Matthew Brocker and Stephen Checkoway found a way to change the firmware for the Mac's built-in camera so that the activity light stays disabled. As a result, the camera can be activated without anyone that's actually at the computer knowing.
Apple designed the activity light to work as an integral part of the camera so that there shouldn't be a way to have one active without the other. The idea behind the design was that no one could eavesdrop on your activities without your knowledge.
The system the two men developed requires a firmware update on the victim's Mac, and that means it can't easily be done without their knowledge. Firmware updates need administrator passwords to install, making it more difficult to get onto someone's computer. The easiest way to get the new firmware on to susceptible Macs is to gain physical access — meaning to sit down at the computer's keyboard — and install the update from there.
Alternately, a Mac that's part of a remote management system, like many businesses and schools use to install software and updates on user's computers over a network, can be used to install firmware hack. That's how Mr. Brocker and Mr. Checkoway delivered the hack to their test system.
Once the firmware update and special apps for remotely controlling the built-in camera were installed, the men were able to activate the Mac's camera and record video without the green activity light turning on.
The conditions necessary to install the hack are fairly limited, and they get even narrower thanks to the list of Macs that appear to be susceptible to the firmware hack. So far, it looks like only pre-2008 iMac, MacBook, and MacBook Pro models fit the requirements. Newer model Macs don't seem to be compatible to the firmware change.
That makes the likelihood of someone secretly installing the firmware on your Mac very slim, although it does drive home some important points about computer security. Giving anyone unsupervised access to your Mac, for example, is a good way to end up with apps you don't want and settings changes that reduce your overall security. Setting your Mac to auto-login at startup instead of requiring a password makes it easy to for anyone that gets their hands on your computer to see and do whatever they want, too.
What Mr. Brocker and Mr. Checkoway's reserach showed is that even though our Macs may seem secure, there are ways clever coders can get at our personal information. It may not be likely, but as we do more to protect our computers and our data, the harder it is for hackers to get at the information we'd rather keep private.