> In a statement, an Apple spokesperson said the company is "aware of this issue and we have identified a fix that will be released in a software update later this week."
https://www.buzzfeednews.com/article/nicolenguyen/facetime-b...
FaceTime bug lets you hear audio of person you are calling before they pick up
11–20 of 458 posts
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#12Security and privacy are two big parts of the marketing for the iPhone.
I'm curious how they can mitigate the reputational damage.
Edit:
It gets worse:
https://www.theverge.com/2019/1/28/18201383/apple-facetime-b...
If the recipient rejects the call by pressing the power button, it starts sending video.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#13I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#14That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.
Unless Apple decides they face significant legal exposure over the bug somehow I don't see them doing that. It would attract so much more attention that it would almost certainly not be worth it economically. I wonder if they (executives? engineers? the company itself?) could be charged with aiding and abetting wiretapping or something now that they know it's happening and are letting their servers keep doing it.
Do you think they will just ask all their employees to manually disable facetime in the meantime?
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#15I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
This is a form of speculation which increases performance in the common case where the call is accepted.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#16Security and privacy are two big parts of the marketing for the iPhone. I'm curious how they can mitigate the reputational damage. Edit: It gets worse: https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... If the recipient rejects the call by pressing the power button, it starts sending video.
Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior?
It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person.
Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#17I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
Maybe it did used to work, but now because of a seemingly unrelated bug fix, it has broken it. Wack-a-mole style.
Takes the engineering right out of software engineering if you ask me.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#18Security and privacy are two big parts of the marketing for the iPhone. I'm curious how they can mitigate the reputational damage. Edit: It gets worse: https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... If the recipient rejects the call by pressing the power button, it starts sending video.
Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person.…
> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior?
Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#19I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
doesn’t help that their bug bounty program is invite-only ( at least the last time I checked )
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#20Earlier quoted context omitted.
This is assuming there is no possible server side mitigation.
Even if there is a server side mitigation, it's a big black eye to have devices being remotely tappable with no user interaction. The devices are obviously not trustworthy anymore with the current software, and you are at the mercy of apple's servers. So a spying apple could always undo the server side mitigation (if even this is mitigatable server side). It's also a wakeup call to see that it is even possible for de…
> but the public perception might be forever changed.
No. Human fix their first impression and seldom change.
Soon after Apple release a fix, they will boost how fast Apple fix bugs.
It take a decades to realize no software is secure.