Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

Post reply on HN
Print view View original

131–140 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#131

Post by jsjohnst »

stcredzero wrote: post #22
0x0 wrote: post #3

That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.

That's a pretty huge flaw. Millions if not... Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? I think their engineering is losing quality or is falling behind on what they have to cover.

> Is it just me, or is such a phrase applicable to Apple far too many times in the past several years?

Couldn't the same statement be made about Facebook, Google, Yahoo, and other very large tech companies too?

When a company has a billion users, pretty much any huge flaw is going to have a very wide reaching impact.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#132

Post by briandear »

redblacktree wrote: post #54
DINKDINK wrote: post #35

I wonder if the Apple representative who said this would be "fixed later this week" realizes this allows any attacker to wiretap any iPhone user (that has the vuln)

Yeah, that's bizarre. If my team were responsible for a bug like this, we'd be fixing it before we went home.

Do you know how long it takes to build iOS? It isn’t a “git deploy” and you’re done.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#133

Post by askafriend »

gene91 wrote: post #110
wmf wrote: post #15

Earlier quoted context omitted.

This is a form of speculation which increases performance in the common case where the call is accepted.

This sound horrifying. If I use a hacked/modified FaceTime client, does this mean I'll be able to hear and see the other end before they pick up, even after the fix?

Facetime calls are end to end encrypted so I doubt a modified client would work.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#134

Post by codetrotter »

Someone1234 wrote: post #37
NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely: https://www.theregister.co.uk/2017/11/28/root_access_bypass_... And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password: https://www.theregister.co.uk/2017/10/05/apple_patches_passw... All within…

I remember some people discovered that you could kill the xscreensaver lock screen on Debian with Alt+SysRq+F some years back. Well, a decade back actually — 2009.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=562884

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#135

Post by josephg »

saagarjha wrote: post #72
aphextron wrote: post #50

Earlier quoted context omitted.

>So… your theory is that if people understood pointers this wouldn’t have happened? Yes. But it has nothing to do with pointers specifically, just the mindset and training of the average developer who has had experience with them, vs. the average developer who has not. There's an entire generation of developers now graduating from CS programs, hiring into Apple, and getting dumped on these application teams with zero…

> The result is you have tons of brilliant people who can quickly whip up a DFS algorithm, but don't understand that using 4MB of RAM for a JPEG is unnacceptable, or that whatever dynamic thing they are asking the runtime to do might not always work as intended. I’m not sure where you’re getting this anecdote from, because I have not found it to be at all true in practice.

I’m not sure about the situation at Apple, but this is 100% true in the web development world today; with the exception that many of the new programmers hired straight out of General Assembly and the like can’t implement a DFS algorithm either.

It’s a nightmare for security and performance - the number of obvious, blatant security issues I’ve spotted and fixed just through luck alone is horrifying.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#136

Post by 55555 »

briandear wrote: post #132
redblacktree wrote: post #54

Earlier quoted context omitted.

Yeah, that's bizarre. If my team were responsible for a bug like this, we'd be fixing it before we went home.

Do you know how long it takes to build iOS? It isn’t a “git deploy” and you’re done.

How long does it take?

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#137

Post by notfed »

int_19h wrote: post #124

This sort of thing is why I'd prefer devices to come with hardware killswitches for mic, video, and various radio modules.

iPhones already have a "mute" slider switch. When I first looked into iPhones (after years of Androids), my instant reaction upon seeing the slider switch was "Ah! FINALLY! I can feel at peace in the knowledge that software vulnerabilities are powerless to hack my camera or microphone!"

Of course, stupidly, the slider doesn't "mute" my camera or microphone, but only my speaker. For Apple to modify this slider so that it mutes my camera and microphones would require the daunting addition of two transistors. And the act of such a simple modification would put an end to the incredibly creepy, Orwellian possible reality that we all risk taking a part in every time we glance at the familiar tiny screens we have become so intimately glued to.

Apple should add those two transistors.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#138

Post by saagarjha »

culturestate wrote: post #121
saagarjha wrote: post #113

Earlier quoted context omitted.

Why not just turn on airplane mode?

If you don't trust the software in the first place, there's no real reason for you to trust that airplane mode is actually effective.

If you can't trust the software at all, you might be better served with turning your phone off :/

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#139

Post by kennywinker »

angott wrote: post #45
wmf wrote: post #15

Earlier quoted context omitted.

This is a form of speculation which increases performance in the common case where the call is accepted.

I always wondered why FaceTime Audio has almost zero call establishment time on iOS, as opposed to WhatsApp or FB Messenger where you need to wait half a second before the audio feed kicks in after answering. Guess this is the reason!

That has not been my experience with facetime audio. For me it’s 3-10s wait after tapping the accept-call button before audio is connected.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#140

Post by saagarjha »

LeoNatan25 wrote: post #119
saagarjha wrote: post #92

Earlier quoted context omitted.

> Zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability. What makes you think this?

The amount of bugs like this, specifically lock screen evasion bugs, bug also disk management bugs we've seen, etc. As I said, this is not specific to Apple. The whole industry lacks security awareness, and because people don't hold these companies accountable, there is little financial incentive to change that.

Your specific claim was that Apple has "zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability"–this isn't true at all. Sure, Apple's software has had some serious bugs in it, but this does not mean that they have no security practices in place.
Post reply on HN