Disabling iSight camera and microphone

There have been a number of inquiries about disabling the camera and microphone on the MacBook Pro for people working in areas where video and audio recording devices are prohibited.

Rule Title: OSX00070-Disable Audio Recording Support Software

Discussion: Your computer might be in an environment where recording devices such as cameras or microphones are not permitted. You can protect your organization’s privacy by disabling these devices. Remove support for the microphone and audio subsystem. This may disable audio playback. Important: Repeat these instructions every time a system update is installed.

Check Content:

1. Open System Preferences -> Sound.

2. Select Internal microphone and ensure "Input Volume" is set to zero.

3. Select Line-In (if present) and ensure "Input Volume" is set to zero.

4. Select Display Audio and ensure "USB" is set to zero.

If any of the parameters are not set to zero, then this is a finding.

Fix Text:

Open a terminal session and enter the following commands to remove the files:

sudo srm -rf /System/Library/Extensions/AppleOnboardAudio.kext

sudo srm -rf /System/Library/Extensions/AppleUSBAudio.kext

sudo srm -rf /System/Library/Extensions/AppleDeviceTreeUpdater.kext

sudo srm -rf /System/Library/Extensions/IOAudioFamily.kext

sudo srm -rf /System/Library/Extensions/VirtualAudioDriver.kext sudo touch /System/Library/Extensions

GUI Procedures:

1. Open the /System/Library/Extensions folder.

2. To remove support for audio components such as the microphone, drag the following files to the Trash: AppleOnboardAudio.kext, AppleUSBAudio.kext, AudioDeviceTreeUpdater.kext, IOAudioFamily.kext, and VirtualAudioDriver.kext

3. Open Terminal and enter the following command: $ sudo touch System/Library/Extensions The touch command changes the modified date of the /System/Library/Extensions folder. When the folder has a new modified date, the Extension cache files (located in /System/Library/) are deleted and rebuilt by Mac OS X.

4. Choose Finder -> Secure Empty Trash to delete the file.

5. Restart the system.

Rule Title: OSX00075-Disable Video Recording Support Software

Discussion: Your computer might be in an environment where recording devices such as cameras or microphones are not permitted. You can protect your organization’s privacy by disabling these devices. Remove support for an external or built-in iSight camera. Note: The support for external iSight cameras should be removed on all machines. Removing only support for internal iSight cameras would still leave support for external cameras available. You can also have an Apple Authorized Technician remove the built-in video camera hardware from your Apple computer. Important: Repeat these instructions every time a system update is installed.

Check Content:

1. Open the /System/Library/Extensions folder.

2. Ensure the following file does NOT exist:Apple_iSight.kext.

3. Control click the IOUSBFamily.kext and select Show Package Contents.

4. Open the /Contents/PlugIns/ folder.

5. Ensure the following file does NOT exist: AppleUSBVideoSupport.kext

Fix Text:

Open a terminal session and enter the following commands to remove the files:

sudo srm -rf /System/Library/Extensions/Apple_iSight.kext

sudo srm -rf /System/Library/Extensions/IOUSBFamily.kext/Contents/Plugins/AppleUSBVideoSuppo rt.kext

sudo touch /System/Library/Extensions

GUI Procedures:

1. Open the /System/Library/Extensions folder.

2. To remove support for the external iSight camera, drag the following file to the Trash:Apple_iSight.kext.

3. To remove support for the built-in iSight camera, control click the IOUSBFamily.kext and select Show Package Contents.

4. Open the /Contents/PlugIns/ folder.

5. Drag the following file to the Trash: AppleUSBVideoSupport.kext

6. Open Terminal and enter the following command: $ sudo touch /System/Library/Extensions The touch command changes the modified date of the /System/Library/Extensions folder. When the folder has a new modified date, the Extension cache files (located in /System/Library/) are deleted and rebuilt by Mac OS X.

7. Choose Finder -> Secure Empty Trash to delete the file.

8. Restart the system.