Since recent hacks concerning unauthorised recording of video/audio MacOS/OS X on Apple Macs, I found a handy tool called Oversight that notifies you when a process wants to use the camera or microphone:
One of the most insidious actions of malware, is abusing the audio and video capabilities of an infected host to record an unknowing user. Macs, of course, are not immune; malware such as OSX/Eleanor, OSX/Crisis, OSX/Mokes, and others, all attempt to spy on OS X users. OverSight constantly monitors a system, alerting a user whenever the internal microphone is activated, or the built-in webcam is accessed. And yes, while the webcam’s LED will turn on whenever a session is initially started, new research has shown that malware can surreptitious piggyback into such existing sessions (FaceTime, Sykpe, Google Hangouts, etc.) and record both audio and video – without fear of detection.
While OverSight is running, anytime the internal microphone is activated, or a process accesses the built-in webcam, OverSight will alert you of this fact.
More, specifically, whenever the internal microphone is activated, the following notification will be shown:
For webcam usage, OverSight is a little more intelligent, in the sense that it can identify the process that is using the camera. Moreover, if a secondary process accesses the camera (while it’s already in use), OverSight can detect this as well. While the secondary process may not be inherently malicious (maybe you’re FaceTiming and Skyping at the same time?), malware can piggyback into existing sessions in order to record them. As there are no visible indications of this activity (as the LED light is already on), the malware can record both audio and video without fear of detection….until now!
The webcam notifications will contain the name of the process (i.e. OSX/Mokes) and its process identifier. Moroever, the notification allows one to terminate the process via the ‘block’ option.
You can find Oversight here. It is 100% free (no demo mode, limited functionality, etc).
