Apple's iOS 12.1.4 Update to Fix FaceTime Eavesdropping Bug Showing Up in Analytics

[ghostface147]

It's about time. I tried the bug out on a friend and the results were… eye-opening.

View attachment 819296

How so? Apple disabled the Group FaceTime thing that apparently mitigated the bug. Or does it not matter?

 

[Chrjy]

Appleinsider?

Are you being serious in terms of less negativity?

 

[Bawstun]

In fact it was so simple, that you picked up on it on the day of release

I don’t use FaceTime and never have. One of the first things I disable on any fresh install of iOS.

Regardless, still a simple bug. It takes 2 simple steps to entirely erase any end user’s privacy. Another public relations nightmare which will result in lost customers and stalled upgrades. Won’t see the effect of this until their next earning’s release, but it will be a real hit.

 

[archvile]

Honestly, from what I understand, it's not as though this bug is in any way insidious—at the very least, you will be aware that someone is trying to join the call, no? So I don't see why this is considered such a horrific breach of trust, when selling personal data, including real-time location tracking—which is far more useful to someone with malicious intent—is considered a "business model".

No, the user is NOT aware of this happening, that’s why it is such a serious privacy issue.

Also any account you sign up for that falls within your criteria of “selling personal data”, is something that the user has to willingly do. This bug could have been performed without the consent or willingness of the other party.

 

[goonie4life9]

Additionally, Apple needs to improve their technical support process. I never contact Apple until I've tried everything listed on their Support website. I can't tell you the number of times the advisors have demanded I repeat the steps listed on the website while I am on the call with them, to "prove" I have done all of the troubleshooting. After all of that, all they do is escalate it to engineering, who very often asks me to replicate the steps I have already done. With this inefficient of a process, it did not surprise me that it took over a week for someone high enough at Apple to actually address the issue.

I’m assuming it didn’t get to the right people. There’s a real problem with apple’s reliance on the Radar system. Radar is too difficult for an average non-technical person to use, there’s no obvious way for someone to report a critical bug to Apple without using radar, etc. Apple needs to seriously consider new ways of reporting and tracking bugs. Something like a friendlier version of bug reporter running on the device itself (i.e. the bug reporting app that installs during betas.)

 

[xgman]

I wonder whether the current 12.2 beta already has this or will get this on the next point release (more likely)?

 

[archvile]

Yep. Very simple bug that should have been caught. This will result in many lost upgrades and sales for the next year and beyond. Another massive Tim Cook failure. Really sucks for those of us who see the writing on the wall.

You could also argue that the entire point of the dev beta/public beta program is too assist Apple with finding and reporting issues (such as this), in addition to devs being able to test their apps against the latest version. That’s why they include a mandatory feedback app on every beta version. And I am sure there are many, many more dev/public beta testers than there are QA testers internally. So by your logic, anyone on the beta for 12.1 should have also caught this “very simple bug”.

 

[ikramerica]

The only way this bug can be fixed by a software update is if Apple also fixes Group FaceTime on the server side to not work with iOS version lower than the fix. Apple can’t force you to update directly.

 

[Chrjy]

I don’t use FaceTime and never have. One of the first things I disable on any fresh install of iOS.

Regardless, still a simple bug. It takes 2 simple steps to entirely erase any end user’s privacy. Another public relations nightmare which will result in lost customers and stalled upgrades. Won’t see the effect of this until their next earning’s release, but it will be a real hit.

I work closely with QA testers everyday. The remit is to work through testing the app in terms of its functionality. Adding yourself to a call wouldn't have been considered as you are the person initiating the call. If part of the functionality was that you could add yourself to a call that you already initiated, then yes, this would have been picked up on.

 

[nt5672]

These days when Apple projects a time line, we need to double or even triple it. So my guess is that this week means sometime in the next 30 days. Welcome to the new Apple.

 

[cmaier]

Are you being serious in terms of less negativity?

No, that was sarcasm.

The only way this bug can be fixed by a software update is if Apple also fixes Group FaceTime on the server side to not work with iOS version lower than the fix. Apple can’t force you to update directly.

I’m sure they will.

 

[Chrjy]

No, that was sarcasm.

Oh! That's a shame....

 

[keysofanxiety]

It's about time. I tried the bug out on a friend and the results were… eye-opening.

View attachment 819296

MacRumors needs to implement a double-like button on your profile. One is never enough.

 

[I7guy]

Yep. Very simple bug that should have been caught. This will result in many lost upgrades and sales for the next year and beyond. Another massive Tim Cook failure. Really sucks for those of us who see the writing on the wall.

I actually don’t think there will be much if any of lost sales. Maybe some persons in the edge will go to android.

The only left over will be these lawsuits that will either be dismissed or take years to settle. Otherwise, it’s TCB.

 

[avanpelt]

I'm sorry Apple, but QA didn't try hard enough to break it. With a feature this sensitive, it is necessary to have a couple of employees trying to break things all day every day. I know not every bug can be discovered in time, but obvious ones like this should be caught before release.

I wouldn’t call this bug ‘obvious’. I’d like to know how many people have tried to add themselves to a Group FaceTime call after they initiated said call. That’s not something most people would attempt to do in the first place, I don’t think.

 

[cmaier]

I wouldn’t call this bug ‘obvious’. I’d like to know how many people have tried to add themselves to a Group FaceTime call after they initiated said call. That’s not something most people would attempt to do in the first place, I don’t think.

But it is precisely the thing a professional QA engineer would test. It’s a boundary case (“what if I call myself?”) and boundary cases are where most bugs come from.

 

[cppguy]

First thing i tried was adding myself to a call (during the early betas of the feature.). Tested that i could talk from iPad to iPhone, etc. Sadly, didn’t occur to me to first add a third party. :-(

Oh I don't blame any public beta tester for not catching this. I'm just saying security experts spend their days thinking about how to break into things. For example, how can I make a CSV or Excel file that remotely executes code? How can I enter a negative number into a box where only a positive value makes sense? I don't know if I had discovered this problem myself. It's impossible to tell. But if I spent several days trying to break it, then I might have tried to add myself to a call. I would need two accounts, and two phones on my desk, and countless hours trying to break it. When I test my own software, I do try to think about all sorts of situations. For example, enter -0.0 as a number. Try to copy and paste my name into a box that only accepts a number. If Cmd+V doesn't work, right click and choose Paste.

Look, I took an MIT Computer Security online course, and I learned a lot about defensive programming techniques. I've tried to put code into a CSV file, and made Excel execute it. I'm not a security expert, but there are engineers out there who spend their days trying to come up with scenarios. And if something is as simple as adding yourself to a call, they might catch it. Not by calling friends randomly, but in a controlled, lab situation.

 

[aliensporebomb]

It's about time. I tried the bug out on a friend and the results were… eye-opening.

View attachment 819296

I so wanted to do this but you did it better than I ever could have hoped.

 

[eatrains]

Is there any reason to allow a user to add themselves to a call if they're already on the call?

 

[slide_to_unlock]

I am a developer. I thought I was bad tester but now I know. I am better than Apple at testing.

 

[archvile]

These days when Apple projects a time line, we need to double or even triple it. So my guess is that this week means sometime in the next 30 days. Welcome to the new Apple.

Wut. They have a very quick turnaround for serious issues such as this. Several big macOS bugs, and a couple of iOS ones in recent memory, have been released within 24 hours to a couple days of the exploit being made public. In fact, for such a big company, this turnaround time is extremely impressive.
[doublepost=1548966669][/doublepost]Hindsight is 20/20: The Thread

 

[nortonandreev]

I wonder whether the current 12.2 beta already has this or will get this on the next point release (more likely)?

Not yet.

 

[Greymacuser]

I'm so glad I never updated to the current iOS.

 

[citysnaps]

Does anyone else know of a more friendly Apple site with other friendly actual Apple enthusiasts? Seriously, for as long as I've lurked on here it's all negative people who are Apple haters commenting. Pointless to be on here anymore. All this negative news is hardly "rumors".

Sadly, it's the only way some people can find a bit of happiness and power in their lives, where none otherwise exists.

Not a healthy situation.

 

[Doctor Q]

If Apple waits to thoroughly test iOS 12.1.4, they are blasted for the long delay.

If Apple distributes iOS 12.1.4 without thoroughly testing it, and any unfortunate side effects show up, they'll be blasted for that.

If Apple distributes iOS 12.1.4 without thoroughly testing it, and no side effects show up, they'll have escaped either of those sad fates.

It's a type of burden that many software developers must bear, though not in such a big spotlight.