Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

Post reply on HN
Print view View original

51–60 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#51

Post by nkozyra »

akerl_ wrote: post #42
giancarlostoro wrote: post #18

Earlier quoted context omitted.

> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!

I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is sim…

> Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug?

I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception.

That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar.

edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating any negative news about the device would be paramount

edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#52

Post by giancarlostoro »

akerl_ wrote: post #42
giancarlostoro wrote: post #18

Earlier quoted context omitted.

> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!

I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is sim…

> Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug?

That reads much clearer, you're right, I misunderstood what you meant. I think it depends, PSN isn't as personal as someone's potential unsolicited nudes being extracted by total strangers. If enough bad press came of it, it wouldn't be the same ballpark. I certainly hope nothing horrible comes of it.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#53

Post by morganvachon »

judge2020 wrote: post #47
Someone1234 wrote: post #37

Earlier quoted context omitted.

It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely: https://www.theregister.co.uk/2017/11/28/root_access_bypass_... And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password: https://www.theregister.co.uk/2017/10/05/apple_patches_passw... All within…

Not Apple related, but you could log into any linux box using a specific few versions of grub2 by hitting backspace 28 times: https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-...

Sometimes I feel like a relic using Slackware with lilo and SysV init, then I read about exploits like that and I smile.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#54

Post by redblacktree »

DINKDINK wrote: post #35

I wonder if the Apple representative who said this would be "fixed later this week" realizes this allows any attacker to wiretap any iPhone user (that has the vuln)

Yeah, that's bizarre. If my team were responsible for a bug like this, we'd be fixing it before we went home.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#55

Post by googlemike »

greenleafjacob wrote: post #46
kiwijamo wrote: post #41

The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.

Not sure if this was intentional but in security, Alice and Bob wre the names in hypotheticals for the attacker and unwitting victim since the RSA paper. https://en.m.wikipedia.org/wiki/Alice_and_Bob

Your comment shows a clear lack of contextual insight into general software security. Alice (A) and Bob (B) are ubiquitous in discussions:

https://en.wikipedia.org/wiki/Alice_and_Bob

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#56

Post by padiyar83 »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

Yeah. Never attribute to malice that which is adequately explained by stupidity ~Hanlon's razor

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#57

Post by tehlike »

oil25 wrote: post #29
qrbLPHiKpiux wrote: post #4

Not for long. Will be patched in hours, I bet.

This would actually be a fun interview question - how to emergency patch 1B+ globally distributed mobile devices. I would say at least several days for the obvious QA which needs to be done.

Desperate times call for faster-deployment. Been there. Sometimes, you might even need to patch a binary.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#58

Post by dannyw »

0x0 wrote: post #3

That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.

Perhaps apppe should disable Group FaceTime calls until an update is out.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#59

Post by segmondy »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

Most likely 2 different teams worked on it. One worked on accepting calls, the other worked on transmitting audio, another probably worked on video. Then it got integrated and complete e2e testing wasn't done.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#60

Post by JeremyBanks »

stcredzero wrote: post #22
0x0 wrote: post #3

That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.

That's a pretty huge flaw. Millions if not... Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? I think their engineering is losing quality or is falling behind on what they have to cover.

Comparable examples?
Post reply on HN