Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

Post reply on HN
Print view View original

171–180 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#171

Post by saagarjha »

askafriend wrote: post #165
saagarjha wrote: post #149

Earlier quoted context omitted.

If FaceTime is implemented the way the parent comment mentions (which it very well may not) I don't see why you could make a client that performs a proper key exchange to set up an end-to-end call and simply pretend grab the video instead of hiding it behind the "dailing" screen?

"The initial FaceTime connection is made through Apple server infrastructure that relays data packets between the users’ registered devices. Using APNs notifications and Session Traversal Utilities for NAT (STUN) messages over the relayed connection, the devices verify their identity certificates and establish a shared secret for each session. The shared secret is used to derive session keys for media channels stream…

I'm not doubting whether FaceTime is end-to-end encrypted, I'm not sure whether FaceTime sends data before the call is accepted for speculation reasons.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#172

Post by awhitty »

paultopia wrote: post #97
gpm wrote: post #9

Earlier quoted context omitted.

Unless Apple decides they face significant legal exposure over the bug somehow I don't see them doing that. It would attract so much more attention that it would almost certainly not be worth it economically. I wonder if they (executives? engineers? the company itself?) could be charged with aiding and abetting wiretapping or something now that they know it's happening and are letting their servers keep doing it.

Anyone got Tim Cook's number? If you do, bet you can get some, uh, exposure for this problem real quick.

I think it’s inappropriate to make (or imply) a call to action in a public forum to violate the privacy of a public figure (or anyone, but a public figure in this case). There’s low probability that Tim’s personal accounts or devices are easily accessible by the public, and I assume he has a team dedicated to his personal security, but let’s not encourage folks to start scheming...

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#173

Post by RKearney »

bitpush wrote: post #63

I don't want to be harsh, but Apple really should walk the talk regarding privacy. It has its heart in the right place but bugs like this show how careless they are.

I never thought of Apple as caring much about privacy given the insane amount of third party tracking scripts loaded in apps on the AppStore. What I would give for LittleSnitch running on iOS...

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#174

Post by LeoNatan25 »

saagarjha wrote: post #162
LeoNatan25 wrote: post #151

Earlier quoted context omitted.

I am not speaking about dedicated security teams. What security training is there for end-user app developers at Apple? From discussions with developers I know, it doesn't seem to exist, or at least not spread everywhere.

Maybe it's not enough for your satisfaction, but there are resources available for writing safe and secure code (I'm not sure if this is required, though), as well as regular audits by the security team.

I come from a security background (6 years in a security firm), and I have seen some pretty paranoid practices. I do not wish that to be prevalent. One thing which I really did appreciate in that firm, and find very valuable, was putting every developer and product person on a security awareness and secure coding course, where basics are taught, but also an attempt is made to push a security-first mindset.

I am now in a consumer-oriented company, and while I appreciate the much more relaxed environment, I am often shocked at how no attention or thought is paid to security. It baffles me that management, at the very least, has little care for this stuff.

This is an industry-wide problem.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#175

Post by m3kw9 »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

Would be a server bug for sure

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#177

Post by samstave »

stiGGG wrote: post #170
samstave wrote: post #144

Earlier quoted context omitted.

http://i.imgur.com/rG0p0b2.gif

Oh dear, I remember something similar was possible on iOS lockscreen multiple times. What version of Windows was that?

95. 98 had an even better one... just hitting cancel on some login boxes would let you in.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#178

Post by casefields »

ummonk wrote: post #32
preinheimer wrote: post #10

As an apple user I'm concerned. I hope it doesn't turn out that Apple has known about this for weeks/months/whatever. On the upside I have a lot of confidence that they can fix this, and that I can receive that patch in a timely fashion.

They said later this week, which seems surprisingly untimely given the severity of this bug.

Also, lets not forget Trump, against security advice, has remained using his iphone. oof.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#179

Post by casefields »

withinrafael wrote: post #65
tills13 wrote: post #61

Earlier quoted context omitted.

This has been disproven time and time again.

OP is referring to the ability to tap into any Alexa device, a feature Amazon calls Drop In ( https://www.amazon.com/gp/help/customer/display.html?nodeId=... ).

Google Duo does offers it as well.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#180

Post by Karupan »

nexuist wrote: post #166
Karupan wrote: post #150

Just thinking out loud here - why isn't there legislation that makes it mandatory for phone manufacturers to send out a notification to all devices affected by serious security flaws (like this one)? Not only will fixing and rolling out an update take a while, there is also no guarantee that the update will be installed. Meanwhile, hackers will have a field day. Or maybe there is already one, and I'm blissfully ignor…

Just to play devil's advocate (not a lawyer though): What constitutes a "phone"? Any device with cellular capabilities? What about WiFi calls? What if it's an industrial device with no network (LTE/data) access? Is a laptop with a 3G modem covered under this? I would suspect the problem is in defining what devices to target, and also the fact that forcing any company to modify the functionality could be perceived as…

Valid points. How about restricting the scope to devices connected to a network and having some sort of push notification capability?

> In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app.

> I agree that it might be a good idea to differentiate between a normal update and a security critical one, though.

But there is no mention of severity like you pointed out, and that is crucial. And till such a patch is available, Apple should notify users to disable offending apps/features if possible.

Post reply on HN