Who Touched My Mac’s Cam?

Recently I found out that my Mac’s facetime cam was on occasionaly. That is quite confusing to me and I was trying to find out a reason to do so. Although I was not that cautious like Mark Zuckerberg who used a tape to block the laptop’s camera¹, I don’t know if there are some malicious software running on my operating system and the software may control my webcam. Thus I have to find out the reason for it. In this post I will show one way to handle the problem.

Confusion

I’ve never met such problem, so if this happens to you especially for your notebook and iMac, this would also be a problem. Because initially I don’t know if I should trust the the green indicator or not. But I thought I should be aware of it. I know that Apple’s hardware and software engineers value privacy of users and they also want to maintian the brand’s reputation, the probability of a malfunctioning webcam indicator is low.

The most important question to ask is where to start? Although I consider myself a pro user, I still have no clue how to sort out a solution or formulate an experiment to do so.

More Symptoms

So from my knowledge on the operating system, the first thing I checked was the control center. Normally camera access would be shown with amber dot wihin control center. For example, if I use Zoom and open the camera, I could see the webcam indicator as well as a amber dot in control center, shown as follows. You could see on top there is a microphone icon with the app’s name.

However, my situation is more complicated, as you can imagine, there’s no indication which app is using the webcam. It acts as if there’s nothing sneaky going on. I was worried because I thought the malware would be more advanced that what I expected.

It seems to me there are not a lot of ways to check out this issue, but I need to find alternative ways.

Under the Hood

I need to check further using command line tools, I asked LLMs online to see if there are some ways to check which processes are using the hardware. Here’s the command that I ran to see which processees were using or at least accessing the hardware.

github ➤ sudo lsof | grep "AppleCamera"
Micro\x20 65009          user  txt       REG               1,17      199296 1152921500312259142 /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/AppleCamera.plugin/Contents/MacOS/AppleCamera
Micro\x20 65009          user  txt       REG               1,17      222547           934814627 /private/var/db/oah/path/AppleCamera.aot
AppleCame 65022     _cmiodalassistants  txt       REG               1,17      506432 1152921500312259145 /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/AppleCamera.plugin/Contents/Resources/AppleCameraAssistant
AppleCame 65022     _cmiodalassistants  txt       REG               1,17      296259           934814629 /private/var/db/oah/path/AppleCameraAssistant.aot

You could see some processes are using the camera while the indicator is on. You need sudo to run the command, the values like 65009 are the PIDs for the processes. I tried to kill those processes, forexample using kill 65009, I still could not be able to turn off the webcam indicator. As a sidenote, the 65009 one is not a malware.

Serendipity

I still could not handle the issue by the previous methods, I had to go to “Settings” or “System Preferences” to see my available options. I did not mention this in the beginning is that I knew all those things are under my control with nothing suspicious at all like some malware apps listed and I actually could not think those options would help me handle the problem at hand at all. You could find out the list by going through the following steps.

\(\texttt{System Preferences}\Longrightarrow\texttt{Security & Privacy}\Longrightarrow\texttt{Camera}\)

\(\texttt{System Settings}\Longrightarrow\texttt{Privacy & Security}\Longrightarrow\texttt{Camera}\)

Here’s a screenshot of the privacy settings look like:

Initially, I checked all apps listed in here, I did not find any apps that could be problematic at all, like some apps I don’t know about.

Later on, I decided I had to uncheck and check each item, because this is the only available options for me. I unchecked and checked each apps’ accessibility as a last resort. I was not that confident at all in the beginnig, until I found out which app caused the problem and why. When unchecking and checking each app, those apps need to be restarted to allow for the changes to be made.

After going throught the list one by one with ones that are checked, I found when I did the process for Microsoft Powerpoint, the webcam indicator suddenly turned off.

What happened?

I actually recalled that I used Microsoft Powerpoint‘s recording function to add narratives to slides show files. I had to allow PowerPoint to use my webcam. After I recorded the video task that was handled by Microsoft Powerpoint, I did not uncheck the app within the list.

Conclusion

In this post, I showed a way to handle the webcam indicator on when users are not intentionally using the cameras at all. By resetting the privacy settings for apps within the list, one could narrow down which apps are causing the problems.

1. Mark Zuckerberg tapes up his webcam[↩]