Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

Post reply on HN
Print view View original

151–160 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#151

Post by LeoNatan25 »

saagarjha wrote: post #140
LeoNatan25 wrote: post #119

Earlier quoted context omitted.

The amount of bugs like this, specifically lock screen evasion bugs, bug also disk management bugs we've seen, etc. As I said, this is not specific to Apple. The whole industry lacks security awareness, and because people don't hold these companies accountable, there is little financial incentive to change that.

Your specific claim was that Apple has "zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability"–this isn't true at all. Sure, Apple's software has had some serious bugs in it, but this does not mean that they have no security practices in place.

I am not speaking about dedicated security teams. What security training is there for end-user app developers at Apple? From discussions with developers I know, it doesn't seem to exist, or at least not spread everywhere.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#152

Post by saagarjha »

notfed wrote: post #137
int_19h wrote: post #124

This sort of thing is why I'd prefer devices to come with hardware killswitches for mic, video, and various radio modules.

iPhones already have a "mute" slider switch. When I first looked into iPhones (after years of Androids), my instant reaction upon seeing the slider switch was "Ah! FINALLY! I can feel at peace in the knowledge that software vulnerabilities are powerless to hack my camera or microphone!" Of course, stupidly, the slider doesn't "mute" my camera or microphone, but only my speaker. For Apple to modify this slider so that…

Are you suggesting that the silent switch also turns off the camera and microphone?

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#153

Post by saagarjha »

Gigablah wrote: post #145
saagarjha wrote: post #94

Earlier quoted context omitted.

I don't see a bug in the patch to fix this bug going over very well with the press.

It's not like they haven't done it before :) https://www.theguardian.com/technology/2017/nov/30/apple-mac...

Yeah, that's my point ;)

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#154

Post by samstave »

crgt wrote: post #107
paultopia wrote: post #97

Earlier quoted context omitted.

Anyone got Tim Cook's number? If you do, bet you can get some, uh, exposure for this problem real quick.

Anyone try FaceTiming his email? Could be linked to iCloud and FaceTime-able..

[redacted]

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#155

Post by kennywinker »

notfed wrote: post #137
int_19h wrote: post #124

This sort of thing is why I'd prefer devices to come with hardware killswitches for mic, video, and various radio modules.

iPhones already have a "mute" slider switch. When I first looked into iPhones (after years of Androids), my instant reaction upon seeing the slider switch was "Ah! FINALLY! I can feel at peace in the knowledge that software vulnerabilities are powerless to hack my camera or microphone!" Of course, stupidly, the slider doesn't "mute" my camera or microphone, but only my speaker. For Apple to modify this slider so that…

Frankly, I’m totaly in favour of hardware interrupt switches for the camera/mic - but I think I understand why it’s not likely to happen. First, to a lot of people it will look like admitting your thing is hackable, which makes it seem vulnerable. Second, now every time I accept a call I have to check this switch - sounds like a switch most people will leave in the on-position 100% of the time and then when it accidentally gets flicked they’ll bring their phone to the Apple store because “it’s broken”.

Also, I don’t want my ringer to have to be on any time I take a call... but that’s just a debate about if it should be one switch or two.

Also the hardware switch doesn’t interrupt the speaker, it just turns the ringer to silent/vibrate mode - you can put someone on speakerphone or play music with it on.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#156

Post by saagarjha »

55555 wrote: post #136
briandear wrote: post #132

Earlier quoted context omitted.

Do you know how long it takes to build iOS? It isn’t a “git deploy” and you’re done.

How long does it take?

Several hours to a day, depending on how many components fail to build.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#157

Post by paxys »

dannyw wrote: post #62

If I were Apple, I would be implementing a server side migration right now: - if someone adds their own email or phone number again to a group chat, immediately terminate the call As far as I know, this would mitigate the vulnerability. Alternatively, disable Group FaceTime calls altogether.

I'm pretty sure there are a lot of Apple engineers evaluating and testing fixes (including this one) as we speak.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#158

Post by paxys »

DINKDINK wrote: post #35

I wonder if the Apple representative who said this would be "fixed later this week" realizes this allows any attacker to wiretap any iPhone user (that has the vuln)

If it's a client-side fix then I won't be surprised if it does take that long.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#159

Post by marnett »

greenleafjacob wrote: post #46
kiwijamo wrote: post #41

The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.

Not sure if this was intentional but in security, Alice and Bob wre the names in hypotheticals for the attacker and unwitting victim since the RSA paper. https://en.m.wikipedia.org/wiki/Alice_and_Bob

Don’t get me started about Eve...
Post reply on HN