… As apple disables feature
A significant bug has been discovered in FaceTime and is currently spreading virally over social media. The bug lets you call anyone with FaceTime, and immediately hear the audio coming from their phone — before the person on the other end has accepted or rejected the incoming call. Apple says the issue will be addressed in a software update “later this week”.
Naturally, this poses a pretty big privacy problem as you can essentially listen in on any iOS user, although it still rings like normal, so you can’t be 100% covert about it. Nevertheless, there is no indication on the recipient’s side that you could hear any of their audio. There’s a second part to this which can expose video too …
Here’s how it worked: An iPhone user would call someone using FaceTime, tap “Add Person” and add their own phone number. Without the recipient answering the phone, audio from the other user’s phone then streamed to the caller.
If the recipient hit the phone’s power button, thinking the call had been declined, another curious bug kicked in: The recipient’s audio cut out, but the caller could suddenly monitor that person’s camera.
The damage potential here is real. You can listen in to soundbites of any iPhone user’s ongoing conversation without them ever knowing that you could hear them. Until Apple fixes the bug, it’s not clear how to defend yourself against this attack either aside from disabling FaceTime altogether.
What we have also found is that if the person presses the Power button from the Lock screen, their video is also sent to the caller — unbeknownst to them. In this situation, the receiver can now hear your own audio, but they do not know they are transmitting their audio and video back to you. From their perspective, all they can see is accept and decline. (Another update: It seems there are other ways of triggering the video feed eavesdrop too.)
We have also replicated the problem with an iPhone calling a Mac. By default, the Mac rings for longer than a phone so it can act as a bug for an even longer duration.
Meanwhile Apple has reportedly temporarily disabled the Group FaceTime to enable it fix the bug.
On Monday night, Apple said on its System Status page that Group FaceTime is temporarily unavailable, suggesting the feature was taken offline after the reports.
“We’re aware of this issue and we have identified a fix that will be released in a software update later this week,” an Apple spokesperson said in a statement to ABC News.
If you’re running iOS 12.1 or later and want to disable FaceTime until there’s an update, go to Settings on your iPhone, tap Facetime, and toggle it off.
— Benji Mobb™ (@BmManski) January 28, 2019