Serious FaceTime Bug Lets You Hear a Person's Audio Before They Answer [Update: And See Video]

[I7guy]

Only addressed now that it's in the news. Don't you see a trend yet?

As the saying goes, correlation does not imply causation. It's in the news, but there is no evidence Apple only found out about it from the "news" and they didn't have a fix prior to the "news" that they were planning on rolling out. People will believe what they want anyway.

 

[mistasopz]

Some pretty sad comments from Apple defenders here:

• It's not that bad, you don't even lose data.
• I don't even use FaceTime so it's not a big deal.
• It's going to get patched, not a big deal.
• All software has problems.
• Yeah, but, Google, Android, but...
• I have nothing to hide, who cares.

 

[Awesom-0]

Now that it's news or now that it's known? And is it only being addressed because it's in the news or the news of it being addressed is in the news because Apple needed to address the news but has been working on and planning to release a fix even prior to that?

As far as privacy, there's a difference of having actual features that knowingly impose on it and having an unintentional bug that crafted and issue.

No just no It should have never existed in the first place correct?

It should never be allowed without authentication from both sides before doing anything correct?

I can't call someone on a phone and listen to their house while it rings can I? This is basic fundamentals for setting up a conversation. Nothing does it any other way without hardware blocking that or software actually doing what it should.

You don't just mess up by code for this It's a layer of security for one but to screw up like this means there is either a layer that is so stupid easy to screw up by one little error, or they have something normally listening in or both.

If I edit code with a hack and it causes something like this that is a huge flaw because I didn't just break it I caused something else. They did not just break something they exposed what they already had in place.

That's what I'll assume until they show different. And you think they will show anything? Or do you think ios is so secure and protects your privacy

Apple doesn't care its just what you will buy based on what they say Then everyone here repeats it for advertising.

Look at the front page here. It's already buried. Have you noticed yet that something bad comes out then you will see betas advertised for osx, the watch Apple TV, ios, and home pod?

This wasn't the case before. But now many here testing beta software, with Apple lol.

Umm wasn't the point of having Apple products that it was ultra reliable

Apple has changed and I want the old version back Macrumors has changed as well and now it's just advertising.

 

[fermat-au]

Apple's CES ad coming back to bite in the ass, big time. This guys can't seem to catch a break these days.

This is a BAD bug.
It is even worse for Apple, given their current marketing push towards privacy. Even if this don't result in any serious outcomes, it makes Apple look sloppy, even incompetent.
Are Apple the company that really caries about user privacy or is privacy just about marketing to them?

 

[I7guy]

No just no It should have never existed in the first place correct?

It should never be allowed without authentication from both sides before doing anything correct?

I can't call someone on a phone and listen to their house while it rings can I? This is basic fundamentals for setting up a conversation. Nothing does it any other way without hardware blocking that or software actually doing what it should.

You don't just mess up by code for this It's a layer of security for one but to screw up like this means there is either a layer that is so stupid easy to screw up by one little error, or they have something normally listening in or both.

If I edit code with a hack and it causes something like this that is a huge flaw because I didn't just break it I caused something else. They did not just break something they exposed what they already had in place.

That's what I'll assume until they show different. And you think they will show anything? Or do you think ios is so secure and protects your privacy

Apple doesn't care its just what you will buy based on what they say Then everyone here repeats it for advertising.

Look at the front page here. It's already buried. Have you noticed yet that something bad comes out then you will see betas advertised for osx, the watch Apple TV, ios, and home pod?

This wasn't the case before. But now many here testing beta software, with Apple lol.

Umm wasn't the point of having Apple products that it was ultra reliable

Apple has changed and I want the old version back Macrumors has changed as well and now it's just advertising.

It's still a bug that will be fixed. People can take it anywhere they want. And yes, I believe Apple is out to protect the privacy of it's customers, even if bugs (some worse than others) are discovered.

 

[JosephAW]

So now I have to not only cover the camera from perps but also cover the mic.

Time for a physical switch to disable all features.

 

[flom]

It's still a bug that will be fixed. People can take it anywhere they want. And yes, I believe Apple is out to protect the privacy of it's customers, even if bugs (some worse than others) are discovered.

what makes you believe that? Because the mouthpiece of the company says what you want to hear? Following them blindly doesn't make it true.

 

[AaronEdwards]

So now I have to not only cover the camera from perps but also cover the mic.

Time for a physical switch to disable all features.

Engineers added one while designing the latest iteration of phones, but since they got 0.1mm thicker, Jony Ive vetoed it.

 

[TVreporter]

Why can’t anyone answer this: Is this just on iOS 12 versions? I have my wife’s phone and an iPad on iOS 11

 

[Awesom-0]

As the saying goes, correlation does not imply causation. It's in the news, but there is no evidence Apple only found out about it from the "news" and they didn't have a fix prior to the "news" that they were planning on rolling out. People will believe what they want anyway.

You know what was different a decade ago People here wouldn't accept it. Most are gone or will be

Half of the people now are a walking talking billboard for Apple. You reply to me when Macrumors already put this on the second page because betas and other things are released

Two or three different threads on this alone but umm front page isn't this

It lasted how long when it's more important than betas?

I miss what osx and apple was. But this is worse than reddit that just screams advertising I would know because I worked in advertising and I am a engineer lol.

Even better I was a engineer for Samsung. And I used to love Apple for who they were compared to Microsoft And I'll be the first to say Android and ios need to get their crap together and do things right

But this fanboy stuff has to die especially here.

These are probably my last posts here because it's turned into the typical junk you see on reddit or Slashdot.

You better demand much more from Apple But half of the accounts that post here seem like advertising anymore.

I rarely say anything but this is your red flag A bug like this exposes a serious underlying problem. You don't just have this happen you don't even have this happen on a hidden layer for spying. It is seriously bad in a way that shows gross incompetence.

Like saving plain text passwords in osx .. That was the first sign they were up to something. This just verifies they are intentionally doing more and not even doing it well

Mark my words eventually it will come out. And I'm not here promoting Android or anything else Both suck with privacy same with most apps Some just hide it better and some sell you a thousand dollar phone touting it

You don't screw up secure software in this way without that software having in place something else. Or if you do it was totally screwed up in the first place. Take your pick. Or Apple should explain in detail how it could happen.

We all know that Apple isn't going to say anything in detail just like everything in the past decade

 

[I7guy]

You know what was different a decade ago People here wouldn't accept it. Most are gone or will be

Half of the people now are a walking talking billboard for Apple. You reply to me when Macrumors already put this on the second page because betas and other things are released

Two or three different threads on this alone but umm front page isn't this

It lasted how long when it's more important than betas?

I miss what osx and apple was. But this is worse than reddit that just screams advertising I would know because I worked in advertising and I am a engineer lol.

Even better I was a engineer for Samsung. And I used to love Apple for who they were compared to Microsoft And I'll be the first to say Android and ios need to get their crap together and do things right

But this fanboy stuff has to die especially here.

These are probably my last posts here because it's turned into the typical junk you see on reddit or Slashdot.

You better demand much more from Apple But half of the accounts that post here seem like advertising anymore.

I rarely say anything but this is your red flag A bug like this exposes a serious underlying problem. You don't just have this happen you don't even have this happen on a hidden layer for spying. It is seriously bad in a way that shows gross incompetence.

Like saving plain text passwords in osx .. That was the first sign they were up to something. This just verifies they are intentionally doing more and not even doing it well

Mark my words eventually it will come out. And I'm not here promoting Android or anything else Both suck with privacy same with most apps Some just hide it better and some sell you a thousand dollar phone touting it

You don't screw up secure software in this way without that software having in place something else. Or if you do it was totally screwed up in the first place. Take your pick. Or Apple should explain in detail how it could happen.

We all know that Apple isn't going to say anything in detail just like everything in the past decade

It's all well and good your opinion, but has little to do with the premise that Apple jumped into action after this hit the news.

As far as the fanboy stuff, it's just as bad as the anti-apple agenda masquerading as positive criticism.
[doublepost=1548735169][/doublepost]

what makes you believe that? Because the mouthpiece of the company says what you want to hear? Following them blindly doesn't make it true.

On the flip side, because one doesn't believe that is the case or doesn't believe the CEO doesn't make it false either.

 

[Awesom-0]

I am sorry, but you are downplaying a really bad failure in QC in a security relevant iOS core technology, and I can’t by any means understand why you would want to do so.

You might not be a software engineer, but there are enough techniques to prevent these kind if bugs and some are really basic and not even special security related patterns.

This app starts the whole VOIP stack behind an “incoming call” screen. If you don’t understand that this is an application state that should not exist and that managment of application state is crucial for these kind of apps and a proven technique, I won’t be able to explain the engineering problem at hand to you. And that’s still not looking at all the other levels (multi-me in group chat, no physical user interaction check, no hard stop on press of power button) that should have prevented this supergate from happening. None of these checks were in place. This is a huge failure.

You might also agree that the amount of testing and QC that Boeing might put into their product might result in better products and “**** happens” might a more appropriate answer coming from your corner bicycle shop than from a plane company.

“**** happens” is always true, but lacks any insight into proven techniques of how to prevent **** to happen or leak in crucial situations. That said, may your diapers always match your needs.

(There are great patterns in diaper design, btw., that some might not know about and that still make the whole thing much more reliable and safe these days and therefor are standard now in diaper manufacturing.)

Good to see someone here with some understanding

Something is very wrong for this to just be a bug Especially for a company touting privacy and security.

It really looks like they got caught doing something else

It's still a bug that will be fixed. People can take it anywhere they want. And yes, I believe Apple is out to protect the privacy of it's customers, even if bugs (some worse than others) are discovered.

If I edit code do you understand I break it so it doesn't work at all For this to happen most likely it's exposing something else

Or if someone screwed up there is a giant flaw in its design for this to happen

Like the plain text passwords in osx as a "bug" Do you really believe that or do you work for Apple

These issues are exposing serious problems at Apple you should be concerned with and not defend. It is unacceptable even 20 years ago.
[doublepost=1548735267][/doublepost]

It's all well and good your opinion, but has little to do with the premise that Apple jumped into action after this hit the news.

As far as the fanboy stuff, it's just as bad as the anti-apple agenda masquerading as positive criticism.
[doublepost=1548735169][/doublepost]
On the flip side, because one doesn't believe that is the case or doesn't believe the CEO doesn't make it false either.

Are you going to address the software problems or talk about different things This should never happen just like the passwords in osx being plain text.

 

[I7guy]

Good to see someone here with some understanding

Something is very wrong for this to just be a bug Especially for a company touting privacy and security.

It really looks like they got caught doing something else


If I edit code do you understand I break it so it doesn't work at all For this to happen most likely it's exposing something else

Or if someone screwed up there is a giant flaw in its design for this to happen

Like the plain text passwords in osx as a "bug" Do you really believe that or do you work for Apple

These issues are exposing serious problems at Apple you should be concerned with and not defend. It is unacceptable even 20 years ago.

It's still a bug (yes, a serious one). One can wrap all of the hyperbole around this, but it still boils down to, a bug, no matter where my place of employment is.

 

[cmaier]

Looks like they disabled group FaceTime at the server

 

[I7guy]

Good to see someone here with some understanding

Something is very wrong for this to just be a bug Especially for a company touting privacy and security.

It really looks like they got caught doing something else


If I edit code do you understand I break it so it doesn't work at all For this to happen most likely it's exposing something else

Or if someone screwed up there is a giant flaw in its design for this to happen

Like the plain text passwords in osx as a "bug" Do you really believe that or do you work for Apple

These issues are exposing serious problems at Apple you should be concerned with and not defend. It is unacceptable even 20 years ago.
[doublepost=1548735267][/doublepost]
Are you going to address the software problems or talk about different things This should never happen just like the passwords in osx being plain text.

I am not addressing anything. Apple will be fixing the issue. Lots of things shouldn't happen in this world, but they do. Experian shouldn't have been hacked either.

 

[I7guy]

Looks like they disabled group FaceTime at the server

That's an interesting way of cutting this off at the knees.

 

[TVreporter]

I can’t find any confirmation anywhere that this just impacts iOS 12 devices... what about earlier versions?

 

[TheSkywalker77]

Wait for them to get sued over this too.

 

[antonis]

Just a piece of NSA code that went astray.
What ? You didn’t actually believe the iOS privacy crap, did you ?

 

[stylinexpat]

The person you are calling still has the someone would like to FaceTime screen, even though no more ringing.


Facetime Video. Haven't tested Audio.

So how long does that last for? Usually not long if I am not mistaken or unless they answer or refuse call, correct..?

 

[Scooz]

Yea it is kind of forgive-able that they never checked this one extremely specific GUI action. But why is the core of the system way before we even get to the GUI patched together so poorly that this worked?

Forgive me I am not programmer but you would think the design of the software would be built from the ground up to make something like this nearly impossible (yes I know there is no impossible in software). I would imagine the processes handling the transfer of video/audio would be locked down absolutely unable to proceed without direct user consent. Hell even that direct user consent, "swipe to answer", should be very carefully engineered to ensure there literally was a HUMAN making the motion & not faked by a bot. I always thought Apple had this **** on lock? Is this the revealing moment where we find out Apple security is no better than anyone elses & is literally a misplaced ; away from catastrophe? Am I crazy to think the underlying design should be ensuring this glitch is not possible?

I think you’re absolutely right. There are several layers where that behaviour should have been stopped from happening. From multiple mes in the call to the hard user interaction checks you mentioned. That phone/facetime app should not be handled like it’s any other app, the calculator or something.

That’s all hard work. Expensive in design, implementation, auditing and maintainance. But you have to see that this core app/technology needs these efforts and investments. Google had similar problems with their old media stack, Windows with their super user implemetation. But you need to see what app needs work and effort beyond simply ensuring functionality and that this intensive care might have be extended to OS features and frameworks that the app uses.

And it would be normal to assume that they would have done so in those 12 years. Apple always has the artist bonus, but after a feature becomes standard one should expect even Apple to polish it’s implementation.

So maybe this was a typical Apple issue: Group Facetime being a new feature but one that a customer would see as a part of a meanwhile hardened core feature and therfor expect it to work securely and especially not break the core feature. Artist-Apple, though, was just happy that it worked at all.

 

[citysnaps]

Nothing is 100% perfect. However, when a bored taxi driver can hack the phone in a few attempts, QA engineers haven't tried hard enough. Sorry, there should be someone in the company who's trying to hack the interface 8 hours a day.

If I test an email app, I need to try what happens when the From and To addresses are the same, or empty. Similarly, we need to test what happens when we add ourselves into an existing conversation. These are common boundary conditions.

Hindsight is super easy now that the issue is revealed and now known.

Are you confident you can test for all other potential unknown issues lurking out there for all of Apple’s software, under myriad scenarios and test permutations?

With 100% certainty? If so, you should apply for employment at Apple as their Director of Software QC. Convince Apple you can deliver on that and they’ll pay you a ton of money.

 

[Ethosik]

Good to see someone here with some understanding

Something is very wrong for this to just be a bug Especially for a company touting privacy and security.

It really looks like they got caught doing something else


If I edit code do you understand I break it so it doesn't work at all For this to happen most likely it's exposing something else

Or if someone screwed up there is a giant flaw in its design for this to happen

Like the plain text passwords in osx as a "bug" Do you really believe that or do you work for Apple

These issues are exposing serious problems at Apple you should be concerned with and not defend. It is unacceptable even 20 years ago.
[doublepost=1548735267][/doublepost]
Are you going to address the software problems or talk about different things This should never happen just like the passwords in osx being plain text.

Windows 10 has had some serious bugs too that “should never happen”.

1. 1511 update broke all desktop and start menu shortcuts when you click on them once each per restart. You would receive “bad stub data”. Breaking shortcuts that existed for MANY versions of Windows should not happen.

2. 1511 Disk Cleanup (not even system files) was known to completely destroy Windows installs. Luckily we had images and Acronis backups at my work.

I’m a software engineer. It doesn’t matter if it’s on a different layer. Weird bugs like this can happen. I’m not saying it’s not serious, but “should never happen” never works when humans are programming because we all make mistakes.

 

[Awesom-0]

It's all well and good your opinion, but has little to do with the premise that Apple jumped into action after this hit the news.

As far as the fanboy stuff, it's just as bad as the anti-apple agenda masquerading as positive criticism.
[doublepost=1548735169][/doublepost]
On the flip side, because one doesn't believe that is the case or doesn't believe the CEO doesn't make it false either.

I am not addressing anything. Apple will be fixing the issue. Lots of things shouldn't happen in this world, but they do. Experian shouldn't have been hacked either.

Diverting the subject to experian.. They don't advertise security and operating systems.

Do you have any understanding of security and operating systems or just blindly defend anything Apple

This should never happen. Has this even happened with Skype when it was shown that with prism?

You don't just have this happen without serious issues ever. I forget but isn't this supposed to be end to end encryption and security as the priority

They got caught and people are reporting FaceTime group chat disabled I wouldn't trust FaceTime or imessage for anything important. Plenty of open source stuff that you can actually trust.

Probably why Apple won't make anything cross platform now. You won't ever know unless they make it open source right?

I keep trying to justify wanting anything from Apple but either it's a throw away product or they want to tell me they know better than me Yeah .. Um throughout history that has been proven to be a very stupid move for a individual.

They could very easily open source ios and osx and be optimized on their hardware and run better than anything else competing But they don't and won't until they lose the fan boys and people who won't learn anything else

Watch Apple is just turning into Facebook I'm out I waited on a Mac pro back for Nehalem architecture and had to build my own since they delayed that 6 months compared to everyone else. Waited for updated xserves for them to discontunue it My mbp fried the gpu that they said wasn't affected and then they said was like every single other company 6 months before them, 2 iPhones with touch disease before it was a huge issue.

Everything since then I switched to works perfectly just degraded batteries on a couple of things

Never needed a extended warranty except with Apple. And if you say their warranty repair is great Nope they screwed that up as well on the fried gpu. I gave that $2700 mbp away after they broke other things replacing the motherboard.

Seems like everything here is advertising.

I see you all saying others wouldn't have any idea because they are not a engineer

LOL I'm a engineer and those people you put down for not being one have the right idea and should complain.

Slashdot went to garbage and this did close to a decade ago.

If you want my resume on being an engineer Nissan sent me to college and I left to work with Samsung while doing architecture for InterZone in Milan

If you think it's difficult to design a case for a iPad pro so it doesn't bend or a actual Mac pro you are also wrong. In the amount of time Apple had had I could of done that with hand tools and a block of aluminum.

It's all retarded and I'm done ranting about how far Apple has fallen and clearly I don't belong here Just another echo chamber.

No company is good not Apple, Microsoft, Dell anyone. Fan Boys and people who stick with any brand will ruin them

You want privacy you must have a open source reviewed software. Not a company that tells you they know best and what you want

I'm done delete my account mods and post some more ads or giveaways or betas.
[doublepost=1548737896][/doublepost]

Windows 10 has had some serious bugs too that “should never happen”.

1. 1511 update broke all desktop and start menu shortcuts when you click on them once each per restart. You would receive “bad stub data”. Breaking shortcuts that existed for MANY versions of Windows should not happen.

2. 1511 Disk Cleanup (not even system files) was known to completely destroy Windows installs. Luckily we had images and Acronis backups at my work.

I’m a software engineer. It doesn’t matter if it’s on a different layer. Weird bugs like this can happen. I’m not saying it’s not serious, but “should never happen” never works when humans are programming because we all make mistakes.

Yes and does it break the security layer in place to send audio to those who request it And if you want security you pick anything else. Bsd Unix Linux. You know software people can actually audit and fix right then.

Not a system where you have to trust a company that says we know best for you. Here you don't want touch ID let us make things more expensive by adding facial scans and touch bars

 

[C DM]

I am sorry, but you are downplaying a really bad failure in QC in a security relevant iOS core technology, and I can’t by any means understand why you would want to do so.

You might not be a software engineer, but there are enough techniques to prevent these kind if bugs and some are really basic and not even special security related patterns.

This app starts the whole VOIP stack behind an “incoming call” screen. If you don’t understand that this is an application state that should not exist and that managment of application state is crucial for these kind of apps and a proven technique, I won’t be able to explain the engineering problem at hand to you. And that’s still not looking at all the other levels (multi-me in group chat, no physical user interaction check, no hard stop on press of power button) that should have prevented this supergate from happening. None of these checks were in place. This is a huge failure.

You might also agree that the amount of testing and QC that Boeing might put into their product might result in better products and “**** happens” might a more appropriate answer coming from your corner bicycle shop than from a plane company.

“**** happens” is always true, but lacks any insight into proven techniques of how to prevent **** to happen or leak in crucial situations. That said, may your diapers always match your needs.

(There are great patterns in diaper design, btw., that some might not know about and that still make the whole thing much more reliable and safe these days and therefor are standard now in diaper manufacturing.)

I'm not downplaying anything. I'm commenting on the reality of the situation that something like this can still happen with even improved and amazing quality assurance in play. There's is no way to guarantee that there would be no issues at all.

Seems like the interpretation of that is somehow being taken as if nothing could or should be done to avoid things like this and that things can't be improved. Which, as I mentioned before, isn't what is being said. All that is being commented on is that reality falls in between the extremes--an issue coming up doesn't necessarily mean things are just horrific and basically no work happens and that's it.