13 ms·
Apple was warned about the FaceTime eavesdropping bug last week
- a-dub 8y agofrom petaluma to kankakee! finding bugs in the internet of shitty things! the latest craze to sweep the nation!
- dang 8y agohttps://news.ycombinator.com/item?id=19029594 https://news.ycombinator.com/item?id=19029594 is another article on this. Also https://news.ycombinator.com/item?id=19029548 https://news.ycombinator.com/item?id=19029548.
- trumped 8y agodang, that was quick
- josu 8y agoI submitted it before those 2 articles, but it got lost on new. It got resubmitted by the admin, who sent me this email: We thought you might like to know that we put https://news.ycombinator.com/item?id=19029573 https://news.ycombinator.com/item?id=19029573 in the second-chance pool, so it will get a random placement on the front page sometime in the next 24 hours. This is part of an experiment in giving good HN submissions multiple chances at the front page. If you're curious, you can read about it at https://news.ycombinator.com/item?id=11662380 https://news.ycombinator.com/item?id=11662380 and other links there.
- dang 8y agoYup, that was me. When we merge threads, we try to favor the earliest submission. Eventually we're hoping to have some kind of karma sharing so it isn't such a lottery.
- amrrs 8y agoWhile you're here, ,my comments get published but my links never on new section even. anything wrong with my account?
- josu 8y agoI see. Thank you.
- flurdy 8y agoI submitted the WSJ story only 2 minutes before Josu's original The Verge submission. Josu' submission was just above mine on the "new" page, so when I clicked on it and read the Verge article I realised it was a better article than the one I submitted. (and not paywalled) My first comment on my own submission was for people to look at the other article as well/instead. Karma sharing sounds nice, but in the end, I just want people to read the better article.
- josu 8y agoThanks, I didn't realized. And yeah, I don't feel like people here care that much about karma. Usually when I submit articles it's because I want to read the discussion that it creates on HN.
- dang 8y agoYou're right! Yours was earlier. Either I didn't notice that or I saw your comment or I decided the other article was better... can't remember. Thanks for caring about the quality of HN. That's what matters.
- jm20 8y agoI can only imagine the amount of bug reports, real and false, that a company of Apple's size must receive on a daily basis. Is there any company at that scale that can reliably filter through all of them to find actual, critical bugs quickly? It simply isn't as easy as saying 'flag all reports with 'security vulnerability' in the submission for priority.' That could still be thousands of reports in the 'priority' queue, most of which some person would need to manually investigate one by one.
- jonathanberger 8y agoIt's not hard to reach a living person who works at Apple. The next step should have been reproducing it for that person. It's not clear that the finders in this story did that - it seems they might have been trying to find out about bounty payments first. If any tech support or Apple Genius were to have seen this bug reproduced, it should have immediately been easy to flag to the right person.
- dewey 8y agoWhat if you don’t live near an Apple Store like a lot of people do? Saying that it’s not hard for a person to get in contact with someone working at Apple seems like a pretty biased view.
- gpvos 8y ago"Looking for a bounty?" Where did you get that from?
- justtopost 8y agoBug Bounty I would assume, for finding the error.
- gpvos 8y agoOf course. However: I didn't re-read the article, but I don't remember that it suggested anything of the sort, so GGP just projected that onto them.
- jachee 8y agoHow many other hundreds-of-billions-of-dollars companies could produce a production code fix faster?
- briandear 8y agoIt should only take a few minutes if you’re the average HN commentator.
- olliej 8y agoA HN commentator would never have made such a big in the first place. Duh. :D
- olliej 8y agoFollow up, would it be “an HN” or “a HN”? eg hatche-en or atche-n or hacker? As before I’m sure the worlds greatest linguist will also be here :)
- howenterprisey 8y agoProbably "an HN", as saying the letter "H" sounds like "ayy-ch" (in American pronunciation, at least), which has an initial vowel sound.
- olliej 8y agoRight, but when I tried saying it in my head it seemed weird because my brains turn it into “an hacker news” :)
- SmellyGeekBoy 8y agoThey could have built their own Group FaceTime in their mom's basement in a weekend. With blackjack and hookers!
- p1necone 8y ago(according to the article) They didn't spend over a week developing a fix to the bug, it took them over a week to just disable the feature (given the severity of the bug this should have been done as soon as they knew about it). It also sounds like the person reporting the bug was ignored until she made a developer account and reported the bug through that - that shouldn't have been necessary.
- mishurov 8y agoIt's irrelevant cos Apple NPC retards will defend it either way.
- osrec 8y agoNot turning out to be a great week for Apple. Even if they do receive a large number of bug reports, I would like to think they have the resources (let's face it, they're not cash-strapped) to resolve something as critical and privacy-focused as this. Their failure to do so makes a mockery of their users who pay a significant premium for their products, often in the name of privacy.
- ninedays 8y agoPeople who thinks that what happened is unacceptable needs to understand that Apple must receive a lot of these types of call every week. What would you do if someone send you multiple messages saying that they found a major issue _without even detailling anything_ while this person actually wants you to give them money for what they found (that they still haven't disclosed any information about it)? I'm sure the majority would ignore these calls unless some details were shared about the issue. I am not surprised about what happened at all. There is an argument that can be made about the fact that it took Apple so many years to finally implement group video call that they could take a little bit of time to do it right but other than that, I don't see how Apple could have prevented a bug that a person wasn't willing to disclose without having money first.
- LfLxfxxLxfxx 8y agoThe actual tip: https://pbs.twimg.com/media/DyGIwiHVYAAJaxH.jpg https://pbs.twimg.com/media/DyGIwiHVYAAJaxH.jpg You don't see this kind of stuff every week, and surely Apple has the resources to at least confirm it.
- zymhan 8y agoYou're telling me some random customer wrote _THAT_ writeup? That's impressive.
- sangnoir 8y agoRandom lawyer - turns out the ability to describe things in clear, unambiguous language and in detail results in pretty high quality bug reports.
- brohee 8y agoThis was seriously as good as you can expect from a non technical, non QA person, and actually better than what lots of technical users would report. A video as reproduction steps is as credible as it gets. I hope she and and son get a nice reward from Apple...
- 8y ago
- webmobdev 8y agoWhat is happening with Apple - people used to justify the high cost of Apple devices claiming they paid for the "high quality". But now ... First the "bug" that allowed root access on macOS and now this "bug" that literally allowed anyone to spy on you through your iPhone? Not to speak of iPads / iPhones that bend, ios throttling due to weak batteries etc. etc. Something is quite wrong ...
- SmellyGeekBoy 8y agoI'm no Steve Jobs fan or Apple apologist but it seems obvious enough - Jobs was the force driving the company forward and now the momentum he created is finally starting to wear off. I really hope they can get their shit together sooner or later as they still seem the best of a bad bunch wrt privacy - at least for now.
- pantulis 8y agoThere has been recently some activity here in HN regarding formal model checking and protocol verification (TLA+, SPIN, Promela...) I guess they are relevant to this case. This stuff is hard.
- qrbLPHiKpiux 8y agoThat letter from the lawyer to Apple is quite inflammatory.
- auiya 8y agoHow so?
- benologist 8y agoIt's somehow never the tech companies' fault for willfully designing inept feedback channels or even null-routed feedback channels in Google's case to impede customers communicating with them. I think many companies, especially given $200b in savings, could have handled this report better. Many companies without $200b can receive information from a customer without it passing through journalists first. What's especially pathetic is it doesn't matter what you're reporting - a grave security bug, a widespread hardware flaw, a longing for better functionality - Apple doesn't want to know. In fact they warned iOS developers against trying to get their attention. If you run to the press and trash us, it never helps. https://medium.com/@krave/apple-s-app-store-review-process-is-hurting-users-but-we-re-not-allowed-to-talk-about-it-55d791451b https://medium.com/@krave/apple-s-app-store-review-process-i...
- lozenge 8y agoClearly it does matter what you're reporting - that quote is specifically about the app store review process.
- tome 8y agoThat Medium article presents the quotation as though it's literally something that Apple wrote. It doesn't actually appear to on the page it supposedly came from, nor anything like it, as far as I can see. https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/ [EDIT: Apple indeed literally write that in a previous version of the page. Wow.]
- benologist 8y agoThe guidelines have since been updated. https://www.ibtimes.co.uk/has-apple-been-plain-creepy-by-warning-app-developers-not-talk-press-1463812 https://www.ibtimes.co.uk/has-apple-been-plain-creepy-by-war... http://www.elischiff.com/blog/2015/3/24/fear-of-apple http://www.elischiff.com/blog/2015/3/24/fear-of-apple
- itdaniher 8y agoIt's visible verbatim in an archived version of the page. See: https://web.archive.org/web/20141226094343/https://developer.apple.com/app-store/review/guidelines/ https://web.archive.org/web/20141226094343/https://developer...
- renholder 8y agoMaybe I'm just too old and contankerious and just don't "get it" but warning Apple via Twitter[0] isn't really following a Coordinated Vulnerability Disclosure process, yeah? [0] - https://resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf https://resources.sei.cmu.edu/asset_files/SpecialReport/2017... EDIT: Changed the link to the CERT guide for CVD.
- smt88 8y agoThe tweet wasn't the warning. The tweet describes the 14 year old's mom sending a formal notice of some kind. Anyway, it's absurd to say thay tweets aren't enough warning if they're public. A public disclosure may be distasteful to Apple, but it doesn't change the fact that they have a security emergency.
- renholder 8y ago>Anyway, it's absurd to say thay tweets aren't enough warning if they're public. Who said Tweets weren't enough warning? Did I say that? Where? ...and what does a warning have to do with CVD? The two precepts aren't mutually exclusive, yeah?
- smt88 8y agoYou yourself implied a relationship between CVD and the tweet when you said that a tweet isn’t a valid step in a CVD process.
- benologist 8y agoApple staff should copy/paste the information reported to them on Twitter to the relevant team for triage or investigation. The user is already helping enough by telling them on Twitter.
- renholder 8y agoThis is true but she had already emailed them and from the looks of the screenshot, recevied a response[0]? I still fail to see what that has to do with CVD, though? [0] - https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=/0x0:1672x806/920x0/filters:focal(0x0:1672x806):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/13723266/Screen_Shot_2019_01_29_at_2.07.07_PM.png https://cdn.vox-cdn.com/thumbor/zrezAXK0-NdK3ugN3G2Uwd_vzuo=...
- FactolSarin 8y agoWhen I saw the headline, I assumed it was a situation where someone had emailed the wrong address or only tried to contact them via Twitter. But upon reading the article I see this is a high-quality report. She was sounding alarms and emailing all the right people. It's is insane that Apple missed this. I think at this point, we need Tim Cook to write an apology piece about how they screwed up, how this won't happen again, and who got fired.
- jdavis703 8y agoWe also need some kind of hardware indicator like a light that indicates when the mic or camera are turned on. After a blunder like this, a privacy-focused needs to rebuild trust that they take privacy seriously.
- judge2020 8y agothere already is one when an app is still listening to your microphone in the background, a giant red bar at the top of the screen. The difference with this bug is that the facetime call pre-initializes microphone and video to reduce the initial connection delay.
- jdavis703 8y agoRight, I don’t want something in the software which is what happens today. I want a hardware indicator, that should in theory be harder to break or hack (and should make this kind of bug more obvious to a QA team and the general public).
- markonen 8y agoYears ago my team and I discovered a pretty significant bug in Safari's/CFNetworking's TLS implementation. Once the browser had deemed a certificate valid once, it would subsequently accept it for all hostnames. We got absolutely nowhere with Apple's official security contacts. The issue only got resolved months later, after I was able to find an employee from their security team at WWDC and explain the issue face to face.
- jackson1way 8y agoCare to tell how it went? Did he have an expanation why the process was so crappy? Did hebmaybe even knew about your bug report but was unable tonfonsomething sbout it because of some beaurocracy?
- markonen 8y agoWe did not have any visibility into the process. Overall I think they just didn’t see it as that big of a deal, definitely not big enough to change release schedules for. This got assigned a CVSS score of 6.8, so not Critical or even High severity. Still feels pretty severe to me, but I guess that’s how everyone who discovers an issue like this would feel…
- romeisendcoming 8y agoAnother product stream and company (and hype) I was never a fan of. Best thing they did was to rip off FreeBSD and the worst was break *nix compliant userspace + influence design UX and UI patterns for a new generation.