24 ms·

FaceTime bug lets you hear audio of person you are calling before they pick up

1534 points by uptown 8y ago

deleted 8y ago
[deleted]
0x0 8y ago
That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.
- gpm 8y ago
  Unless Apple decides they face significant legal exposure over the bug somehow I don't see them doing that. It would attract so much more attention that it would almost certainly not be worth it economically. I wonder if they (executives? engineers? the company itself?) could be charged with aiding and abetting wiretapping or something now that they know it's happening and are letting their servers keep doing it.
  - 0x0 8y ago
    Do you think they will just ask all their employees to manually disable facetime in the meantime?
  - paultopia 8y ago
    Anyone got Tim Cook's number? If you do, bet you can get some, uh, exposure for this problem real quick.
    - crgt 8y ago
      Anyone try FaceTiming his email? Could be linked to iCloud and FaceTime-able..
      - samstave 8y ago
        [redacted]
        xuki 8y ago
        That’s not his Apple email.
        samstave 8y ago
        I know. I didnt want to post his supposedly actual public email for fear of being accused of doxxing him.
        saagarjha 8y ago
        I doubt he has his public email hooked up to his iPhone's iMessage/FaceTime, anyways.
        netsharc 8y ago
        I wouldn't be surprised if Apple has their own internal iCloud network. Just like Google has their Apps for Business, Apple could have one but just inwards-facing and not hosting any other business. This means even if you have his internal FaceTime/iMessage ID, you wouldn't be able to contact him because his account and yours exist in 2 realms. Then again I guess he'd need an external-facing one for public VVIP to FaceTime him. Maybe he just carries 2 phones?
        saagarjha 8y ago
        Apple has iCloud@Work, but I don't think it supports iMessage and FaceTime.
        gammateam 8y ago
        That's what the sockpuppet account and TOR is for.
    - gpm 8y ago
      I suppose I did suggest trying to convict Apple with aiding in wiretapping, I really don't think being the one they are aiding is a good idea...
    - theDoug 8y ago
      "We must keep fighting for the kind of world we want to live in. On this #DataPrivacyDay let us all insist on action and reform for vital privacy protections. The dangers are real and the consequences are too important." - Tim Cook today in what is now a bit ironic https://mobile.twitter.com/tim_cook/status/1090001767780179969 https://mobile.twitter.com/tim_cook/status/10900017677801799...
    - deleted 8y ago
      [deleted]
    - awhitty 8y ago
      I think it’s inappropriate to make (or imply) a call to action in a public forum to violate the privacy of a public figure (or anyone, but a public figure in this case). There’s low probability that Tim’s personal accounts or devices are easily accessible by the public, and I assume he has a team dedicated to his personal security, but let’s not encourage folks to start scheming...
      - bookofjoe 8y ago
        see: https://www.reddit.com/r/apple/comments/77hl5k/i_sent_an_email_to_tim_cook_the_other_day_and_he/ https://www.reddit.com/r/apple/comments/77hl5k/i_sent_an_ema...
    - bookofjoe 8y ago
      I use tcook@apple.com. Full disclosure: so far, it's been one-way correspondence; I've yet to hear back.
- stcredzero 8y ago
  That's a pretty huge flaw. Millions if not... Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? I think their engineering is losing quality or is falling behind on what they have to cover.
  - JeremyBanks 8y ago
    Comparable examples?
    - stcredzero 8y ago
      Just off the top of my head: I think on three separate occasions, specifically crafted text messages have made the Messages app disappear from iOS, requiring a reboot. There was a comparable MacOS login bug not too long ago.
  - saagarjha 8y ago
    Quality concerns aside, any bug in iOS instantly affects a billion people by virtue of the number of active users it has.
  - jsjohnst 8y ago
    > Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? Couldn't the same statement be made about Facebook, Google, Yahoo, and other very large tech companies too? When a company has a billion users, pretty much any huge flaw is going to have a very wide reaching impact.
- dannyw 8y ago
  Perhaps apppe should disable Group FaceTime calls until an update is out.
  - smmnyc 8y ago
    Done!
    - chmaynard 8y ago
      Tim, is that you?
  - twothumbsup 8y ago
    They have Group FT disabled on the backend for now according to The Verge article about this.
qrbLPHiKpiux 8y ago
Not for long. Will be patched in hours, I bet.
- 0x0 8y ago
  They would probably need to at least blacklist every affected ios version from the facetime servers, there will be a long trail of devices not updating soon
  - xfitm3 8y ago
    This is assuming there is no possible server side mitigation.
    - 0x0 8y ago
      Even if there is a server side mitigation, it's a big black eye to have devices being remotely tappable with no user interaction. The devices are obviously not trustworthy anymore with the current software, and you are at the mercy of apple's servers. So a spying apple could always undo the server side mitigation (if even this is mitigatable server side). It's also a wakeup call to see that it is even possible for devices to start sharing audio or video with no user interaction. Obvious in hindsight for a software engineer perhaps, but the public perception might be forever changed.
      - j16sdiz 8y ago
        > but the public perception might be forever changed. No. Human fix their first impression and seldom change. Soon after Apple release a fix, they will boost how fast Apple fix bugs. It take a decades to realize no software is secure.
      - giancarlostoro 8y ago
        I mean, you can disable Facetime: https://www.imore.com/how-to-turn-on-off-restrict-facetime-iphone-ipad https://www.imore.com/how-to-turn-on-off-restrict-facetime-i... So I wouldn't get all the tinfoil over this matter, I would probably disable Facetime if I were most people though. Then it's likely to only be an issue of audio being streamed, much less horrible than inappropriate video streaming. I would hope they roll out a server-sided fix initially. "If calling user, if user ads themselves to group call, hang up group call" or some silly logic. I rather see that first, and then the client-side fix.
preinheimer 8y ago
As an apple user I'm concerned. I hope it doesn't turn out that Apple has known about this for weeks/months/whatever. On the upside I have a lot of confidence that they can fix this, and that I can receive that patch in a timely fashion.
- ummonk 8y ago
  They said later this week, which seems surprisingly untimely given the severity of this bug.
  - casefields 8y ago
    Also, lets not forget Trump, against security advice, has remained using his iphone. oof.
minimaxir 8y ago
> In a statement, an Apple spokesperson said the company is "aware of this issue and we have identified a fix that will be released in a software update later this week." https://www.buzzfeednews.com/article/nicolenguyen/facetime-bug-iphone https://www.buzzfeednews.com/article/nicolenguyen/facetime-b...
Jonnax 8y ago
Security and privacy are two big parts of the marketing for the iPhone. I'm curious how they can mitigate the reputational damage. Edit: It gets worse: https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug-iphone-eavesdrop-listen-in-remote-call-security-issue https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... If the recipient rejects the call by pressing the power button, it starts sending video.
- akerl_ 8y ago
  Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person. Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.
  - giancarlostoro 8y ago
    > Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
    - akerl_ 8y ago
      I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.
philip1209 8y ago
Tomorrow's earnings call should be fun
NelsonMinar 8y ago
I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
- wmf 8y ago
  This is a form of speculation which increases performance in the common case where the call is accepted.
  - angott 8y ago
    I always wondered why FaceTime Audio has almost zero call establishment time on iOS, as opposed to WhatsApp or FB Messenger where you need to wait half a second before the audio feed kicks in after answering. Guess this is the reason!
    - kennywinker 8y ago
      That has not been my experience with facetime audio. For me it’s 3-10s wait after tapping the accept-call button before audio is connected.
  - hopler 8y ago
    Similar to how Nextels cellular "push to talk" fake walkie talkies worked.
    - jsjohnst 8y ago
      > Similar to how Nextels cellular "push to talk" fake walkie talkies worked. Not really. The reason the PTT was virtually instant connect has nothing to do with optimization tricks, but rather is a purpose built design of the network tech it was using. Nextel PTT didn't go over a normal cellular network, it went over something called iDEN[0]. iDEN provides a trunked radio service[1] which has a similarish feature to a conventional two-way radio. Sprint acquired Nextel and as iDEN wasn't as relevant anymore with the advances in cellular networks (despite those who actually used the PTT functionality), in 2013 Sprint shutdown the network to use it for additional LTE bandwidth in the 800mhz band[2]. [0] https://en.wikipedia.org/wiki/IDEN https://en.wikipedia.org/wiki/IDEN [1] https://en.wikipedia.org/wiki/Trunked_radio_system https://en.wikipedia.org/wiki/Trunked_radio_system [2] https://en.wikipedia.org/wiki/Nextel_Communications https://en.wikipedia.org/wiki/Nextel_Communications
dawnerd 8y ago
While they're getting a fix ready, might be smart to just disable FaceTime if you don't rely on it. https://www.imore.com/how-to-turn-on-off-restrict-facetime-iphone-ipad https://www.imore.com/how-to-turn-on-off-restrict-facetime-i...
- paulie_a 8y ago
  That just seems like a good idea anyways. FaceTime as a product just flat out seems stupid.
  - yoz-y 8y ago
    Why? I use it all the time and in terms of simplicity it beats all other video calling products.
    - peteretep 8y ago
      I'll take a stab at that, although I don't think it's stupid per-se. Everyone I talk to, I talk to via WhatsApp, LINE, or FB Messenger, and generally I only use that method to talk to them, whatever else they're on. All of those have easy one-press buttons to initiate video call. Using some kind of Apple-only technology? I mean I think most people I know are probably on an iPhone, but having to remember everyone's device to know if they can FaceTime? Ugh. I suspect I could work out how to FaceTime someone if you made me, but I'd have to work it out rather than just knowing it.
      - 7Z7 8y ago
        But isn't everyone being on WhatsApp or FB Messenger or whatever just elevating the device uncertainty to platform uncertainty? You still have to remember or check who is on what. It seems like if they generally are all on iPhone, FaceTime is the one thing you could reliably call them on, and it will even tell you right in the messages app if you can FaceTime them.
        peteretep 8y ago
DINKDINK 8y ago
I wonder if the Apple representative who said this would be "fixed later this week" realizes this allows any attacker to wiretap any iPhone user (that has the vuln)
- redblacktree 8y ago
  Yeah, that's bizarre. If my team were responsible for a bug like this, we'd be fixing it before we went home.
  - saagarjha 8y ago
    The team might be able to fix it today, but the fix needs to go through testing and then be built alongside the rest of iOS (a multi-hour process). I wouldn’t be surprised if this takes two or three days to roll out.
    - taftster 8y ago
      They obviously didn't test it the first time out. Why do they need to test it this time?
      - saagarjha 8y ago
        I don't see a bug in the patch to fix this bug going over very well with the press.
        Gigablah 8y ago
        It's not like they haven't done it before :) https://www.theguardian.com/technology/2017/nov/30/apple-macos-high-sierra-fix-breaks-file-sharing-password-security-flaw-emergency-patch https://www.theguardian.com/technology/2017/nov/30/apple-mac...
        saagarjha 8y ago
        Yeah, that's my point ;)
yy77 8y ago
An quick stop for the possbile privacy disaster for Apple is to stop group facetime call at once but not wait for later this week for bug fix. Could image that quite some one might already try to peek for privacy using this.
throwawaymjabba 8y ago
I would like to bring up something that happened to someone I know during WhatsApp call. Person A was in US and person B in India and were audio calling through Whastapp on something work related. Person A starts hearing someone else on his side, nothing unexpected on Bs side. A started a new call and everything was fine. A said it reminded him of the crosstalk that was common during the landline days. Could it be a bug or was someone listening and forgot to turn off their mic? No idea.
sys_64738 8y ago
Amazon calls this a feature in Alexa!
- tills13 8y ago
  This has been disproven time and time again.
  - withinrafael 8y ago
    OP is referring to the ability to tap into any Alexa device, a feature Amazon calls Drop In (https://www.amazon.com/gp/help/customer/display.html?nodeId=202153130 https://www.amazon.com/gp/help/customer/display.html?nodeId=...).
    - casefields 8y ago
      Google Duo does offers it as well.
      - jvolkman 8y ago
        I think you're referring to the Duo feature which shows a video of the caller to the person being called prior to answering. Basically the opposite of drop in and of this FaceTime issue.
    - rootusrootus 8y ago
      The receiving device has to grant permission, and every time you drop-in it plays a sound effect to alert the user they've been dropped-in on.
kiwijamo 8y ago
The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.
- greenleafjacob 8y ago
  Not sure if this was intentional but in security, Alice and Bob wre the names in hypotheticals for the attacker and unwitting victim since the RSA paper. https://en.m.wikipedia.org/wiki/Alice_and_Bob https://en.m.wikipedia.org/wiki/Alice_and_Bob
  - googlemike 8y ago
    Your comment shows a clear lack of contextual insight into general software security. Alice (A) and Bob (B) are ubiquitous in discussions: https://en.wikipedia.org/wiki/Alice_and_Bob https://en.wikipedia.org/wiki/Alice_and_Bob
    - justwalt 8y ago
      Not sure his comment deserved a response like that.
    - gammateam 8y ago
      ITT: lack of social cues all around, classic Hackernews
    - ShamelessC 8y ago
      Geez that was harsh...
  - marnett 8y ago
    Don’t get me started about Eve...
- 8y ago
manicdee 8y ago
Imagine, all this time Five Eyes actually had a way of breaching privacy and they only started making noise about access enablement recently because they knew someone was going to report the vulnerability to Apple.
joeblau 8y ago
I just called my friend who was already on a call talking to his brother. He could hear me and his brother but his brother and I couldn't hear each other. I was also able to call him, have him hang up and then see his video and hear his audio. He couldn't hear me, but I could hear and see everything. I'm turning my phone off tonight!
- argsv 8y ago
  is it not enough to disable FaceTime for the time being?
  - joeblau 8y ago
    You may not even have to do that. It looks like Apple disabled Group FaceTime server side[1]. [1] - https://news.ycombinator.com/item?id=19025329 https://news.ycombinator.com/item?id=19025329
  - omaranto 8y ago
    It probably is, but when you are freaked out you want certainty.
    - jimmaswell 8y ago
      Better remove the battery too. https://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news-18854.html https://www.tomsguide.com/us/nsa-remotely-turn-on-phones,new...
      - zuck9 8y ago
        Which you cannot do on iPhones.
        Tepix 8y ago
        ifixit.com :-)
  - deleted 8y ago
dannyw 8y ago
If I were Apple, I would be implementing a server side migration right now: - if someone adds their own email or phone number again to a group chat, immediately terminate the call As far as I know, this would mitigate the vulnerability. Alternatively, disable Group FaceTime calls altogether.
- rgovostes 8y ago
  It might trigger the bug to just invite any additional participant (say, a second phone the attacker possesses), in which case blocking only inviting oneself is not sufficient. My theory is that the server routes messages to everyone who has been invited to the call, even if they have not accepted it. One message might be "participant left," in which case if you are the last one, the call ends. Another would be "participant joined." The bug would center around the fact that the logic for handling a "participant joined" message does not check if the call has been accepted and makes an unexpected transition to a state that it should not be in. The "participant joined" code likely handles the case that the new participant was already present on the call. Why? Apple wants to support seamlessly transitioning your call from one device to another. That's why blocking might not be so straightforward from the server side.
- paxys 8y ago
  I'm pretty sure there are a lot of Apple engineers evaluating and testing fixes (including this one) as we speak.
- saagarjha 8y ago
  > Alternatively, disable Group FaceTime calls altogether. Apple has just done this.
bitpush 8y ago
I don't want to be harsh, but Apple really should walk the talk regarding privacy. It has its heart in the right place but bugs like this show how careless they are.
- AimForTheBushes 8y ago
  Software is hard.
- RKearney 8y ago
  I never thought of Apple as caring much about privacy given the insane amount of third party tracking scripts loaded in apps on the AppStore. What I would give for LittleSnitch running on iOS...
  - scottishfiction 8y ago
    Set up https://www.charlesproxy.com/ https://www.charlesproxy.com/ on the same network as your phone, then set it to be the phone's proxy server. Voila, you can now be horrified by the amount of tracking going on. You can even MITM SSL traffic by adding a trusted CA to your phone.
- blub 8y ago
  This is a security issue, where Apple is pretty crap, just like MS or Google or everybody else. Taking a look at the security patches of macOS, Android or Windows is pretty depressing. Privacy is concerned with the company purposefully spying on its users, like Google, MS or Facebook do.
LeoNatan25 8y ago
This is due to the very poor QA efforts Apple has, coupled with junior developers who lack a security-aware mindset. This is, sadly, the case with most companies these days. Zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability.
- saagarjha 8y ago
  > Zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability. What makes you think this?
  - LeoNatan25 8y ago
    The amount of bugs like this, specifically lock screen evasion bugs, bug also disk management bugs we've seen, etc. As I said, this is not specific to Apple. The whole industry lacks security awareness, and because people don't hold these companies accountable, there is little financial incentive to change that.
    - saagarjha 8y ago
      Your specific claim was that Apple has "zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability"–this isn't true at all. Sure, Apple's software has had some serious bugs in it, but this does not mean that they have no security practices in place.
      - LeoNatan25 8y ago
        I am not speaking about dedicated security teams. What security training is there for end-user app developers at Apple? From discussions with developers I know, it doesn't seem to exist, or at least not spread everywhere.
        saagarjha 8y ago
        Maybe it's not enough for your satisfaction, but there are resources available for writing safe and secure code (I'm not sure if this is required, though), as well as regular audits by the security team.
wufufufu 8y ago
They forgot to turn the NSA flag off in production
SamuelAdams 8y ago
Are there any specific Faraday bags that folks recommend?
- saagarjha 8y ago
  Why not just turn on airplane mode?
  - culturestate 8y ago
    If you don't trust the software in the first place, there's no real reason for you to trust that airplane mode is actually effective.
    - saagarjha 8y ago
      If you can't trust the software at all, you might be better served with turning your phone off :/
      - nkurz 8y ago
        Off may not be enough: https://www.wired.com/2014/06/nsa-bug-iphone/ https://www.wired.com/2014/06/nsa-bug-iphone/ Like the SamuelAdams said, you might do better with a Faraday bag.
dzhiurgis 8y ago
FaceTime audio ducking is the worst thing about FaceTime. Impossible to watch something online with another person. Also, FaceTime never closes after a call cleanly. Camera stays up until you right click + quite the app...
rgovostes 8y ago
Fun story: I tested this bug, initiating a call from my phone and then joining it on my Mac. After I had ended the call, the Mac's camera LED stayed on, even though the FaceTime app was not showing a video preview (in fact it had no windows open). Was it transmitting? Who knows! State management seems to be a mess all over the place.
- saagarjha 8y ago
  This means your camera was in use by some application. Whether that video left your device is harder to ascertain, but you can try quitting FaceTime to see if the light turns off.
kimburgess 8y ago
It may be entirely unrelated, however this is the exact sort of behaviour you would expect to see associated with providing compatibility with Australia's newly introduced AABill, or to implement GCHQ's ghost participant proposal (https://www.lawfareblog.com/principles-more-informed-exceptional-access-debate https://www.lawfareblog.com/principles-more-informed-excepti...).
- deleted 8y ago
  [deleted]
- FuckOffNeemo 8y ago
  I wish you weren't right.
- rjf72 8y ago
  The bizarre thing is how little people seem to have paid attention to Snowden. Apple joined the NSA's PRISM program in 2012. [1] PRISM enables the government to access data from participating companies including audio, video, and live chat. I'm linking to Wiki there only as a catalogue of sources. The page itself is useless and has overtly fake (though at least mildly amusing) quotes from Google. There's no need for new bills for these sort of issues to be a concern. I also tend to agree with you that this is not necessarily related to these programs. The reason I mention this at all is because I think there is a reasonable chance that this is related, that this overall issue is very important, and that the amount of cognitive dissonance on this is surprising and regressive. These programs are real. Companies facilitating access, including real time, to your data and "private" conversations is real. And it seems to only be getting worse. Yet people seem to convince themselves otherwise, including throughout this thread. Part of the reasons these programs are able to carry on mostly unchallenged is because people convince themselves that what is happening, is not. [1] - https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Media_disclosure_of_PRISM https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#M...
wtmt 8y ago
What about updates for people who don't update often or don't even see that there's an update? This is way too critical a bug for people who don't follow the news to not be taken care of (their devices, I mean). Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out, yet what I've seen is that point updates are left as optional and may not even show up unless one checks for an update. As much as forced new feature updates take freedom away from users, Apple needs to up its game on security fixes like this (that could be standalone) being pushed to all compatible devices ASAP (no waiting for the phone to be on the charger overnight, etc.).
- saagarjha 8y ago
  > Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out iOS upgrades are not mandatory by any means. > no waiting for the phone to be on the charger overnight, etc. This is how you get phones running out of battery halfway through an update.
  - wtmt 8y ago
    > iOS upgrades are not mandatory by any means. The upgrades are not mandatory, but the downloads certainly are. I've had to delete the iOS downloads several times over years (including the downloads for iOS 12) because iOS doesn't have an option to disable this, and it automatically downloads the upgrade in the background when on WiFi for a long enough time. It's a cumbersome process to delete the download. It's even worse when you consider that a downloaded update would be installed overnight if you leave the device on the charger and connected to WiFi and by mistake tap on install when that prompt appears at some random time. The user interface for controlling and managing iOS upgrades does not exist. > This is how you get phones running out of battery halfway through an update. The OS could always put a limit saying the phone should be charged at least 30-40% for an update to start installing. Even now, the upgrades and updates are allowed to go through for iPhones without them having to be on the charger.
argsv 8y ago
Premature optimization, perhaps. Don’t optimize by sending audio too early (as others have suggested) and why should I be able to add my own number to the conversation if I that number is the call’s initiator? Makes no sense.
- yreg 8y ago
  >why should I be able to add my own number to the conversation You might want to add several devices with the same facetime handle to the same call.
int_19h 8y ago
This sort of thing is why I'd prefer devices to come with hardware killswitches for mic, video, and various radio modules.
- notfed 8y ago
  iPhones already have a "mute" slider switch. When I first looked into iPhones (after years of Androids), my instant reaction upon seeing the slider switch was "Ah! FINALLY! I can feel at peace in the knowledge that software vulnerabilities are powerless to hack my camera or microphone!" Of course, stupidly, the slider doesn't "mute" my camera or microphone, but only my speaker. For Apple to modify this slider so that it mutes my camera and microphones would require the daunting addition of two transistors. And the act of such a simple modification would put an end to the incredibly creepy, Orwellian possible reality that we all risk taking a part in every time we glance at the familiar tiny screens we have become so intimately glued to. Apple should add those two transistors.
  - saagarjha 8y ago
    Are you suggesting that the silent switch also turns off the camera and microphone?
    - notfed 8y ago
      Yup. Or, at the least, have a separate switch that does so.
      - basil-rash 8y ago
        That went from "two transistors" to "an entirely separate physical component on the chassis" pretty quickly.
        notfed 8y ago
        He/she didn't like the first suggestion. (Actually, it seems most people commenting here don't. Apparently I'm in the minority on this one.)
reasonablemann 8y ago
People always ask me why I have the camera on my computer covered. There is still far too much trust in technology.
d-sc 8y ago
Just tried this with my brother. Apparently I can listen to his iMac audio from my phone. This could mean and increase in the time to fix the bug.
heyjudy 8y ago
NSA calling, please pick up. ;)
Karupan 8y ago
Just thinking out loud here - why isn't there legislation that makes it mandatory for phone manufacturers to send out a notification to all devices affected by serious security flaws (like this one)? Not only will fixing and rolling out an update take a while, there is also no guarantee that the update will be installed. Meanwhile, hackers will have a field day. Or maybe there is already one, and I'm blissfully ignorant!
- nexuist 8y ago
  Just to play devil's advocate (not a lawyer though): What constitutes a "phone"? Any device with cellular capabilities? What about WiFi calls? What if it's an industrial device with no network (LTE/data) access? Is a laptop with a 3G modem covered under this? I would suspect the problem is in defining what devices to target, and also the fact that forcing any company to modify the functionality could be perceived as a slippery slope (i.e. security notifications first, NSA backdoors later...) In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app. I agree that it might be a good idea to differentiate between a normal update and a security critical one, though.
  - Karupan 8y ago
    Valid points. How about restricting the scope to devices connected to a network and having some sort of push notification capability? > In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app. > I agree that it might be a good idea to differentiate between a normal update and a security critical one, though. But there is no mention of severity like you pointed out, and that is crucial. And till such a patch is available, Apple should notify users to disable offending apps/features if possible.
    - tedunangst 8y ago
      So... every computer running some sort of syslogd?
wilkskyes 8y ago
Should the engineers who were responsible for this be punished or retrained?
- wilkskyes 8y ago
  Surprised at the down votes here, is this to imply that things should just carry on as usual with no real consequence or remedy?
- frou_dh 8y ago
  The more pertinent question in this kind of situation is to the Lead/Architect. Namely, why have you created an environment in which quality can slip like this, and what are you going to change?
smmnyc 8y ago
Apple has disabled group FaceTime on their end. https://www.apple.com/support/systemstatus/ https://www.apple.com/support/systemstatus/
- timeimp 8y ago
  Oh damn, they can do it just like that? I thought FaceTime was a P2P thing... but it appears group FT requires Apple's servers?
  - snuxoll 8y ago
    It never was (or only was for a short period) thanks to patent trolls.
  - saagarjha 8y ago
    IIRC, this was because of a lawsuit with VirnetX.
  - _bxg1 8y ago
    Very few communication services are truly P2P; it's way more likely to have syncing issues and is virtually impossible without at least a handshake. Even Signal, which does have syncing issues due to being mostly P2P, requires a server for the initial handshake.
    - acchow 8y ago
      Especially on mobile, where you want to conserve battery life.
  - fizx 8y ago
    Each person only uploading one copy of video in a multiparty situation is a huge win for quality on mediocre connections.
    - TrickyRick 8y ago
      Skype used to be "P2P" where one party would act as the host in a group call.
drdrey 8y ago
Isn't it fantastic that the exact same bug works on 2 different OSes?
- sigjuice 8y ago
  Not exactly. There is likely a lot of common, if not identical code.
shiado 8y ago
Perhaps their NSA PRISM code got mixed up with their user facing code? I'm not just joking, we all know Apple only pays lip service to privacy and got caught red-handed during the Snowden leaks. VOIP is indeed listed. https://cdn.vox-cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=/0x0:700x525/1820x1213/filters:focal(294x206:406x318):format(webp)/cdn.vox-cdn.com/uploads/chorus_image/image/61159115/prism-slide-4.1419979622.0.jpg https://cdn.vox-cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=...
giardini 8y ago
Looks like iPhone spyware. I doubt that FaceTime is the first use of this "bug"!
ziont 8y ago
once i had to talk to my boss i didnt really like this explains it.
Mikeb85 8y ago
Is it just me, or does it seem Apple can't secure their services as well as Google? There's always 'concerns' about Google spying, but no proof, meanwhile there's been major hacks involving Apple that are quickly forgotten because the CEO claims to be all about privacy.
- alkibiades 8y ago
  the quantity of papers with major security flaws in android versus ios shows you all you need to know. there is an endless stream of android ones but very few ios okes
  - Mikeb85 8y ago
    Key word is services. iCloud had a very public hack, now this. What Google services have been exploited?
gigatexal 8y ago
They’ll fix it fast. People just love to crucify Apple for everything.
baxtr 8y ago
Seriously, I don’t think that this is so bad. Google advertised something similar like this as feature. Don’t get me wrong: it should be fixed. But the shitstorm is way too big
sgt 8y ago
I wonder how many devices are affected. Just tested between two iPhones running latest iOS and could not reproduce.
nurettin 8y ago
With the advent of microphone embedded computing devices, a bug can really become a bug.
docbrown 8y ago
Rumor mill: FaceTime bug was submitted to Apple on 20 January 2019 by a concerned mother after .. her 14-year-old son discovered it. >My teen found a major security flaw in Apple’s new iOS. He can listen in to your iPhone/iPad without your approval. I have video. Submitted bug report to @AppleSupport...waiting to hear back to provide details. Scary stuff! #apple #bugreport @foxnews [0] https://twitter.com/mgt7500/status/1087171594756083713?s=21 https://twitter.com/mgt7500/status/1087171594756083713?s=21
- samcday 8y ago
  If the mother did in fact submit a ticket a week ago, it's pretty shameful that the escalation / verification process took more than a week for a bug of this severity.
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
- npunt 8y ago
  Interesting twitter account. First tweet 1/1/19, few followers, mostly politics, then a major bug report (not only in discovery but in knowing how to go through the reporting process). Not saying it’s fake at all - it looks 100% legitimate - but it adds some extra bit of weirdness to this story. Quite the providence, and a really bad bug. (edited for clarity)
  - neya 8y ago
    The genuineness of the Twitter account is absolutely irrelevant in contrast to the validity of the bug itself. Apple was reported a high priority bug at a specific time. Who reported it, how they look like, what their Twitter profile looks like should have no impact on Apple's bug fixing process and how long/short they took to fix the bug.
wincent 8y ago
Reminds me of the time I FaceTimed my mother (in Australia) only to see the call answered by a total stranger (in Texas).
buraksarica 8y ago
We noticed a similar bug many years ago on a GSM enabled PDA device. I cannot recall the brand/model.
novaRom 8y ago
This will always happen with non-open source software.
- saagarjha 8y ago
  This also happens with open-source software too. It just takes a bit longer to figure out what's going on with closed-source software.
- dewey 8y ago
  Remember OpenSSL / Heartbleed etc?
crististm 8y ago
"Sagem GSM phone let's you hear the other party's audio before you pick up" - Demonstrated this last time about 6 years ago calling my phone from different networks: fixed, and two other GSM. My conclusion was that it's an implementation bug easy to trip on or a provision in standard that it's easy to misread. Now - if the audio channel is _right there_ for you to read, what chances are for this to be only a Sagem firmware bug?
shocks 8y ago
On the 1st of November a friend shared with me a screenshot from the Instagram of a concerned parent explaining a situation in which her child was being cyber bullied, and it was clear from the content of the messages that the bully could her their private conversations. I guess this bug has been know and abused for at least three months?
illwrks 8y ago
My colleague and I experienced the same thing last week on his Samsung phone. Another colleague was calling us to talk about a project, we were chatting away and in the few seconds before the phone was 'answered' our colleague heard what we were talking about.
ainiriand 8y ago
It is super crazy that when you apply for a dev job in companies like this you have to be like a small Alan Turing and yet things like this happens.
ChucklesNorris 8y ago
"Bug"? What came to my mind was "bugged." Zuckerberg needs to answer more questions before Congress, this time under oath.
titzer 8y ago
Open. Source.
ChucklesNorris 8y ago
There was a recent article which correctly pointed out the Samsung phone owners cannot uninstall Facebook from their phones. It is best to assume that you're always being listened to, and watched. User settings can always be overridden, buried in code you'll never see.
FabHK 8y ago
I must admit that when reading yet another privacy-invasion-headline I saw "Facebook", not FaceTime/Apple. Not sure whether it's more indicative of unjustified prejudice or actual precedent.
- briandear 8y ago
  The difference is that Facebook does it intentionally.
Antifragile1 8y ago
iFaggots still boycotting Huawei?
z3t4 8y ago
I guess when it's virtually impossible to get into contact with the developers they will get their "bug reports" via the news.
apple_pol_throw 8y ago
I worry about Apple. Software quality has been dropping, but it's not Swift or some other specific technology that's the problem. It's talent. The company has had a hard time attracting very senior talent. The difficulty is self-imposed and comes from leadership's strict policy of not paying market wages at the high end. Multiple hiring managers at Apple have complained to me that they've lost good people because the company just won't match offers from the Googles and Facebooks of the world. Apple refuses to acknowledge the reality of the market. Given that Apple's most experienced people keep retiring and that Apple isn't replacing them with equals, I expect software quality to continue to drop until leadership decides to abandon its shortsighted comp restrictions. [Posting from a throwaway for obvious reasons]
hema_n 8y ago
I am unaware of this problem..as I am an android user.
- rootusrootus 8y ago
  Yeah, with the long list of things you have to worry about, I wouldn't be worried about an iPhone problem either.
fma 8y ago
I'll admit I have limited knowledge on iPhone security... But would it be technically possible to do this with other apps? For example if one has Wechat, can there be a backdoor to be listened in on? Thinking about state actors...
CodeSheikh 8y ago
I feel like around three years ago Apple engineering changed QA leadership or restructured org in that dept and the quality has been down. Prior to IOS9, I have had barely noticed bugs. But now I am in that "used-to" mode that I have learned to ignore such bugs or nuances.
chx 8y ago
Oof. I am reasonably sure very very soon there will be a number of very polite but very pointed questions on Apple's desk from concerned lawmakers, data protection authorities and such not only from the USA but the European Union as well about how this happened and what are they doing to make sure this doesn't happen again. I can very well see the European Data Protection Supervisor fining them to some very interesting amount as well.
tammer 8y ago
I encountered a bug a while back — when I would connect to a dial-out call to get onto my company’s conference service from its app, while using a pair of cheap Bluetooth headphones (I’ve upgraded since then!) the mute button didn’t work. As in, the mute button would be clearly activated, but my audio still carried through to the call. As in, I discovered this in quite an embarrassing way. I filed a radar but never got a real response about it. Really there appears to be a strong need at Apple to ensure QA is checking for confirmations of user interaction. As I haven’t experienced anything like this since I’m still with them but these types of problems are the very thing that would lead me to shake my deep investment in the Apple ecosystem.
- josu 8y ago
  I have serious trust issues with mute buttons. I rather not say anything I may regret while the mic is muted.
danra 8y ago
Apple’s bug handling is broken. Anyone who has filed a few rdars knows it is thankless work. The amount of work you have to invest for anyone to even look at your bug is high. In the instance of this particular bug, I wouldn’t be surprised if at least part of the reason it took a week and a half to handle since it was reported was that the initial reply to the reporter was “please send us the exact steps to reproduce” and then nothing was done until the bug reporter replied back. I wouldn’t be surprised to learn there were even a few iterations of this, since I personally experienced it. Then, your bug gets looked at. But you don’t know anything about its status. Until anything from a few days to a few months later, it gets closed as a duplicate. Of course there is no way to know in advance that the bug was already opened, and that you could save an hour of work time instead of making a minimal reproducible version of your app which reproduces the bug. At least, that’s been my unfortunate experience. /rant
gargalatas 8y ago
Damn! And it was a feature they would disclose in the next apple event...
samstave 8y ago
A fun though experiment for a bug like this would have been to test lists of emails against validating the ability to FaceTime call with the email and determine if it was used as the iCloud email address... Had this bug gone unknown longer - then you'd have a list of all the endpoints you could spy on.

1534 points by uptown 8y ago

deleted 8y ago

[deleted]

0x0 8y ago

That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number? Perhaps Apple should simply pull the plug on the facetime servers for now.

gpm 8y ago
Unless Apple decides they face significant legal exposure over the bug somehow I don't see them doing that. It would attract so much more attention that it would almost certainly not be worth it economically. I wonder if they (executives? engineers? the company itself?) could be charged with aiding and abetting wiretapping or something now that they know it's happening and are letting their servers keep doing it.
- 0x0 8y ago
  Do you think they will just ask all their employees to manually disable facetime in the meantime?
- paultopia 8y ago
  Anyone got Tim Cook's number? If you do, bet you can get some, uh, exposure for this problem real quick.
  - crgt 8y ago
    Anyone try FaceTiming his email? Could be linked to iCloud and FaceTime-able..
    - samstave 8y ago
      [redacted]
      - xuki 8y ago
        That’s not his Apple email.
        samstave 8y ago
        I know. I didnt want to post his supposedly actual public email for fear of being accused of doxxing him.
        saagarjha 8y ago
        I doubt he has his public email hooked up to his iPhone's iMessage/FaceTime, anyways.
        netsharc 8y ago
        I wouldn't be surprised if Apple has their own internal iCloud network. Just like Google has their Apps for Business, Apple could have one but just inwards-facing and not hosting any other business. This means even if you have his internal FaceTime/iMessage ID, you wouldn't be able to contact him because his account and yours exist in 2 realms. Then again I guess he'd need an external-facing one for public VVIP to FaceTime him. Maybe he just carries 2 phones?
        saagarjha 8y ago
        Apple has iCloud@Work, but I don't think it supports iMessage and FaceTime.
        gammateam 8y ago
        That's what the sockpuppet account and TOR is for.
  - gpm 8y ago
    I suppose I did suggest trying to convict Apple with aiding in wiretapping, I really don't think being the one they are aiding is a good idea...
  - theDoug 8y ago
    "We must keep fighting for the kind of world we want to live in. On this #DataPrivacyDay let us all insist on action and reform for vital privacy protections. The dangers are real and the consequences are too important." - Tim Cook today in what is now a bit ironic https://mobile.twitter.com/tim_cook/status/1090001767780179969 https://mobile.twitter.com/tim_cook/status/10900017677801799...
  - deleted 8y ago
    [deleted]
  - awhitty 8y ago
    I think it’s inappropriate to make (or imply) a call to action in a public forum to violate the privacy of a public figure (or anyone, but a public figure in this case). There’s low probability that Tim’s personal accounts or devices are easily accessible by the public, and I assume he has a team dedicated to his personal security, but let’s not encourage folks to start scheming...
    - bookofjoe 8y ago
      see: https://www.reddit.com/r/apple/comments/77hl5k/i_sent_an_email_to_tim_cook_the_other_day_and_he/ https://www.reddit.com/r/apple/comments/77hl5k/i_sent_an_ema...
  - bookofjoe 8y ago
    I use tcook@apple.com. Full disclosure: so far, it's been one-way correspondence; I've yet to hear back.
stcredzero 8y ago
That's a pretty huge flaw. Millions if not... Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? I think their engineering is losing quality or is falling behind on what they have to cover.
- JeremyBanks 8y ago
  Comparable examples?
  - stcredzero 8y ago
    Just off the top of my head: I think on three separate occasions, specifically crafted text messages have made the Messages app disappear from iOS, requiring a reboot. There was a comparable MacOS login bug not too long ago.
- saagarjha 8y ago
  Quality concerns aside, any bug in iOS instantly affects a billion people by virtue of the number of active users it has.
- jsjohnst 8y ago
  > Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? Couldn't the same statement be made about Facebook, Google, Yahoo, and other very large tech companies too? When a company has a billion users, pretty much any huge flaw is going to have a very wide reaching impact.
dannyw 8y ago
Perhaps apppe should disable Group FaceTime calls until an update is out.
- smmnyc 8y ago
  Done!
  - chmaynard 8y ago
    Tim, is that you?
- twothumbsup 8y ago
  They have Group FT disabled on the backend for now according to The Verge article about this.

qrbLPHiKpiux 8y ago

Not for long. Will be patched in hours, I bet.

0x0 8y ago
They would probably need to at least blacklist every affected ios version from the facetime servers, there will be a long trail of devices not updating soon
- xfitm3 8y ago
  This is assuming there is no possible server side mitigation.
  - 0x0 8y ago
    Even if there is a server side mitigation, it's a big black eye to have devices being remotely tappable with no user interaction. The devices are obviously not trustworthy anymore with the current software, and you are at the mercy of apple's servers. So a spying apple could always undo the server side mitigation (if even this is mitigatable server side). It's also a wakeup call to see that it is even possible for devices to start sharing audio or video with no user interaction. Obvious in hindsight for a software engineer perhaps, but the public perception might be forever changed.
    - j16sdiz 8y ago
      > but the public perception might be forever changed. No. Human fix their first impression and seldom change. Soon after Apple release a fix, they will boost how fast Apple fix bugs. It take a decades to realize no software is secure.
    - giancarlostoro 8y ago
      I mean, you can disable Facetime: https://www.imore.com/how-to-turn-on-off-restrict-facetime-iphone-ipad https://www.imore.com/how-to-turn-on-off-restrict-facetime-i... So I wouldn't get all the tinfoil over this matter, I would probably disable Facetime if I were most people though. Then it's likely to only be an issue of audio being streamed, much less horrible than inappropriate video streaming. I would hope they roll out a server-sided fix initially. "If calling user, if user ads themselves to group call, hang up group call" or some silly logic. I rather see that first, and then the client-side fix.

preinheimer 8y ago

As an apple user I'm concerned. I hope it doesn't turn out that Apple has known about this for weeks/months/whatever. On the upside I have a lot of confidence that they can fix this, and that I can receive that patch in a timely fashion.

ummonk 8y ago
They said later this week, which seems surprisingly untimely given the severity of this bug.
- casefields 8y ago
  Also, lets not forget Trump, against security advice, has remained using his iphone. oof.

minimaxir 8y ago

> In a statement, an Apple spokesperson said the company is "aware of this issue and we have identified a fix that will be released in a software update later this week." https://www.buzzfeednews.com/article/nicolenguyen/facetime-bug-iphone https://www.buzzfeednews.com/article/nicolenguyen/facetime-b...

Jonnax 8y ago

Security and privacy are two big parts of the marketing for the iPhone. I'm curious how they can mitigate the reputational damage. Edit: It gets worse: https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug-iphone-eavesdrop-listen-in-remote-call-security-issue https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... If the recipient rejects the call by pressing the power button, it starts sending video.

akerl_ 8y ago
Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person. Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.
- giancarlostoro 8y ago
  > Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
  - akerl_ 8y ago
    I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.

philip1209 8y ago

Tomorrow's earnings call should be fun

NelsonMinar 8y ago

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

wmf 8y ago
This is a form of speculation which increases performance in the common case where the call is accepted.
- angott 8y ago
  I always wondered why FaceTime Audio has almost zero call establishment time on iOS, as opposed to WhatsApp or FB Messenger where you need to wait half a second before the audio feed kicks in after answering. Guess this is the reason!
  - kennywinker 8y ago
    That has not been my experience with facetime audio. For me it’s 3-10s wait after tapping the accept-call button before audio is connected.
- hopler 8y ago
  Similar to how Nextels cellular "push to talk" fake walkie talkies worked.
  - jsjohnst 8y ago
    > Similar to how Nextels cellular "push to talk" fake walkie talkies worked. Not really. The reason the PTT was virtually instant connect has nothing to do with optimization tricks, but rather is a purpose built design of the network tech it was using. Nextel PTT didn't go over a normal cellular network, it went over something called iDEN[0]. iDEN provides a trunked radio service[1] which has a similarish feature to a conventional two-way radio. Sprint acquired Nextel and as iDEN wasn't as relevant anymore with the advances in cellular networks (despite those who actually used the PTT functionality), in 2013 Sprint shutdown the network to use it for additional LTE bandwidth in the 800mhz band[2]. [0] https://en.wikipedia.org/wiki/IDEN https://en.wikipedia.org/wiki/IDEN [1] https://en.wikipedia.org/wiki/Trunked_radio_system https://en.wikipedia.org/wiki/Trunked_radio_system [2] https://en.wikipedia.org/wiki/Nextel_Communications https://en.wikipedia.org/wiki/Nextel_Communications

dawnerd 8y ago

While they're getting a fix ready, might be smart to just disable FaceTime if you don't rely on it. https://www.imore.com/how-to-turn-on-off-restrict-facetime-iphone-ipad https://www.imore.com/how-to-turn-on-off-restrict-facetime-i...

paulie_a 8y ago
That just seems like a good idea anyways. FaceTime as a product just flat out seems stupid.
- yoz-y 8y ago
  Why? I use it all the time and in terms of simplicity it beats all other video calling products.
  - peteretep 8y ago
    I'll take a stab at that, although I don't think it's stupid per-se. Everyone I talk to, I talk to via WhatsApp, LINE, or FB Messenger, and generally I only use that method to talk to them, whatever else they're on. All of those have easy one-press buttons to initiate video call. Using some kind of Apple-only technology? I mean I think most people I know are probably on an iPhone, but having to remember everyone's device to know if they can FaceTime? Ugh. I suspect I could work out how to FaceTime someone if you made me, but I'd have to work it out rather than just knowing it.
    - 7Z7 8y ago
      But isn't everyone being on WhatsApp or FB Messenger or whatever just elevating the device uncertainty to platform uncertainty? You still have to remember or check who is on what. It seems like if they generally are all on iPhone, FaceTime is the one thing you could reliably call them on, and it will even tell you right in the messages app if you can FaceTime them.
      - peteretep 8y ago

DINKDINK 8y ago

I wonder if the Apple representative who said this would be "fixed later this week" realizes this allows any attacker to wiretap any iPhone user (that has the vuln)

redblacktree 8y ago
Yeah, that's bizarre. If my team were responsible for a bug like this, we'd be fixing it before we went home.
- saagarjha 8y ago
  The team might be able to fix it today, but the fix needs to go through testing and then be built alongside the rest of iOS (a multi-hour process). I wouldn’t be surprised if this takes two or three days to roll out.
  - taftster 8y ago
    They obviously didn't test it the first time out. Why do they need to test it this time?
    - saagarjha 8y ago
      I don't see a bug in the patch to fix this bug going over very well with the press.
      - Gigablah 8y ago
        It's not like they haven't done it before :) https://www.theguardian.com/technology/2017/nov/30/apple-macos-high-sierra-fix-breaks-file-sharing-password-security-flaw-emergency-patch https://www.theguardian.com/technology/2017/nov/30/apple-mac...
        saagarjha 8y ago
        Yeah, that's my point ;)

yy77 8y ago

An quick stop for the possbile privacy disaster for Apple is to stop group facetime call at once but not wait for later this week for bug fix. Could image that quite some one might already try to peek for privacy using this.

throwawaymjabba 8y ago

I would like to bring up something that happened to someone I know during WhatsApp call. Person A was in US and person B in India and were audio calling through Whastapp on something work related. Person A starts hearing someone else on his side, nothing unexpected on Bs side. A started a new call and everything was fine. A said it reminded him of the crosstalk that was common during the landline days. Could it be a bug or was someone listening and forgot to turn off their mic? No idea.

sys_64738 8y ago

Amazon calls this a feature in Alexa!

tills13 8y ago
This has been disproven time and time again.
- withinrafael 8y ago
  OP is referring to the ability to tap into any Alexa device, a feature Amazon calls Drop In (https://www.amazon.com/gp/help/customer/display.html?nodeId=202153130 https://www.amazon.com/gp/help/customer/display.html?nodeId=...).
  - casefields 8y ago
    Google Duo does offers it as well.
    - jvolkman 8y ago
      I think you're referring to the Duo feature which shows a video of the caller to the person being called prior to answering. Basically the opposite of drop in and of this FaceTime issue.
  - rootusrootus 8y ago
    The receiving device has to grant permission, and every time you drop-in it plays a sound effect to alert the user they've been dropped-in on.

kiwijamo 8y ago

The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.

greenleafjacob 8y ago
Not sure if this was intentional but in security, Alice and Bob wre the names in hypotheticals for the attacker and unwitting victim since the RSA paper. https://en.m.wikipedia.org/wiki/Alice_and_Bob https://en.m.wikipedia.org/wiki/Alice_and_Bob
- googlemike 8y ago
  Your comment shows a clear lack of contextual insight into general software security. Alice (A) and Bob (B) are ubiquitous in discussions: https://en.wikipedia.org/wiki/Alice_and_Bob https://en.wikipedia.org/wiki/Alice_and_Bob
  - justwalt 8y ago
    Not sure his comment deserved a response like that.
  - gammateam 8y ago
    ITT: lack of social cues all around, classic Hackernews
  - ShamelessC 8y ago
    Geez that was harsh...
- marnett 8y ago
  Don’t get me started about Eve...
8y ago

manicdee 8y ago

Imagine, all this time Five Eyes actually had a way of breaching privacy and they only started making noise about access enablement recently because they knew someone was going to report the vulnerability to Apple.

joeblau 8y ago

I just called my friend who was already on a call talking to his brother. He could hear me and his brother but his brother and I couldn't hear each other. I was also able to call him, have him hang up and then see his video and hear his audio. He couldn't hear me, but I could hear and see everything. I'm turning my phone off tonight!

argsv 8y ago
is it not enough to disable FaceTime for the time being?
- joeblau 8y ago
  You may not even have to do that. It looks like Apple disabled Group FaceTime server side[1]. [1] - https://news.ycombinator.com/item?id=19025329 https://news.ycombinator.com/item?id=19025329
- omaranto 8y ago
  It probably is, but when you are freaked out you want certainty.
  - jimmaswell 8y ago
    Better remove the battery too. https://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news-18854.html https://www.tomsguide.com/us/nsa-remotely-turn-on-phones,new...
    - zuck9 8y ago
      Which you cannot do on iPhones.
      - Tepix 8y ago
        ifixit.com :-)
- deleted 8y ago

dannyw 8y ago

If I were Apple, I would be implementing a server side migration right now: - if someone adds their own email or phone number again to a group chat, immediately terminate the call As far as I know, this would mitigate the vulnerability. Alternatively, disable Group FaceTime calls altogether.

rgovostes 8y ago
It might trigger the bug to just invite any additional participant (say, a second phone the attacker possesses), in which case blocking only inviting oneself is not sufficient. My theory is that the server routes messages to everyone who has been invited to the call, even if they have not accepted it. One message might be "participant left," in which case if you are the last one, the call ends. Another would be "participant joined." The bug would center around the fact that the logic for handling a "participant joined" message does not check if the call has been accepted and makes an unexpected transition to a state that it should not be in. The "participant joined" code likely handles the case that the new participant was already present on the call. Why? Apple wants to support seamlessly transitioning your call from one device to another. That's why blocking might not be so straightforward from the server side.
paxys 8y ago
I'm pretty sure there are a lot of Apple engineers evaluating and testing fixes (including this one) as we speak.
saagarjha 8y ago
> Alternatively, disable Group FaceTime calls altogether. Apple has just done this.

bitpush 8y ago

I don't want to be harsh, but Apple really should walk the talk regarding privacy. It has its heart in the right place but bugs like this show how careless they are.

AimForTheBushes 8y ago
Software is hard.
RKearney 8y ago
I never thought of Apple as caring much about privacy given the insane amount of third party tracking scripts loaded in apps on the AppStore. What I would give for LittleSnitch running on iOS...
- scottishfiction 8y ago
  Set up https://www.charlesproxy.com/ https://www.charlesproxy.com/ on the same network as your phone, then set it to be the phone's proxy server. Voila, you can now be horrified by the amount of tracking going on. You can even MITM SSL traffic by adding a trusted CA to your phone.
blub 8y ago
This is a security issue, where Apple is pretty crap, just like MS or Google or everybody else. Taking a look at the security patches of macOS, Android or Windows is pretty depressing. Privacy is concerned with the company purposefully spying on its users, like Google, MS or Facebook do.

LeoNatan25 8y ago

This is due to the very poor QA efforts Apple has, coupled with junior developers who lack a security-aware mindset. This is, sadly, the case with most companies these days. Zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability.

saagarjha 8y ago
> Zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability. What makes you think this?
- LeoNatan25 8y ago
  The amount of bugs like this, specifically lock screen evasion bugs, bug also disk management bugs we've seen, etc. As I said, this is not specific to Apple. The whole industry lacks security awareness, and because people don't hold these companies accountable, there is little financial incentive to change that.
  - saagarjha 8y ago
    Your specific claim was that Apple has "zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability"–this isn't true at all. Sure, Apple's software has had some serious bugs in it, but this does not mean that they have no security practices in place.
    - LeoNatan25 8y ago
      I am not speaking about dedicated security teams. What security training is there for end-user app developers at Apple? From discussions with developers I know, it doesn't seem to exist, or at least not spread everywhere.
      - saagarjha 8y ago
        Maybe it's not enough for your satisfaction, but there are resources available for writing safe and secure code (I'm not sure if this is required, though), as well as regular audits by the security team.

wufufufu 8y ago

They forgot to turn the NSA flag off in production

SamuelAdams 8y ago

Are there any specific Faraday bags that folks recommend?

saagarjha 8y ago
Why not just turn on airplane mode?
- culturestate 8y ago
  If you don't trust the software in the first place, there's no real reason for you to trust that airplane mode is actually effective.
  - saagarjha 8y ago
    If you can't trust the software at all, you might be better served with turning your phone off :/
    - nkurz 8y ago
      Off may not be enough: https://www.wired.com/2014/06/nsa-bug-iphone/ https://www.wired.com/2014/06/nsa-bug-iphone/ Like the SamuelAdams said, you might do better with a Faraday bag.

dzhiurgis 8y ago

FaceTime audio ducking is the worst thing about FaceTime. Impossible to watch something online with another person. Also, FaceTime never closes after a call cleanly. Camera stays up until you right click + quite the app...

rgovostes 8y ago

Fun story: I tested this bug, initiating a call from my phone and then joining it on my Mac. After I had ended the call, the Mac's camera LED stayed on, even though the FaceTime app was not showing a video preview (in fact it had no windows open). Was it transmitting? Who knows! State management seems to be a mess all over the place.

saagarjha 8y ago
This means your camera was in use by some application. Whether that video left your device is harder to ascertain, but you can try quitting FaceTime to see if the light turns off.

kimburgess 8y ago

It may be entirely unrelated, however this is the exact sort of behaviour you would expect to see associated with providing compatibility with Australia's newly introduced AABill, or to implement GCHQ's ghost participant proposal (https://www.lawfareblog.com/principles-more-informed-exceptional-access-debate https://www.lawfareblog.com/principles-more-informed-excepti...).

deleted 8y ago
[deleted]
FuckOffNeemo 8y ago
I wish you weren't right.
rjf72 8y ago
The bizarre thing is how little people seem to have paid attention to Snowden. Apple joined the NSA's PRISM program in 2012. [1] PRISM enables the government to access data from participating companies including audio, video, and live chat. I'm linking to Wiki there only as a catalogue of sources. The page itself is useless and has overtly fake (though at least mildly amusing) quotes from Google. There's no need for new bills for these sort of issues to be a concern. I also tend to agree with you that this is not necessarily related to these programs. The reason I mention this at all is because I think there is a reasonable chance that this is related, that this overall issue is very important, and that the amount of cognitive dissonance on this is surprising and regressive. These programs are real. Companies facilitating access, including real time, to your data and "private" conversations is real. And it seems to only be getting worse. Yet people seem to convince themselves otherwise, including throughout this thread. Part of the reasons these programs are able to carry on mostly unchallenged is because people convince themselves that what is happening, is not. [1] - https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Media_disclosure_of_PRISM https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#M...

wtmt 8y ago

What about updates for people who don't update often or don't even see that there's an update? This is way too critical a bug for people who don't follow the news to not be taken care of (their devices, I mean). Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out, yet what I've seen is that point updates are left as optional and may not even show up unless one checks for an update. As much as forced new feature updates take freedom away from users, Apple needs to up its game on security fixes like this (that could be standalone) being pushed to all compatible devices ASAP (no waiting for the phone to be on the charger overnight, etc.).

saagarjha 8y ago
> Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out iOS upgrades are not mandatory by any means. > no waiting for the phone to be on the charger overnight, etc. This is how you get phones running out of battery halfway through an update.
- wtmt 8y ago
  > iOS upgrades are not mandatory by any means. The upgrades are not mandatory, but the downloads certainly are. I've had to delete the iOS downloads several times over years (including the downloads for iOS 12) because iOS doesn't have an option to disable this, and it automatically downloads the upgrade in the background when on WiFi for a long enough time. It's a cumbersome process to delete the download. It's even worse when you consider that a downloaded update would be installed overnight if you leave the device on the charger and connected to WiFi and by mistake tap on install when that prompt appears at some random time. The user interface for controlling and managing iOS upgrades does not exist. > This is how you get phones running out of battery halfway through an update. The OS could always put a limit saying the phone should be charged at least 30-40% for an update to start installing. Even now, the upgrades and updates are allowed to go through for iPhones without them having to be on the charger.

argsv 8y ago

Premature optimization, perhaps. Don’t optimize by sending audio too early (as others have suggested) and why should I be able to add my own number to the conversation if I that number is the call’s initiator? Makes no sense.

yreg 8y ago
>why should I be able to add my own number to the conversation You might want to add several devices with the same facetime handle to the same call.

int_19h 8y ago

This sort of thing is why I'd prefer devices to come with hardware killswitches for mic, video, and various radio modules.

notfed 8y ago
iPhones already have a "mute" slider switch. When I first looked into iPhones (after years of Androids), my instant reaction upon seeing the slider switch was "Ah! FINALLY! I can feel at peace in the knowledge that software vulnerabilities are powerless to hack my camera or microphone!" Of course, stupidly, the slider doesn't "mute" my camera or microphone, but only my speaker. For Apple to modify this slider so that it mutes my camera and microphones would require the daunting addition of two transistors. And the act of such a simple modification would put an end to the incredibly creepy, Orwellian possible reality that we all risk taking a part in every time we glance at the familiar tiny screens we have become so intimately glued to. Apple should add those two transistors.
- saagarjha 8y ago
  Are you suggesting that the silent switch also turns off the camera and microphone?
  - notfed 8y ago
    Yup. Or, at the least, have a separate switch that does so.
    - basil-rash 8y ago
      That went from "two transistors" to "an entirely separate physical component on the chassis" pretty quickly.
      - notfed 8y ago
        He/she didn't like the first suggestion. (Actually, it seems most people commenting here don't. Apparently I'm in the minority on this one.)

reasonablemann 8y ago

People always ask me why I have the camera on my computer covered. There is still far too much trust in technology.

d-sc 8y ago

Just tried this with my brother. Apparently I can listen to his iMac audio from my phone. This could mean and increase in the time to fix the bug.

heyjudy 8y ago

NSA calling, please pick up. ;)

Karupan 8y ago

Just thinking out loud here - why isn't there legislation that makes it mandatory for phone manufacturers to send out a notification to all devices affected by serious security flaws (like this one)? Not only will fixing and rolling out an update take a while, there is also no guarantee that the update will be installed. Meanwhile, hackers will have a field day. Or maybe there is already one, and I'm blissfully ignorant!

nexuist 8y ago
Just to play devil's advocate (not a lawyer though): What constitutes a "phone"? Any device with cellular capabilities? What about WiFi calls? What if it's an industrial device with no network (LTE/data) access? Is a laptop with a 3G modem covered under this? I would suspect the problem is in defining what devices to target, and also the fact that forcing any company to modify the functionality could be perceived as a slippery slope (i.e. security notifications first, NSA backdoors later...) In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app. I agree that it might be a good idea to differentiate between a normal update and a security critical one, though.
- Karupan 8y ago
  Valid points. How about restricting the scope to devices connected to a network and having some sort of push notification capability? > In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app. > I agree that it might be a good idea to differentiate between a normal update and a security critical one, though. But there is no mention of severity like you pointed out, and that is crucial. And till such a patch is available, Apple should notify users to disable offending apps/features if possible.
  - tedunangst 8y ago
    So... every computer running some sort of syslogd?

wilkskyes 8y ago

Should the engineers who were responsible for this be punished or retrained?

wilkskyes 8y ago
Surprised at the down votes here, is this to imply that things should just carry on as usual with no real consequence or remedy?
frou_dh 8y ago
The more pertinent question in this kind of situation is to the Lead/Architect. Namely, why have you created an environment in which quality can slip like this, and what are you going to change?

smmnyc 8y ago

Apple has disabled group FaceTime on their end. https://www.apple.com/support/systemstatus/ https://www.apple.com/support/systemstatus/

timeimp 8y ago
Oh damn, they can do it just like that? I thought FaceTime was a P2P thing... but it appears group FT requires Apple's servers?
- snuxoll 8y ago
  It never was (or only was for a short period) thanks to patent trolls.
- saagarjha 8y ago
  IIRC, this was because of a lawsuit with VirnetX.
- _bxg1 8y ago
  Very few communication services are truly P2P; it's way more likely to have syncing issues and is virtually impossible without at least a handshake. Even Signal, which does have syncing issues due to being mostly P2P, requires a server for the initial handshake.
  - acchow 8y ago
    Especially on mobile, where you want to conserve battery life.
- fizx 8y ago
  Each person only uploading one copy of video in a multiparty situation is a huge win for quality on mediocre connections.
  - TrickyRick 8y ago
    Skype used to be "P2P" where one party would act as the host in a group call.

drdrey 8y ago

Isn't it fantastic that the exact same bug works on 2 different OSes?

sigjuice 8y ago
Not exactly. There is likely a lot of common, if not identical code.

shiado 8y ago

Perhaps their NSA PRISM code got mixed up with their user facing code? I'm not just joking, we all know Apple only pays lip service to privacy and got caught red-handed during the Snowden leaks. VOIP is indeed listed. https://cdn.vox-cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=/0x0:700x525/1820x1213/filters:focal(294x206:406x318):format(webp)/cdn.vox-cdn.com/uploads/chorus_image/image/61159115/prism-slide-4.1419979622.0.jpg https://cdn.vox-cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=...

giardini 8y ago

Looks like iPhone spyware. I doubt that FaceTime is the first use of this "bug"!

ziont 8y ago

once i had to talk to my boss i didnt really like this explains it.

Mikeb85 8y ago

Is it just me, or does it seem Apple can't secure their services as well as Google? There's always 'concerns' about Google spying, but no proof, meanwhile there's been major hacks involving Apple that are quickly forgotten because the CEO claims to be all about privacy.

alkibiades 8y ago
the quantity of papers with major security flaws in android versus ios shows you all you need to know. there is an endless stream of android ones but very few ios okes
- Mikeb85 8y ago
  Key word is services. iCloud had a very public hack, now this. What Google services have been exploited?

gigatexal 8y ago

They’ll fix it fast. People just love to crucify Apple for everything.

baxtr 8y ago

Seriously, I don’t think that this is so bad. Google advertised something similar like this as feature. Don’t get me wrong: it should be fixed. But the shitstorm is way too big

sgt 8y ago

I wonder how many devices are affected. Just tested between two iPhones running latest iOS and could not reproduce.

nurettin 8y ago

With the advent of microphone embedded computing devices, a bug can really become a bug.

docbrown 8y ago

Rumor mill: FaceTime bug was submitted to Apple on 20 January 2019 by a concerned mother after .. her 14-year-old son discovered it. >My teen found a major security flaw in Apple’s new iOS. He can listen in to your iPhone/iPad without your approval. I have video. Submitted bug report to @AppleSupport...waiting to hear back to provide details. Scary stuff! #apple #bugreport @foxnews [0] https://twitter.com/mgt7500/status/1087171594756083713?s=21 https://twitter.com/mgt7500/status/1087171594756083713?s=21

samcday 8y ago
If the mother did in fact submit a ticket a week ago, it's pretty shameful that the escalation / verification process took more than a week for a bug of this severity.
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
npunt 8y ago
Interesting twitter account. First tweet 1/1/19, few followers, mostly politics, then a major bug report (not only in discovery but in knowing how to go through the reporting process). Not saying it’s fake at all - it looks 100% legitimate - but it adds some extra bit of weirdness to this story. Quite the providence, and a really bad bug. (edited for clarity)
- neya 8y ago
  The genuineness of the Twitter account is absolutely irrelevant in contrast to the validity of the bug itself. Apple was reported a high priority bug at a specific time. Who reported it, how they look like, what their Twitter profile looks like should have no impact on Apple's bug fixing process and how long/short they took to fix the bug.

wincent 8y ago

Reminds me of the time I FaceTimed my mother (in Australia) only to see the call answered by a total stranger (in Texas).

buraksarica 8y ago

We noticed a similar bug many years ago on a GSM enabled PDA device. I cannot recall the brand/model.

novaRom 8y ago

This will always happen with non-open source software.

saagarjha 8y ago
This also happens with open-source software too. It just takes a bit longer to figure out what's going on with closed-source software.
dewey 8y ago
Remember OpenSSL / Heartbleed etc?

crististm 8y ago

"Sagem GSM phone let's you hear the other party's audio before you pick up" - Demonstrated this last time about 6 years ago calling my phone from different networks: fixed, and two other GSM. My conclusion was that it's an implementation bug easy to trip on or a provision in standard that it's easy to misread. Now - if the audio channel is _right there_ for you to read, what chances are for this to be only a Sagem firmware bug?

shocks 8y ago

On the 1st of November a friend shared with me a screenshot from the Instagram of a concerned parent explaining a situation in which her child was being cyber bullied, and it was clear from the content of the messages that the bully could her their private conversations. I guess this bug has been know and abused for at least three months?

illwrks 8y ago

My colleague and I experienced the same thing last week on his Samsung phone. Another colleague was calling us to talk about a project, we were chatting away and in the few seconds before the phone was 'answered' our colleague heard what we were talking about.

ainiriand 8y ago

It is super crazy that when you apply for a dev job in companies like this you have to be like a small Alan Turing and yet things like this happens.

ChucklesNorris 8y ago

"Bug"? What came to my mind was "bugged." Zuckerberg needs to answer more questions before Congress, this time under oath.

titzer 8y ago

Open. Source.

ChucklesNorris 8y ago

There was a recent article which correctly pointed out the Samsung phone owners cannot uninstall Facebook from their phones. It is best to assume that you're always being listened to, and watched. User settings can always be overridden, buried in code you'll never see.

FabHK 8y ago

I must admit that when reading yet another privacy-invasion-headline I saw "Facebook", not FaceTime/Apple. Not sure whether it's more indicative of unjustified prejudice or actual precedent.

briandear 8y ago
The difference is that Facebook does it intentionally.

Antifragile1 8y ago

iFaggots still boycotting Huawei?

z3t4 8y ago

I guess when it's virtually impossible to get into contact with the developers they will get their "bug reports" via the news.

apple_pol_throw 8y ago

I worry about Apple. Software quality has been dropping, but it's not Swift or some other specific technology that's the problem. It's talent. The company has had a hard time attracting very senior talent. The difficulty is self-imposed and comes from leadership's strict policy of not paying market wages at the high end. Multiple hiring managers at Apple have complained to me that they've lost good people because the company just won't match offers from the Googles and Facebooks of the world. Apple refuses to acknowledge the reality of the market. Given that Apple's most experienced people keep retiring and that Apple isn't replacing them with equals, I expect software quality to continue to drop until leadership decides to abandon its shortsighted comp restrictions. [Posting from a throwaway for obvious reasons]

hema_n 8y ago

I am unaware of this problem..as I am an android user.

rootusrootus 8y ago
Yeah, with the long list of things you have to worry about, I wouldn't be worried about an iPhone problem either.

fma 8y ago

I'll admit I have limited knowledge on iPhone security... But would it be technically possible to do this with other apps? For example if one has Wechat, can there be a backdoor to be listened in on? Thinking about state actors...

CodeSheikh 8y ago

I feel like around three years ago Apple engineering changed QA leadership or restructured org in that dept and the quality has been down. Prior to IOS9, I have had barely noticed bugs. But now I am in that "used-to" mode that I have learned to ignore such bugs or nuances.

chx 8y ago

Oof. I am reasonably sure very very soon there will be a number of very polite but very pointed questions on Apple's desk from concerned lawmakers, data protection authorities and such not only from the USA but the European Union as well about how this happened and what are they doing to make sure this doesn't happen again. I can very well see the European Data Protection Supervisor fining them to some very interesting amount as well.

tammer 8y ago

I encountered a bug a while back — when I would connect to a dial-out call to get onto my company’s conference service from its app, while using a pair of cheap Bluetooth headphones (I’ve upgraded since then!) the mute button didn’t work. As in, the mute button would be clearly activated, but my audio still carried through to the call. As in, I discovered this in quite an embarrassing way. I filed a radar but never got a real response about it. Really there appears to be a strong need at Apple to ensure QA is checking for confirmations of user interaction. As I haven’t experienced anything like this since I’m still with them but these types of problems are the very thing that would lead me to shake my deep investment in the Apple ecosystem.

josu 8y ago
I have serious trust issues with mute buttons. I rather not say anything I may regret while the mic is muted.

danra 8y ago

Apple’s bug handling is broken. Anyone who has filed a few rdars knows it is thankless work. The amount of work you have to invest for anyone to even look at your bug is high. In the instance of this particular bug, I wouldn’t be surprised if at least part of the reason it took a week and a half to handle since it was reported was that the initial reply to the reporter was “please send us the exact steps to reproduce” and then nothing was done until the bug reporter replied back. I wouldn’t be surprised to learn there were even a few iterations of this, since I personally experienced it. Then, your bug gets looked at. But you don’t know anything about its status. Until anything from a few days to a few months later, it gets closed as a duplicate. Of course there is no way to know in advance that the bug was already opened, and that you could save an hour of work time instead of making a minimal reproducible version of your app which reproduces the bug. At least, that’s been my unfortunate experience. /rant

gargalatas 8y ago

Damn! And it was a feature they would disclose in the next apple event...

samstave 8y ago

A fun though experiment for a bug like this would have been to test lists of emails against validating the ability to FaceTime call with the email and determine if it was used as the iCloud email address... Had this bug gone unknown longer - then you'd have a list of all the endpoints you could spy on.