Webcam Hacking – The story of how I gained unauthorized Camera access on iOS and macOS

Amazing rundown by Ryan Pickren on how he gained unauthorized Camera access on iOS and macOS.

We started on a normal HTTP website and ended up on a bastardized blob URI in a Secure Context. Here is a quick summary of how we did it:

1. Open evil HTTP website
2. HTTP website becomes a data: URI
3. data: URI becomes a blob: URI (with magic blank origin)
4. Manipulate window.history (in 2 parts!)
5. Create an about:blank iframe and document.write to it
6. Dynamically give this iframe the sandbox attribute
7. Attempt an impossible frame navigation using X-Frame-Options
8. From within the iframe, window.open a new popup and document.write to it
9. Profit

From this popup, we can use the mediaDevices Web API to access the webcam (front or rear), microphone, screen sharing (macOS only) and much more!

The hack in action (user must have previously trusted skype.com, which is not unlikely):

🤯🤯🤯

Webcam Hacking – The story of how I gained unauthorized Camera access on iOS and macOS →