Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.4: Disable integrated iSight cameras System 10.4
I've been moved to action on this because of a recent NSA security document that states that it is not possible to disable the iSight cameras integrated into Apple computers without also disabling things like USB keyboards and mice. This is simply not true. When a program from OS X (Tiger at least) needs to access the integrated iSight camera, it has to call the QuickTimeUSBVDCDIgitizer.component. This file is located in the /System » Library » QuickTime folder.

Simply deleting this file will prevent any program from being able to access it. Instead, the system will simply display a message stating that the hardware is already in use by another program, and that it recommends you quit that program in order to use the camera. The beauty to all of this is that any program on your Mac that needs to verify the iSight at the hardware level can still do so. This allows things like Skype and iMovie to continue functioning, but without use of the camera. I've been using this on over 200+ MacBooks and iMacs at our Academy, and it works beautifully without causing other issues.
    •    
  • Currently 3.43 / 5
  You rated: 4 / 5 (7 votes cast)
 
[78,713 views]  

10.4: Disable integrated iSight cameras | 27 comments | Create New Account
Click here to return to the '10.4: Disable integrated iSight cameras' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Apple are you listening?
Authored by: Mike Perry on Mar 26, '07 08:24:50AM

If Apple's listening, they should take this as an indication that they need to give us a way to completely and utterly shut down all built-in security holes. Give us a Apple menu option called Security that lets us:

1. Turn off the camera (as here) and microphone
2. Turn off WiFi and Bluetooth for less-than-nice public locales like airports
3. Control Ethernet: Off completely, local IPs only, or every IP.

The feature would also be a quick way to check if those options have been disabled via Preferences.

And they really should give us a different sort of iSight camera on laptops, one that rotates some 270 degrees to face the user or a conference speaker. (Who wants to video tape themselves?) Rotating it to look inside the case would effectively shut it down. A few degrees of up down movement would also be handy.

--Mike Perry, Untangling Tolkien



[ Reply to This | # ]
Apple are you listening?
Authored by: brett_x on Mar 26, '07 08:49:08AM

How about an option to "Never join the "XXXX" wireless network". We have one rogue network near our offices and it's outside our control. There's no way that I know of for me to "always ignore" or "never Join" that network. Every time I fire up my laptop, it asks if I'd like to join it.
On a higher level, I'd like to disable our users ability to join that network.. but Apple doesn't consider themselves in the Enterprise market enough to give us full controls.... (if anyone knows of a way to do that, please let me know).



[ Reply to This | # ]
Apple are you listening?
Authored by: PizzaCake on Mar 26, '07 01:13:07PM

I remember setting up my sister's MacBook to only join wireless networks I had specified. I created a Location called safe wireless. There was an option to not automatically connect to wireless networks. Just dig around network preferences/airport I'm sure its all around there.



[ Reply to This | # ]
Apple are you listening?
Authored by: jelmore49 on Mar 26, '07 04:45:59PM

In the Network pane of the System Preferences, go to the AirPort configuration. There will be a sub-tab also called "AirPort".

Change "By default, join:" from "Automatic" to "Preferred networks" and remove all network names that you do not want the machine to connect to.

Select the "Options..." button; for "If no preferrred networks are found:", select "Keep looking for recent networks"; this should keep AirPort for looking for non-authorized networks, but I haven't tried it.



[ Reply to This | # ]
Apple are you listening?
Authored by: UberFu on Mar 28, '07 01:48:41PM

"2. Turn off WiFi and Bluetooth for less-than-nice public locales like airports
3. Control Ethernet: Off completely, local IPs only, or every IP."

Mike - these 2 are already available_

Have been since each were implemented [ethernet since pre OS 9 days and Bluetooth when it first came out]

Both can be accessed in the System Preferences App and Bluetooth has an optional Menubar Item that can be activated and which controls Bluetooth functionality_ I use them both constantly_

I do agree with your 2nd suggestion about having the camera "rotatable"_ But basically what they need to do moreso is to go back to the original design of the iSight Camera that they used to sell [until recently for $65] and bring it back - period_

I think an independent - mobile camera is a way better solution than a fixed camera built into your laptop screen looking back at you_


Another low-tech solution is to pop open the laptop screen backing and physically disconnect it from the board it's connected to_ Still looks pretty and only looks pretty_

Or at the least Apple should givve consumers the option of purchasing a laptop with or without a camera - like they do with the option of a back-lit keyboard or not OR like they do with the option for a glossy screen or non-glossy screen_



[ Reply to This | # ]
Electrical tape
Authored by: googoo on Mar 26, '07 08:58:42AM

There is a low-tech (but not very pretty) solution. Just put electrical tape over the camera lens if you are really worried about it. Seriously, it would be nice to have a physical cover that you could open and close on the camera.

-Mark



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: bts on Mar 26, '07 09:14:41AM

This hint is correct about its directly observable consequences, but not their implications.

This makes it hard for programs to use the iSight. They might have to ship their own drivers. They might have to access it directly, without QuickTime's friendly interface. But they can certainly still get to it.



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: ebow on Mar 26, '07 10:12:53AM
This hint appears to be for situations where no program should be able to access the iSight. There are environments in which cameras are not allowed, and by deleting this file a person might be able to demonstrate that the camera is effectively disabled and therefore permissible for use. Of course, the security fiends I've encountered would probably still be reluctant to give it approval, but the point of the hint still stands: making the camera unusable.

[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: GaelicWizard on Mar 27, '07 04:23:35AM

I believe that you misunderstood the comment to which you are replying.

Any program *can* still access the iSight camera, just not through QuickTime.

JP

---
Pell



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: chafnerjr on Mar 26, '07 11:40:09AM

Good points all around. I shouldn't have focused on the NSA security document but thats what made me realize not to many people were doing this. Mostly I was concerned about the educational market. While developers or programmers could certainly work around my proposed solution easily, my students cannot. Working for an educational facility it was demanded of me that I disable the cameras in a way so that the students could not use them but also be remotely reversable. As you can imagine this is easy to disabled and re-enable over a network using ARD or other such administrative methods. I know this is not highly secure but it works in a pinch for everyone and perfectly for education.

P.S. Most major OS X updates replace this file so remember to check it after any OS updates.

Chris Hafner
chafnerjr@yahoo.com



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: allanmarcus on Mar 26, '07 11:19:29AM

Here at my National Lab we have our Apple Vendor physically open the laptop and unplug the iSight from the motherboard.



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: chafnerjr on Mar 26, '07 11:45:50AM

When you unplug the iSight does it still pass hardware checks?



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: v8media on Mar 27, '07 02:51:51AM

For any of the people actually removing isights (not just unplugging) I would love to get a hold of these things. I have a use for about ten of them.

Send me an email at v8media@gmail.com if you've got a few.

Thanks, Ian



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: imageworx on Mar 27, '07 07:45:20AM

Why can't Apple just make this an option? Either with or without iSight in BTO... I'm sure folks would like the option (especially sensitive companies/organizations).

---
To BeOS or Not to BeOS



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: porkchop_d_clown on Mar 28, '07 04:01:34AM

Because the total number of people who would buy a macbook without the camera is certainly less than 50k, and might be less than 10k.

Remember, he didn't say that Apple was removing the cameras, just unplugging them from the mobo.

---
Everyone loves a clown, but no one will lend him money!



[ Reply to This | # ]
I disagree
Authored by: johnqsmith on Mar 26, '07 06:55:45PM

The point is, if you disable it in software then it can be reenabled in software can't it? Someone, or a piece of malware can simply pop the file back in and it's all good(yes, iff they are admin, but that's part of the point of trying to protect even after compromise...). THAT is why the NSA says you can't disable it without disabling USB stuff. Because the camera is on the USB2 bus, and therefore, so long as you can write to USB devices, you can turn the camera back on. The only solution is literally disconnecting it, and until there is a physical switch to do so, you're left with unplugging it after opening it up. Software can't fix it.



[ Reply to This | # ]
I disagree
Authored by: chafnerjr on Mar 27, '07 08:28:08AM

Again I apologize for pointing to the NSA articles. I was being a bit ahead of myself. This "tip" is really intended for the educational community where users do not have admin access. As you can imagine there could be much legal trouble if an underage student were to appear on the internet doing what teenagers do. We could, in theory, be held accountable for providing said student with web cams.

In this particular situation it is critical for private institutions using mac's. I should have thought out my initial tip before writing it. Also I didn't know if it was going to be re-written as this was my first "tip" sent here.



[ Reply to This | # ]
Interesting.
Authored by: porkchop_d_clown on Mar 28, '07 04:04:35AM

I wonder what the thinking was there. I know my niece's school district issued her a macbook with the iSight still working, I was messing with it before I decided I should upgrade from my PBG4.

To be honest, at 42, I have very little use for Photobooth. :-P Heck, I've never even been asked to video conference. :-D :-D

---
Everyone loves a clown, but no one will lend him money!



[ Reply to This | # ]
Interesting.
Authored by: chafnerjr on Mar 28, '07 05:18:34AM

I'm assuming that when you say "school district" you mean that they are day schools where the parent has the direct responsibility over the action of the student. In this case I certainly understand. Besides the cameras are just so way cool.

My school, however, is a private boarding school. We have to be a little more careful with what our students can do in their free time as we have direct responsibility for many of their actions. Long story short there is a real legal issue should one of our students display themselves inappropriately somewhere over the internet since they are underage.



[ Reply to This | # ]
I disagree
Authored by: explodingpickle on Sep 08, '07 06:00:13PM

This also only seems to disable the iSight from apps that rely on QuickTime to access it. If I go in a dark room with my MacBook Pro and turn the keyboard backlight on, then go outside the backlight will go off.



[ Reply to This | # ]
Suggestion: MAKE CAMERA IN MACBOOK PRO REMOVEABLE!
Authored by: peterrosen on Mar 31, '07 06:06:01AM
I agree the camera built in needs help. What i think is it SHOULD BE REMOVABLE, JUST LIKE THE BULLET ON THE BRICK (plug part on the transformer you plug in to the wall).

Also, where is the gain setting and color balance? Sheeeesh. Its based on Quartz Composer, shurely a hook in the software could be hacked or written?

Thanks for letting me know what you think?

BTW, check out my HeartWave animation:


http://mauimacman.blip.tv/

[ Reply to This | # ]
Suggestion: MAKE CAMERA IN MACBOOK PRO REMOVEABLE!
Authored by: RichB on Mar 31, '07 03:59:00PM
10.4: Disable integrated iSight cameras
Authored by: zakai on May 16, '07 04:30:37PM

hello all, been following this discussion, even though my situation is a little different. I have a macbook pro with an internal iSight.. but also a firewire external iSight.

I can connect both camera but could not figure out a way to choose which one to use. It seem to alway prefer the internal isight.

however, sometimes, if I try to turn the video off and then back on again quickly, the camera will pick the external isight. So I know it is possible to get video input from it.

removing the QuickTimeUSBVDCDigitizer seems to disable them both.

Any way to control which cam to use as input?

--Ami



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: diastelo on Jan 04, '08 06:17:14PM

I read the NSA guide too, and the one for 10.3 clearly states how to disable the iSight (judging by the date, this may only apply to external iSight cameras. Integrated iSight cameras probably didn't exist yet).

Call me nitpicky if you want, but I'm setting the record straight. NSA didn't write the guide for 10.4. Apple did.

I don't know where this assumption got started, either, since it says so directly on NSA.gov when you go to download the guide. (Look under Information Assurance, then look for their Security Guidance).



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: diastelo on Jan 09, '08 10:57:21AM

Sorry for the poor tone of my earlier reply. I was frustrated from hours of searching online and finding the same wrong information over and over again.

It's possible that disabling /System/Library/Extensions/Apple_iSight.kext may solve the problem. I'll test this later on and get back to you guys.



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: gsgm on Oct 21, '08 08:53:01AM

Was asked about this topic and was glad to be able to find some thoughts here.

Basically, I have been asked to do this on a leopard machine. (All this hints here seem to reference Tiger).

Also, once these files are moved, will a QT update ever attempt to replace them? (ie: Auto re-enabling?)



[ Reply to This | # ]
10.4: Disable integrated iSight cameras
Authored by: BradMacPro on Jul 03, '09 12:32:37PM
http://techslaves.org/index.php?page=52

simple Applescript toggles permissions for driver files. Easy, fast and reversible.

Of course if absolute security requires it, then yes, disassemble the computer and pull the connection to the cam.

[ Reply to This | # ]