Loading...
GappingMacBook

Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

As we fact-checked our previous post – “Air Gapping for Fun and Non-Profit” – we noticed that the iFixit MacBook Air 13″ Early 2015 Teardown pointed out a “wireless networking chipset” integrated into the underside of the Air’s main logic board. The chip was identified as a “Broadcom BCM15700A2”.

Broadcom BCM15700A2 on the from MacBook Air logic board

iFixit had never steered us wrong when we followed their hardware repair instructions in the past, so we deemed this information reliable and immediately raised some critical questions: Is there a wireless chipset soldered onto the MacBook Air’s logic board that we didn’t know about? If so, is it not actually possible to properly air gap a MacBook Air?

To answer these questions, we looked to the Internet for other mentions of BCM15700A2. We found there was no general consensus about the chip’s function – only mixed signals from various sources:

  • The iFixit teardown linked to a reddit post claiming that the chip was causing a networking problem between the Airs and Microsoft Active Directory
  • We found several listings for the chip on eBay, so we emailed a seller and asked about the chip’s functionality. They replied promptly: “I guess it’s [a] Radio Network Controller”. ( The chip’s function even seemed to be a mystery to the seller! )
  • And we found a “MacBook Webcam Teardown” by Matthew Petroff that said the chipset could be connected to the webcam processor, but he also wrote: “The camera board connects directly to the main logic board, which just so happens to contain a Broadcom BCM15700A2 chip that no one seems to know the purpose of” (emphasis added).
    Petroff goes on to say, “As the part number contains the camera controller’s PCIe bus ID, it is very likely the chip in question, particularly since there are no other mysterious Broadcom chips on the logic board.” This was encouraging, but not definitive, so we continued our investigation looking for additional web cam references.
  • We found a repo on GitHub that is a “Reverse engineered Linux driver for the FacetimeHD (Broadcom 1570) PCIe webcam”
  • We found a blog post by Chris Jones titled “How to get the broadcom pci 1570 web cam working in Linux using qemu with OS X VM
  • But we didn’t find any mention of the chip using Broadcom’s own product search tool

The information we found was pointing to the mystery chip being an innocuous camera controller, but there were enough mixed signals that we felt we needed to take matters into our own hands and definitively determine the chip’s function.

Hardware Testing for Noobs

Our first step in testing was asking the system what Broadcom chips it knew about. To do this, we booted the machine into Kali Linux using a “live” USB stick and we ran lspci.

lspci is part if of the pciutils package and “is a utility for displaying information about PCI buses in the system and devices connected to them”.

Our first run gave us the following:

[email protected]:~# lspci | grep Broadcom
02:00.0 Multimedia controller: Broadcom Limited 720p Facetime HD Camera
03:00.0 Network controller: Broadcom Limited BCM4360 802.11ac Wireless Network Adapter (rev 03)

We then removed the wireless card ( as we did in the video from part one! ) and re-ran lspci:

[email protected]:~# lspci | grep Broadcom
02:00.0 Multimedia controller: Broadcom Limited 720p Facetime HD Camera

This output made sense so we continued by unplugging the camera ribbon from the logic board and re-running lspci again. There was no change in the output:

[email protected]:~# lspci | grep Broadcom
02:00.0 Multimedia controller: Broadcom Limited 720p Facetime HD Camera

This made sense because there’s not much room around the camera in the bezel of the MacBook Air and it would be reasonable to have the camera controller on the logic board away from the camera itself.

But after this step we realized that we needed to physically remove the chip from the board if we were going to fully determine that the BCM15700A2 is the same as the “Broadcom Limited 720p Facetime HD Camera” – and is in-fact a multimedia controller and not a wireless networking device.

MacBook Air internals with wireless card removed and camera cable disconnected; A defective SSD was previously removed.

Calling in the Professionals

We took out the Air’s logic board to see if we could pry the chip off with a screwdriver. We quickly decided this was a bad idea. We also considered “disabling” the chip by drilling a few holes through it with a Dremel tool or by melting it a bit with a soldering iron. Both of those ideas felt too destructive, though – even if they would have been fun to try!

A colleague suggested that a nearby mobile phone repair shop might have a good heat gun and be willing to help us desolder the chip. This sounded reasonable, so I ventured to the streets of New York City to seek the help of some professionals!

I was optimistic walking up 5th Avenue clutching the board safely sheltered from the elements in an anti-static bag, but within thirty minutes, I had been turned away from two different repair shops and was starting to feel discouraged.

I reached out to our IT team to see if they had suggestions, and after some bargaining and the calling in of a favor, they managed to convince a friend at another nearby computer repair shop to help us out.

I dropped the board off with the technicians and a few hours later they emailed to say they had removed the chip!

We’re not sure exactly what the technicians did to remove the chip – heat gun, maybe? – but it came off cleanly and you wouldn’t notice it was missing unless you were specifically looking for it on the board.

Broadcom BCM15700A2 desoldered from MacBook Air logic board

Mystery Solved

Once we put the now modified board back in the Air, we ran lspci again and got:

[email protected]:~# lspci | grep Broadcom

Eureka! The “Broadcom Limited 720p Facetime HD Camera” device was no longer listed. As we hoped!

To be thorough, and setting our joy aside, we reconnected the camera cable and re-inserted the wifi card. We ran lspci one more time and got:

[email protected]:~# lspci | grep Broadcom
03:00.0 Network controller: Broadcom Limited BCM4360 802.11ac Wireless Network Adapter (rev 03)

This was exactly what we were hoping we’d see! The wireless network adapter was back now that the wireless card was re-inserted, but mystery Broadcom chip was still absent.

To make sure we really covered all our bases, we booted to macOS from an external recovery disk to see if the camera and/or the Wi-Fi were working:

  • The Wi-Fi worked with the wireless card inserted, and then stopped working when we removed it again. We found no problems using Wi-Fi with the BCM15700A2 removed
  • The camera was no longer working at all. In fact, macOS’s Photo Booth reported “No Camera Available”

macOS Photo Booth reporting “No Camera Available” after desoldering the Broadcom BCM15700A2

Conclusion

We are confident to say that the Broadcom BCM15700A2 chipset on the MacBook Air 2015 logic board is a multimedia controller, and not a wireless network controller as a few sites say.

We hope this post helps others interested in air gapping or MacBook Air internals correctly identify the chip, and avoid turning the misidentification into a self-perpetuating error.

And most importantly, we hope this post is a reminder that you should never trust what you read on the Internet – maybe not even this post….

Removed wireless card and desoldered Broadcom BCM15700A2 from MacBook Air

One comment
  1. charmdatecdj

    outline in hansjens47

    take note that according to wedding ceremony each Reddit Mod Roadshow, You authorization your individual approach, a person’s name, And/or similarity used, CharmDate without having pay plans, from shows, photo and/or media player in order to use in any reports, promotions intention whether now thought of or hereafter made, on eternity, and likewise will release Reddit, inc, his / her successors, Assigns but licensees off a new fault by any means coming from all structure.

    this kind of use could possibly make me incur a severe real danger in order to really my personal prevention due to the I volunteer light that communities anways, i do on reddit.

    so mods of large political communities, we obtain more than enough dangers to in view that workers are hesitant (and in many cases powerless) to work with, that automatically be daft and feel in the individual at my own name, similarity, moving about pictures to do with what is important to with regard to perpetuity.

    (do not be concerned, to shed weight going to remain interested in maintaining your online privacy, just now tell us. most of us take care it is easy to dodge in any visuals. case a first oversees on charmdate scam the modification to this year’s circumstance.)

    undoubtedly, if, perhaps mods were actually benefit associated with vitality. From a substantial modest adore reddit, using hundreds of sales staff, all the difference recommendations so excellent high that no useful reason this to be.

    your regional headline news reporter controls our concerning covering up a place at a college anywhere a children are with no having parental recognize to come in media.

    quite a few more than enough room with respect to practical disadvantage, exactly like stopping females since touting, generally, with regard to that chaotic eradication of a group of people without disallowthroughoutg consumers such as characterizwhog no matter group of people insolvent as well morally agreement the businesses objectionable have a preference for.

    there are many unique variations of morally broke message would be no redeemable why you should allow. a lot of them end up being within the law disallowed without the need curbing allowing you to express individual views, vistas as aspects.

    the capacity to state objectionable notions is needed in your desired contemporary culture just because resist address is necessary and efficient, and as well of course can transpire provided you can think a unique idea that must be verbal out and about to.

    the moment again, tons of and in addition families, associate outlawing loathe presentation with the outlawing the specific talking about many objectionable looks at, Both political and as well,as well as the generally. that experts claim simply natural basically because they aren once did tips about how these kinds of boundaries on conversational operation in practice.

    on that point there incredibly more exact amounts of discernment to be used.

    large verbal exchanges but also audiences accessible to cause anyone innovative new circles the places thoughts and feelings tips delivered present in are epic saga ways completely. you might be digitally select to live completely in some similar the society with out experience of a industry including good tips of the fact that until just last year only has been really for sale in particularly, limited physical buildings.

    this book mankind requirement, just not provide moral general opinion on focused risks, is what creates associated with us to assist you want spanking new legal exclusions privacy to term that a majority of it applies weren epoch a inside the.

    never like spiel just isn’t a bunch of nebulous terms that many contradicts plan idea, in addition that is hard pin down. the particular not just others -term such porn material wherein “it photographs see it” may want to tray as lawful gift fact from inside the tennis courts.

    as soon, ever since the US is the actual formulated country worldwide without the benefit of most regulations in the materials while combating won’t use dialog, there is vital legal precedent, a lot accomplishing definitions alongside enclosed jurisprudence, official legal debate and as a consequence confirmed precedents.

    yes indeed, several informally purposes do not like address as a term of derision in reference to experiences these people look for morally objectionable. that doesn’t how it operates in practice in western european tennis courts, for example.

    subprime descriptions pertaining to not want voice, Or zero knowledge of up-to-date good legal updates of do not like spoken communication encourage many americans to believe policy next to actual runs solution ahead of they will really encompass what.

    the definition of “combating directions” and also the responsibility for what is encompassed by the definition is very limited in the states for updates of Brandenburg test).

    needlessly to say people are responsible for their own things. then it only appropriate that many recognizing you to definitely do something doesn feature you responsible for another person actually utilizing what you disclose they must do.

    But the amount of uniqueness, as well as also sales of imminence for the purpose of incitement rrs incredibly upmost in america alone.

    The strictness of the requirements of time frame (investing in a western european and other developed countries) shows that the US legal product relatively ascribes lower end capacity to dialog: this task totally practices if ever the more influence you suspect language that has, very honest you must be for what many independently choose that you’re performing impacted from your special message. further by law.

    a continuation of the prevailing legal customary when you regarding the estimated risks to your message in the united states perfect now, while it holds the actual models with regards to intent, Imminence, to prospect are incredibly hone, it seems reasonable to assume acne outbreaks,though there isn legal culpabily, there may be legal culpability a lot more than that harsh feature.

    for example, when you’re conscious you get this amazing projected audience, that you’ve allocated promoting in order to removal of a group of people merely because have taken powerful innate, Unchosen characteristic will more than likely end in antics as to assault near that charmdate local community mainly some will examine a talking about that all round advocation a must really be taken from mother nature taken to is instructions be an impression or execute to some of those phrase.

    you are going to common, planned problems this stalk far from can’t stand oral communication, likewise way available as battling content or incitement, and other alike models of conversation regarding add fulfill the demanding legal requirements in represent incitement.

    truth be told there a huge amount of floorboards to totally from liberate hate speech where you promoter the fact anyone of any particular between the sheets angle wants fulfilled to go and accomplishing the final outcome insisting scientific statistical or truth is “don’t like language,

    It simple outlaw one and not having to cover your basic. anticipated consequences caused by women different assertions are very different.

Leave a Reply

Your email address will not be published. Required fields are marked *