Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

Post reply on HN
Print view View original

241–250 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#241

Post by semi-extrinsic »

seanp2k2 wrote: post #123
biggestdecision wrote: post #69

Earlier quoted context omitted.

This bug only applied to grub authentication, which isn't a widely used feature. And you could achieve the same result with boot from disk/USB if that is enabled. The vuln doesn't give you access to the actual accounts on the computer.

Let's not forget https://www.cvedetails.com/cve/CVE-2013-1050/ and https://www.cvedetails.com/cve/CVE-2015-7496/ and https://www.cvedetails.com/cve/CVE-2017-8900/ (to a lesser extent). Check out https://www.cvedetails.com/vulnerability-list.php?vendor_id=... for more fun.

This was the worst one for me:

https://www.cvedetails.com/cve/CVE-2017-12712/

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#243

Post by laumars »

codedokode wrote: post #240
judge2020 wrote: post #47

Earlier quoted context omitted.

Not Apple related, but you could log into any linux box using a specific few versions of grub2 by hitting backspace 28 times: https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-...

Also, you can bypass screen lock in Ubuntu by removing the HDD [1]. The bug still is not fixed. [1] https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1777415

Honestly, I wouldn’t but that in the same class if bugs as those that preceded it because if the attacker he removed the HDD he will have access to your contents anyway (unless the HDD is encrypted) and it’s not a quick and convenient process either (unlike tapping backspace multiple times).

That said, I also don’t agree that this bug should never get fixed either.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#244

Post by lathiat »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

It generally happens because you don’t follow a defined state machine. An example of how this might happen is when starting the call the microphone isn’t opened. Then you add someone else to the Group FaceTime, the event handler for they didn’t stop to consider if the call is active (just assumed it is) and now the code for that handler opens a new port to the microphone so that it can encrypt the audio stream differently for that recipient.

Super easy and not remotely malicious. It’s a failed state check.

The actual bug here might be different but that’s an easy example. But it may also effectively be the bug since all the examples mention adding yourself to the call.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#245

Post by Hydraulix989 »

lathiat wrote: post #244
NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

It generally happens because you don’t follow a defined state machine. An example of how this might happen is when starting the call the microphone isn’t opened. Then you add someone else to the Group FaceTime, the event handler for they didn’t stop to consider if the call is active (just assumed it is) and now the code for that handler opens a new port to the microphone so that it can encrypt the audio stream differ…

I did a bit of WebRTC development for video chat, and the state machine for that is one of the most complicated I've ever dealt with. Even household name-brand commercial providers don't handle all of the edge cases. It took me about a week to get it right. Session negotiation gone wrong can easily cause audio to be heard before the call is established (and this will certainly happen with the naive implementation -- even Google's own reference implementation had issues).

If you're curious, check out this flowchart slide from a Google I/O WebRTC talk:

https://image.slidesharecdn.com/2014q2-geekandkranky-scalabi...

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#246

Post by mcpherrinm »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

This seems like a state machine bug to me.

If you consider what happens when you add a third person to a call: You start sending them everyone's audio!

That's the desired behavior and exactly what happened here.

Except the client should have probably checked if the call had been accepted first. That's why I say it's a state machine bug: The "Send audio" function should have never been activated in state "waiting to accept".

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#247

Post by smelendez »

tedunangst wrote: post #73
Someone1234 wrote: post #37

Earlier quoted context omitted.

It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely: https://www.theregister.co.uk/2017/11/28/root_access_bypass_... And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password: https://www.theregister.co.uk/2017/10/05/apple_patches_passw... All within…

I find those bugs less puzzling because the timeline makes sense. You're not logged in, there's a prompt, you're logged in. Obvious bug in the prompt, but the A happens before B happens before C order is there. Call comes in, audio is recorded, call is accepted is not the expected order. I could imagine a bug where declining the call still accepts the call, because that still obeys the proper ordering, but this bug d…

From the details, it sounds like "adding" the caller to the call before the call recipient accepts probably puts it in a weird state. Could be some kind of off-by-one error, where for some purposes Participant 2 is the caller and for some it's the recipient.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#248

Post by blub »

kiwijamo wrote: post #41

The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.

Something similar happened to me: I got a FaceTime call and both my phone and an iPhone nearby rang! Both contacts were known to the caller, but the AppleIDs were of course different.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#249

Post by yalok »

kiwijamo wrote: post #41

The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.

Observed the same problem the other day.
Post reply on HN