Toggle sidebar Toggle sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Security Update 2006-008 Available

MacRumors

MacRumors

macrumors bot
Original poster


Apple has released Security Update 2006-008 for Mac OS X 10.4.8 (client and server). The 1.8 MB update addresses a vulnerability in Quicktime for Java and Quartz Composer.

It appears as though the update fixes a vulnerability where a specially-crafted Java applet could obtain images rendered on screen by embedded QuickTime objects and upload them to the originating website. Because QuickTime can be used in conjunction with Quartz Composer, this could theoretically allow a hacker to craft a applet that could obtain an attached (or built-in) iSight camera's images. While external iSight cameras have the ability to physically close an iris and turn the camera off, built-in iSight cameras (such as on the MacBook, MacBook Pro, and iMac) can not be physically turned off.

More detailed information can be found via this tech note.
 
Article Link
https://www.macrumors.com/2006/12/19/security-update-2006-008-available/
I knew having a non-turn-offable camera would come back to haunt Apple. At least this vulnerability was fixed, but I wonder if there are other back-doors. Will MOAB find any???
 
Haha, any hacker would get a very uninteresting shot out of my built-in iSight.

It's 2.7mb on my Macbook as well.
 
This might be the only case I ever heard of where you can say "I didn't really fix the bug, but I put a bandaid on it" (over the camera lense)
 
It's my understanding that although there's no iris, there's ALSO no way--due to the electrical design of the iSight--to have the camera turned on without the green On Air light also being on. So at least you always have warning when an app is using the camera. Further clarifcations welcomed.
 
Could people read the description on Apple's website carefully and tell me if I'm totally wrong in thinking that this has nothing at all to do with iSight, and everything to do with being able to retrieve images that are being rendered on screen by Quicktime?

And is it a new policy now for Apple to provide plenty of details about the fix, even if it's being misunderstood (by me or the Macrumors adminstrator who posted this)
 
Such a little update for such a big issue🙂

Installed ok seemed to boot faster and Safari seems snappier;-)
 
nagromme said:
It's my understanding that although there's no iris, there's ALSO no way--due to the electrical design of the iSight--to have the camera turned on without the green On Air light also being on. So at least you always have warning when an app is using the camera. Further clarifcations welcomed.
Click to expand...

That is theoretically correct. Basically, that's what Steve said when he introduced the built-in version without the Iris. However, I hesitate to say 100% definitive statements like "no way". For instance, what if the LED actually burns out or looses contact? The hardware may still be sending the signal for it to turn on, but I don't know if it would be smart enough to realize that the LED isn't operating correctly and therefore the iSight shouldn't operate. In such a case, you may see the iSight work and the LED not illuminate.

I'm just hypothesizing, but trying to prove my point that its dangerous to say 100% definitive things 🙂
 
I bought my mom an iMac a month ago and she specifically asked me if something like this could happen. Mothers always know.
 
plinden said:
Could people read the description on Apple's website carefully and tell me if I'm totally wrong in thinking that this has nothing at all to do with iSight, and everything to do with being able to retrieve images that are being rendered on screen by Quicktime?
Click to expand...

You have to read into what they are saying a bit. The update is for both QuickTime AND Quartz Composer. Quartz Composer can be used to control an iSight, so when you use it in conjunction with Quicktime, you could actually write an applet on a webpage that displays your iSight imagery. Now, theoretically those images should only be viewable on your screen and not accessible to the remote web server, but the vulnerability was that Quicktime for Java could actually grab the Quartz Composer images. Thus, it could grab your iSight images.

If you have an iSight, you can go to the following website to see how Quartz Composer can control your iSight on a website. Its OReilly's site, so while I can't 100% guarantee that it doesn't contain malicious code, I think we should be pretty safe. At least, the site doesn't appear to use Quicktime for Java, which is where the vulnerability is. http://www.oreillynet.com/lpt/wlg/7409
 
You could always use White out, or a white strip of tape..

I have only "used" my iSight camera on my macbook once. Otherwise it is wasted hardware. 🙁
 
Macrumors said:


Apple has released Security Update 2006-008 for Mac OS X 10.4.8 (client and server). The 1.8 MB update addresses a vulnerability in Quicktime for Java and Quartz Composer.

It appears as though the update fixes a vulnerability where a specially-crafted Java applet could obtain images rendered on screen by embedded QuickTime objects and upload them to the originating website. Because QuickTime can be used in conjunction with Quartz Composer, this could theoretically allow a hacker to craft a applet that could obtain an attached (or built-in) iSight camera's images. While external iSight cameras have the ability to physically close an iris and turn the camera off, built-in iSight cameras (such as on the MacBook, MacBook Pro, and iMac) can not be physically turned off.
Click to expand...

In related news, it has been announced the Month of OSX Bugs will not start until January 2nd, but will still end January 31st.
 
nagromme said:
It's my understanding that although there's no iris, there's ALSO no way--due to the electrical design of the iSight--to have the camera turned on without the green On Air light also being on. So at least you always have warning when an app is using the camera. Further clarifcations welcomed.
Click to expand...

Since the camera only has to be on long enough to capture an image, it could take a still image and only be on as long as the "shutter", which might be hard to catch if you're not paying attention. One of those things where you might "think you saw it" but then convince yourself you were imagining things.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back