practices, not guarantees. if you want guarantees, you dont have conversations near microphones... and sweep theroom for transmitters, assuming thats still possible. one would assume some agency with an unfathomable budget could probable fevelop some kind of ultra liw power ulta wideband bug we are nor goingto detect. or it will just record and theywill tell it to transmit later. or just pick it up... thelist goes on,

theoriginal question is valid though, i would like to know that, absentmalicious intent, when my mic is muted its muted, and inthe samevein, that the camera light is an absolute indicator of activity.

when i get around to buying a new mac (or something) which shoukd besoon, ill be doing someexploratory surgery n this one i think.

abnoid• 15 years ago

This does not happen with my early 2011 13" mbp.

mchanson• 15 years ago

This article is without merit. The author's logic train derails shortly after leaving the station.

Without removing the hardware there is no way to prevent someone with remote root access from recording audio from any input regardless of settings. This is true of any machine that has audio inputs and drivers loaded for those devices.

dkissell• 15 years ago

Agreed, I would also urge the author to look for more accredited sources to fuel his infosec paranoia than GQ magazine. David Kusher certainly earned his pay that month.

ddagradi4• 15 years ago

He even gets basic facts incorrect. The author assumes his Macbook Pro doesn't have a dedicated audio input. It does. Every Macbook Pro does. (The Macbook Air is the only Mac shipping without a built-in audio input).

Really, what I see is a software update that fixes a user interface bug. System Preferences no longer offers disconnected audio inputs as a selectable option, because it's just plain smarter that way. Could there any possible confusion for an average user between "Internal Microphone - Built In" and "Line In - Audio Line In" when looking at their sound input options? Seems like a design decision made in the interest of removing irrelevant choices.

mickael1• 15 years ago

The 13 inch Macbook Pro, just like the Air, does not have a dedicated audio input. It's one of those mobile phone headphone/microphone combo jacks.

dedward2• 15 years ago

so despiteall that, when you are using the prefs screen and turn the input volume theway cown, it should not register any input right? Thenwhy does it? thas not nothing.

jamii• 15 years ago

A nice intermediate step is to attach a small light directly to the mic/camera, so that the light is on whenever they are being used.

joshzayin• 15 years ago

They already do this for the camera, though I'm not sure if it's hardware or software.

nthnclrk• 15 years ago

Without further investigation, I pose a potentially naive question:

What evidence is there that this behaviour of the internal mic is the same when the Audio preferences pane is not open?

Could it be that the mic is automatically made 'live' when system preferences or that particular pref pane is opened?

bradleyland6• 15 years ago

Even if that's the case, it's not really relevant. If the concern is that an attacker will listen your mic, the only 100% solution is to physically extricate the mic from your laptop. If an attacker is able to install software (with administrative privilege) on your computer, they can do anything you can do, including re-configure your audio devices and mic volume levels.

jrockway2• 15 years ago

If you are really worried about this, I recommend surgery. I used to have this Windows box at work that would always make sounds for no reason, even though the sound was muted. The solution was to open it up and physically disconnect the speaker. Never made a sound again.

If you don't want your computer to be used as a listening device, first try adjusting your tinfoil hat. If you're still worried, open it up and remove the speakers and microphones. Make sure you get them all! Though I'm sure someone can figure out how to make a hard drive into a microphone, so you'd better replace that with an SSD. Also get the camera while you're in there.

There. Now you just have to worry about the bugs the Agents put all over your house.

finnw• 15 years ago

> There. Now you just have to worry about the bugs the Agents put all over your house.

Physical bugs are expensive. Malware is cheap.

waqf• 15 years ago

Particularly in terms of cost to deploy.

bradleyland6• 15 years ago

If you're after a specific individual, a far better target than their computer would be their cell phone. Computers are complex and stationary. Cell phones are eminently more susceptible to this type of attack because the government can compel carriers to use technology that is already in place. No malware package required.

Working in telecom was enlightening for me. There's a feature called "executive barge in" that pops up from time to time when shopping for PBX systems. Executive barge in allows a user with the appropriate rights to open an audio channel to any phone connected to the switch, bypassing the alerting phase. That is to say, the phone never rings; the audio channel just opens. Most systems provide some sort of brief alert tone, but this is entirely implementation based. There's nothing implicit about opening a channel that would require a tone.

All digital phone systems have the ability to implement a feature like this. Cell phones are digital phones. With old analog (POTS) phones, when the phone was "on hook", there was a physical change in the connection of the copper pairs. In modern phone systems on-hook/off-hook is just a software state. There is no physical difference. Opening an audio channel is a distinct event, completely separate from the alerting signal [1] in common cell phone protocols.

The bottom line is that if you're really concerned that someone is listening in, you should watch the horrible movie "RED" and imitate John Malkovich's character the best you can.

http://www.scribd.com/doc/54495209/UMTS-3G-WCDMA-Call-Flows

ridruejo• 15 years ago

Well, the article reminds me of the "Webcam" short film. It is not so much about covert NSA agents taking over your computer as targeted malware... http://www.youtube.com/watch?v=i841CamEX3o

sequoia• 15 years ago

Amazing; I wonder how the webcam allowed him entry to the building and her apartment (which of course could not have happened without the webcam). I'm as tinfoily as the next guy, I have my webcam covered with a post-it, and I think the issue is serious and people should be more aware, but this video makes alarmist, overreaching leaps to conclude "use a webcam -> get raped" which is precisely what the video suggests.

batista• 15 years ago

If you are really worried about this, I recommend surgery.

Me too -but in a more literal way.

Sorry for the downvotable comment, but cannot resist a pun, especially when it kinda makes my actual point.

The thing is, whether the MBP is "always listening" or not is of little consequence, in an age when we know that governments look into the wires, have taps into ISPs and can listen to any and all mobile phone conversation.

Btw, my iMac 27" 2009, doesn't seem to register any sound with the internal mic set to the minimum volume. And there's also the "Audio MIDI setup" program, where you can disable it completely.

marchdown• 15 years ago

They can eavesdrop on encrypted mobile phone connections? Do you have a solid source on that?

beambot• 15 years ago

Actually... some ceramic capacitors are piezoelectric [1] and thus could (conceivably) be used as low-fidelity audio sensors. Better rip out all the capacitors too -- just in case. ;-)

That would be one crazy covert communications channel. Wonder if there are any security papers exploring that...?

[1] http://www.kemet.com/kemet/web/homepage/kfbk3.nsf/vaFeedback...

jrockway2• 15 years ago

Yes, true. Pretty much any passive device can pick up sound. Two wires running next to each other is enough. A "microphone" is just a particularly well-engineered sound collection device.

stcredzero3• 15 years ago

If you are really worried about this, I recommend surgery.

There might be a Kickstarter product in this. Simply devise a magnetic activation switch for the microphone. I've opened up multiple 13" Macbook Pro laptops, so I know how little space is in that corner where the microphone and magsafe socket board is, but there is enough.

Perhaps even better: a microphone that has a deactivation pin which can be pulled with a pair of tweezers. A service would solder this in place for you, and the laptop could be used with no internal microphone. Then, when it was time for you to sell the laptop, you simply open the case and pull the pin out of the back of the microphone, reactivating it. You could even construct this out of the same microphone element as used in the macbook. Just have the pin short across the mic capsule's terminals.

jordan0day• 15 years ago

Eh, you're a little to glib here. This sort of dismissive (and imo shortsighted) response is a problem.

Let's say it's 2003 and instead of being a post about laptop internal microphones, it's about SQL injection vulnerabilities in [your favorite blogging engine]. The quick & easy response is "Oh, go adjust your tinfoil hat, do you really think you're important enough for the hackers to focus on? And if they do, don't you think they could do a little more than rely on a silly SQL injection vulnerability?"

But we know the problem with SQL injection vulnerabilities usually aren't focused hacker attacks, it's fire-and-forget script kiddie exploits that most of us have to worry about. This is no different. Not too many folks are worried about "the Agents" surreptitiously monitoring their laptop's microphone, it's some bored 14-year-old with time on his hands and an easy-to-use exploit tool.

Terc• 15 years ago

Finding a single regression in a defense in depth strategy does not an exploit make. Software can select whichever input it wants, regardless of whatever settings you may have set. This is one of many things that are simply a best effort to protect the computer. Root access or even access as an Administrative user could bypass this setting easily.

bradleyland6• 15 years ago

Changing your sound configuration is useless against anyone who has obtained admin rights on your operating system. Windows, Linux, Mac, or otherwise. If they have root/admin, they can override any setting you change at the most basic levels.

If you're still OCD and concerned about it, install Soundflower [1] and you can easily configure Soundflower as your default input, but not feed anything on to the Soundflower bus, thus making the default input silence. This is, in effect, the same as the author's suggestion of setting the default input to line-in and plugging in a stub; also pointless, as a line-in jack has no ability to convert acoustic wave forms to electrical signals.

I feel less-smart for even addressing this question.

http://cycling74.com/products/soundflower/

unwind• 15 years ago

I understood is as the stub was plugged into the input to avoid having the input automatically ignored due to not having a device connected.

I don't know (no experience) if Macs' analog ports were this clever, but considering the hardware to detect presence in the port is trivial, it wouldn't surprise me so that's how I interpreted it.

bradleyland6• 15 years ago

I've seen a lot of Windows hardware drivers that do this. They detect when you've plugged a device in to an audio port and change the config to accommodate. OS X doesn't do this. If you configure Line In as the default input, the OS will monitor that port, regardless of its state. The only adjustment OS X makes is to remember input volumes based on plug state. So for example, if you plug in a set of headphones, the volume will be adjusted to the level that was set when headphones were last plugged in. When you unplug, the volume level is reverted to the state it was in prior to plugging in headphones.

doomlaser• 15 years ago

Beat me to it. Though I find the tone of this article incredibly overparanoid.

I'll also link along http://roguemaobea.com. They produce a line of audio apps that can hijack and route sound in OS X for a range of actually useful purposes. They've got tools for doing timed recordings of system audio, Line in audio, or audio from specific apps, as well as a tool for broadcasting any of these audio sources to Apple's Airport Express.

JonnieCache2• 15 years ago

I'd just like to chime in with another vote for soundflower. It's useful for any number of things, I have recently used it to pass youtube videos through VST plugins to clean up the audio, and to make Cave Story, a somewhat old game, work with my external soundcard. You can also use it as an alternative to those ripoff "record your audio output" programs.

It is made by the fine people who produced Max/MSP.

jwr• 15 years ago

Every microphone in every powered device must be considered as listening if you are serious about security at all.

So what if the panel actually even disabled the mic preamp on the board? You could have a program/virus/trojan that silently re-enabled it behind your back, without you knowing. So I'd say this is nothing to be concerned about, because every device you own potentially "listens" with its microphones all the time.

The advice with plugging a jack into the line-in port is good -- if you're sure your hardware hasn't been tampered with, this should physically disconnect the microphone.

Obviously if you're really worried about your computer listening, you should rip it open and physically cut the microphone connection.

lloeki3• 15 years ago

> "if you're sure your hardware hasn't been tampered with, this should physically disconnect the microphone."

Why so? Most soundcards merely detect an impedance change and flick a bit to switch from internal microphone to line-in but you can have full control of that bit by software. That's actually what the prefpane does: even with something plugged in the line in, one can switch back to the internal microphone as a source. (EDIT: apparently it goes hidden on new hardware revisions but the functionality is there, just boot into Linux and do some poking on the soundcard to see what's really available)

calloc• 15 years ago

You can still insert a barrel jack, this time with 4 rings instead of 3 at which point the microphone is disabled.

For example, Apple headphones for your iPhone can be plugged in and used for that purpose...

kgo• 15 years ago

I believe the LED that tells you your MacBook's camera is on is hard-wired into the motherboard, for the very purpose of making it impossible to covertly enable the camera via software. A similar approach could be used for a mic.

mrgordon• 15 years ago

This is not true. The software Prey (which is designed to spy on people who have computers that have been stolen) takes covert photos and sends them without activating the light.

Schwolop• 15 years ago

And if you're really really worried, you should rip out the speakers too. Just in case someone's wired them up to work in reverse...

lloeki3• 15 years ago

Actually I don't think it is listening at all when not in use. In fact the sound card even powers itself down when not in use, which can actually be heard in some cases (with some badly shielded/grounded HP for example). It's on when the prefpane is shown for the purpose of displaying that VU meter but as soon as you quit the prefpane, the hardware turns off. And as soon as an app opens it, it turns back on.

Even then, let's assume the sound card is always on (like my old SB16):

- what would listen to it if it was on? necessarily some code, or else it just goes straight to /dev/null.

- so if it's external code injected by a malicious guy, what prevents him from setting it back to internal (and setting it back to line-in when you're looking)? Or craft all sorts of drivers hooking into or replacing AppleHDA.kext or whatever?

- but if it's not external code it has to be internal (i.e Apple provided), so what would prevent Apple to simply tell you it's off when it would not actually be?

- and since line-in disappeared but the (HDA or whatever) sound chip certainly still has this functionality, what would prevent Apple from having a second microphone plugged into that line-in, completely hidden and uncontrollable?

Now Poe's Law kicks in and I can hear headlines already "Apple removed the line-in on purpose to spy on us!"

JoachimSchipper• 15 years ago

Cell phones are badly-secured always-on tracking devices with built-in microphones designed to communicate potentially sensitive data over known-insecure networks. (Start at https://en.wikipedia.org/wiki/Phone_hacking.) Why are we worrying about MacBooks again?

nodata• 15 years ago

Just because there is something worse to worry about, doesn't mean you should forget about everything else.

brianshumate• 15 years ago

Wow, a lot of pretty serious comments for what I consider to be a completely tongue-in-cheek post that is essentially asking a simple question.

Some of you people need to lighten up.

Besides, my favorite hat is made of copper! ;P

droithomme• 15 years ago

I've deleted kernel extensions to deal with related issues before. They often get reinstalled after updates though, so it can be quite a hassle.

sjs• 15 years ago

> especially the average Mac user to secure their machine’s audio input in the first place.

The average user of any machine doesn't need to worry about this. Much ado about nothing.

joejohnson• 15 years ago

This behavior is not present in OS X 10.7. However, as many people have pointed out, it is foolish to trust the display shown in System Preferences if you are really paranoid about security.

mrdingle• 15 years ago

Though this is a bit foil-hat for most people it can be a real privacy concern. Can your mac be used to secretly spy on you? Absolutely. Has apple done this before to their customers? 100% (and so have others) see carrier IQ: http://en.wikipedia.org/wiki/CarrierIQ

If something like this bothers you theres no reason you should be using any closed source software at all.

It's that easy. If you're concerned about your privacy and system integrity don't use any software from a source you don't personally trust and that can't be reviewed by a third party.

mirkules• 15 years ago

Isn't there a non-destructive low-tech solution, like placing a piece of foam tape over the microphone to block audio?

tlb• 15 years ago

Reducing the volume in the control panel doesn't add security. Microphone input volume is settable from user level without special permissions, so any software that was going to listen can control the volume.

p0wn3d• 15 years ago

Does the same apply to a webcam on a laptop without an indicator light?

stcredzero3• 15 years ago

Apple should put an activation indicator LED shining through micro-holes like the power light is, next to the microphone which is hardwired to a tiny relay, such that the microphone is physically disconnected unless the LED is on.

ladino• 15 years ago

currently down.. > read it here: http://webcache.googleusercontent.com/search?q=cache:brianpr...

ever thought about the camera or your mobile phone? ;)

mbell• 15 years ago

He should throw out his keyboard too: http://vimeo.com/2007855

marcamillion• 15 years ago

I tested mine and turning it down seems to work.

smoody• 15 years ago

If you hook something like this to the macbook, do you get the option of selecting an external mic?

http://www.amazon.com/Logitech-3-5mm-Jack-Audio-Adapter/dp/B...

Is My MacBook Pro Always Listening?

Related Stories