San Francisco (CNN Business) A newly discovered bug in Apple's FaceTime software lets Apple users listen in on the people they are calling, and even see through their front-facing camera, without them picking-up the call.

The bug, flagged by 9to5Mac on Monday, was quickly recreated by people across social media. CNN Business confirmed the bug multiple times in its own tests.

Apple said in a statement Monday night that it has identified a fix for the problem and will release it in a software update later this week. In the meantime, Apple's website indicates Group FaceTime is unavailable , and the company confirmed it has started disabling the Group FaceTime feature for all users.

The bug works on iPhones and iPads running iOS 12.1, and Apple PCs running macOS Mojave, which have the recently added Group FaceTime feature.

When the bug is activated, the person who initiated the call is able to hear the live audio on the other person's phone, even though the recipient has not accepted the call. And their screen gives no indication that their conversation is being transmitted. In some cases, the bug can also show live video of the other person if they press a volume button to dismiss the call.

Read More</s>Ok, everybody. Breathe. It's going to be OK.

Yes. The Facetime eavesdropping bug actually works. I recreated it just like everyone else in the world who has read the article. However, the reaction from the media and even from some cybersecurity professionals is a bit on the melodramatic side in my opinion.

A. If someone calls you via FaceTime, you will probably hear the call coming in, so it won’t be a complete surprise or really stealthy eavesdropping.

B. It's fair to say that someone would be pretty bored eavesdropping on 99.99% of all conversations. In most cases, the worst you might catch someone saying is, “Ugh. Him?! I’m not answering that. That guy sucks!”

Still, the sky is apparently falling, and many seem ready to crucify Apple for this breach of their privacy. To get some broader perspective, I reached out to some cybersecurity experts to see what they think of the Apple FaceTime eavesdropping bug and the implications it has for cybersecurity and privacy. The responses range from this being a crucial flaw to it’s not really that big a deal. Let’s see what the experts have to say.

“The FaceTime bug is pretty severe as far as application bugs go. While Apple has since disabled group FaceTime calls, which experienced the glitch, the effects may still be far reaching.

The bug enables all kinds of data compromise as an iOS user could have had someone eavesdrop regardless of whether the call was ever accepted. As far as businesses are concerned, this could lead to some potentially fine-worthy issues with GDPR in Europe if pre-call conversations were overheard or listened to.

This bug underscores the importance of security testing, especially on applications for such a complex device as the iPhone, of which over seven hundred million devices are in use worldwide. Ease-of-use and security more often than not are contrary to each other. Apple usually handles this security balance very well, but things seem to have gone sideways here.”

“New mobile risks are emerging all the time, and the latest FaceTime bug is a reminder that these days your smartphone is just as data rich as your computer. In this particular case, the real problem is a privacy problem- as the bug essentially allows iOS users to listen in on each other, with no indication that someone is listening in on you. As we adopt new technology into our everyday lives, it’s important to consider how these emerging technology trends could lead to greater privacy risks if we don’t take steps to protect our data. Be sure to disable FaceTime in iOS Settings to be sure no one is listening in on you.”

“People are already paranoid that their devices are listening in – one moment you’re talking about getting pizza only to see an ad about the closest pizza joint pop up on your social media feed. This bug makes the paranoid even more paranoid. Even when a patch is released to fix this kind of issue, there is no stopping other issues creeping up on other applications that rely on your camera and microphone. Even with new features that Apple is releasing in iOS updates, people are still slow to update or refuse to update until absolutely necessary when their favorite app is not supported. Will this security bug make a big impact on Apple? Probably not, but more and more people will continue to act slowly when upgrading iOS and switching to the latest and greatest iPhone.”

“There are little-to-no hardware controls on mobile devices. On laptops we have webcam covers and activity lights. But arguably unless you have the camera covered all the time, this isn't solving the issue because the control is not in the hardware, it's in the software. This means a hacker can actually activate your webcam while deactivating the activity light. The fact that people haven't adopted camera covers on iPhones is saying something about the level of consumer trust in Apple.

It's not malicious code; you’re exposed on these devices even if you don’t install anything malicious. This is similar to unlock bugs. In almost every OS release someone can find a way to unlock your phone, but this is the first time I've seen a bug like this that can be remotely exploited without physical access to the iPhone.”

“This could pose a major issue for anyone working with sensitive data (i.e.- government agencies); however, it looks like the short-term fix is to simply turn off FaceTime calling. If the recipient is running a Mac, there is a potential that the audio can be harvested for a longer period of time (Mac laptop/desktops ring longer than iPhone devices). This all depends upon the recipient letting their device remain unanswered, which would require intimate knowledge from the attacker on the target. Such knowledge of the individual user's behavior could lead to this attack being successful and the compromise of sensitive information, but again, if users simply turn off FaceTime until Apple pushes a fix later this week, then they should be fine.”

Stop Freaking Out about the Apple FaceTime Bug

“While the news of the Apple FaceTime bug is indeed something that is shocking, the industry is getting overly excited as the possibility of this bug being abused is extremely low. I believe people are finally waking up to the shock that technology can enable an attacker to listen to everything you say, use your camera to watch everything you do, and knowing that your iPhone can do this without the user needing to make any changes. Most citizens are ignoring the risks and assume they will never be a target. Again, the cybersecurity community is getting overly enthusiastic about this flaw, most likely because it coincided with National Privacy Day (or what I like to call Privacy Remembrance Day) so such lack of privacy brings some well-debated discussions.”

I didn’t ask Bruce Schneier for his input, but he is a respected cybersecurity expert. On his blog, Schneier proclaimed, “This is definitely an embarrassment, and Apple was right to disable Group FaceTime until it's fixed. But it's hard to imagine how an adversary can operationalize this in any useful way.”

As Ken Underhill explained, it is a more serious issue if you happen to work in the government or some other role where you might be discussing classified or sensitive information. It could also be potentially serious for a cheating spouse or someone doing things they shouldn’t be doing and has secrets to keep. Even then, the risk is minimal in my opinion because of the mitigating factors.

It is a bug and Apple will fix it as quickly as possible, but it's a stretch, in my opinion, to call it "major". A "major" bug is one that lets someone call you via FaceTime and capture all of your credit card data from the Apple Pay cards in your Wallet, or AT LEAST one that lets you enable the audio stream indefinitely so you can just keep listening in. This is more of a "Kind of silly / perhaps annoying bug that may be somewhat serious in rare instances if someone happens to catch exactly the right conversation" bug.</s>Apple users were exposed to a bug which surfaced on January 28, 2019. This bug allows callers to listen in on others’ FaceTime video chats even before they answer the call. The bug is going to affect calls to Mac computers and iPhones. Apple temporarily disabled the group calling functionality on its FaceTime application. Apple dashes to fix the glitch that permits users to hear in the people they were calling even when they did not pick up the call. The bug also allows callers to see the video of the person they are calling before even they picked up in certain circumstances

The US tech giant confirmed the presence of the bug. This bug turns the phone of the call recipient into a microphone even when the call is not picked up. If the call recipient presses the power button on the side of the iPhone, generally used to silence the incoming call, the phone will start broadcasting a video to the caller.

Apple told Reuters that they are aware of the problem and will release a software update to fix the bug later this week. Until an update is released by Apple to fix the bug, users are advised to turn off the face time feature in the phone’s settings.

Here’s how Twitter reacted to the FaceTime bug:</s>Apple has disabled a group-chat function in FaceTime after users said a software bug could let callers activate another person's microphone remotely.

With the bug, a FaceTime user calling another iPhone, iPad or Mac computer could hear audio — even if the receiver did not accept the call. The bug is triggered when callers add themselves to the same call to launch a group chat. That makes FaceTime think the receiver had accepted the chat.

The bug, demonstrated through videos online , comes as an embarrassment for a company that is trying to distinguish itself by stressing its commitment to users' privacy.

"This is a big hit to their brand," said Dave Kennedy, CEO of Ohio-based security firm TrustedSec. "There's been a long period of time people could have used that to eavesdrop. These things definitely should be caught prior to ever being released."

There is no longer a danger from this particular bug as Apple disabled group chats, while regular, one-on-one FaceTime remains available.

NBC News and The Wall Street Journal reported Tuesday that the family of a 14-year-old high school student in Tucson, Arizona, tried to inform Apple about the bug more than a week before it became widely known to the public. The boy, Grant Thompson, said he discovered it by accident while calling friends to play the game "Fortnite."

It's hard to know if anyone exploited the bug maliciously, said Erka Koivunen, chief information security officer for Finnish company F-Secure. He said it would have been hard to use the bug to spy on someone, as the phone would ring first — and it's easy to identify who called.

Apple said Tuesday that a fix will come in a software update later this week. Apple declined to say when it learned about the problem. The company also wouldn't say if it has logs that could show if anyone took advantage of the bug before it became publicly known this week.

Kennedy commended Apple's quick response this week following reports of the bug by tech blogs. He predicted the reputational dent could soon be forgotten if it doesn't become part of a pattern.

"All bugs are obvious in retrospect," said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation. "The truth is bugs are subtle, code is complicated and sometimes things get through."

Galperin said Apple should develop a better process for fielding reports about potential security flaws. She said the 14-year-old's discovery of the problem "just tells us a lot about reporting security bugs depends on knowing the right person."

Apple had introduced the 32-person video conferencing feature in October for iPhones, iPads and Macs. Regular FaceTime calls aren't affected unless the caller turns it into a group chat.

Word of the bug came as Apple reported that profit for the last three months of 2018 dipped slightly to $20 billion while revenue fell 5 percent from the prior year to $84 billion. Earlier this month, Apple said that demand for iPhones was waning and that its earnings for the final quarter of 2018 would be below its own forecasts — a rare downgrade from the company.

If you want to take the extra precaution to avoid being spied on, it's advisable to disable FaceTime on your device until the bug fix is released.
• iPhone or iPad: Find Settings then FaceTime and slide the green button off.
• Mac: Open the FaceTime app. Put your cursor where it says FaceTime at the top-left of the screen next to the Apple icon, then select "Quit FaceTime" from the dropdown.</s>Apple Inc. scrambled to fix a bug in its FaceTime video-chat system that lets callers eavesdrop on users of iPhones, iPads, and Macs, an embarrassing setback for a company that has touted its commitment to privacy.

The glitch, which was flagged on social media Monday, allows one FaceTime user calling another to listen in while the recipient’s Apple device is still ringing—even if the person never accepts the call. It requires several steps, but could be used by someone familiar with the technique to eavesdrop on rooms with...</s>(Reuters) - Andrew and new on Wednesday said the state was probing Apple Inc's failure to warn consumers about a bug that lets iPhones users see and hear others before they accept a video call.

The bug, which has been able to replicate, allows an user placing a call using Apple's video-calling feature to hear audio from the recipient's phone even if the call has not gone through.

"We need a full accounting of the facts to confirm businesses are abiding by consumer protection laws and to help make sure this type of privacy breach does not happen again," said in a statement.

The statement said and James would probe Apple's slow response and cited that a consumer had made the company aware of the bug more than a week before it took action to disable the feature.

Apple said on Monday it was aware of the problem and had come up with a fix that would be released in a software update later this week. The company was not immediately available for comment on Wednesday.

The bug appears to rely on Apple's group video-calling feature, which Apple launched in October. In certain situations, FaceTime also broadcast both video and audio from the recipient's phone, website the Verge reported on Monday.

Cuomo on Monday issued a consumer alert about the bug and encouraged users to disable the app.</s>A teenager from Arizona uncovered a bug that turns IPhones into eavesdropping devices while trying to play a game of 'Fornite' with his friends.

Grant Thompson, a 14-year-old high school student in Tucson, wanted to chat with friends when he discovered a major bug in Apple's popular Group FaceTime feature.

Thompson called his friend Nathan using FaceTime, but Nathan didn't pick up on January 19.

Thompson then swiped up and added another friend, a move that instantly connected him with Nathan, whose phone was still ringing.

The youngster had discovered a bug that allowed him to force other iPhones to answer a FaceTime call, even if the other person doesn't take any action.

Apple has since disabled the 'Group FaceTime' feature, and a software update to fix the bug is expected to be released.

The bug is triggered when callers add themselves to the same call to launch a group chat. That makes FaceTime think the receiver had accepted the chat.

It lets people hear and even see those they are reaching out to on iPhones using the video calling software, sparking privacy fears.

Grant's mother Michele, a lawyer, said she had tried repeatedly to contact Apple about the privacy glitch between her son discovering it and announcing that it was disabling the feature on Tuesday.

Thompson said she tried everything she could think of to get Apple's attention. She emailed, called Apple and tweeted CEO Tim Cook and even faxed a letter on her law firm's letterhead.

'It was very frustrating getting them to respond. I get it. I'm sure they get all sorts of kooks that try to report things to them,' she told CNN Business.

A freshman in high school, Grant told CNN Business he's 'pretty into technology and stuff' and thinks it would be cool if Apple acknowledged his find.

We tested a few more times and found out we could get people to force answer FaceTime calls,' Grant told CNN Business.

'After we confirmed that it worked, I went and told my mom.'

Apple has a bug bounty program that offers financial rewards for some discoveries.

The program, launched in 2016, pays up to $200,000 for detecting bugs, but some third-party companies will offer more.

Thompson said that she hoped her son might be able to claim a bounty for the bug but that the process required technical knowledge she didn't have.

Although she said they didn't report the issue for a reward, she believes Apple should acknowledge her son.

'Apple should reward people for reporting things of this nature, not just reward the developers or the people who are savvy with tech,' said Thompson. 'I think just thanking him would be great,' she said.

The bug, demonstrated through videos online , comes as an embarrassment for a company that is trying to distinguish itself by stressing its commitment to users' privacy.

'This is a big hit to their brand,' said Dave Kennedy, CEO of Ohio-based security firm TrustedSec. "

'There's been a long period of time people could have used that to eavesdrop. These things definitely should be caught prior to ever being released.'

There is no longer a danger from this particular bug as Apple disabled group chats, while regular, one-on-one FaceTime remains available.

It's hard to know if anyone exploited the bug maliciously, said Erka Koivunen, chief information security officer for Finnish company F-Secure.

He said it would have been hard to use the bug to spy on someone, as the phone would ring first - and it's easy to identify who called.

Apple said Tuesday that a fix will come in a software update later this week. Apple declined to say when it learned about the problem.

The company also wouldn't say if it has logs that could show if anyone took advantage of the bug before it became publicly known this week.

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation said the 14-year-old's discovery of the problem 'just tells us a lot about reporting security bugs depends on knowing the right person.'

Galperin said Apple should develop a better process for fielding reports about potential security flaws.</s>LONDON - Apple Inc said on Monday it will issue a software patch later this week for a bug that lets iPhone users hear audio from users who have not yet accepted a video call.

The bug, which Reuters was able to replicate, allows an iPhone user placing a call using Apple’s FaceTime video calling feature to hear audio from the recipient’s phone even if the recipient has not yet picked up the call. The bug appears to rely on Apple’s group video calling feature.

Apple announced the feature last summer, but then removed it from early test versions of its iOS 12 operating system. Apple released the feature to the public in late October.

“We’re aware of this issue and we have identified a fix that will be released in a software update later this week,” an Apple spokesperson said in a statement.</s>Earlier this week, a bug was found in FaceTime that could let others listen in to your Apple device’s microphone (or, in specific cases, view video from the camera) without you accepting the FaceTime call.

Apple disabled the Group FaceTime feature that enabled this bug server-side, thus preventing its future misuse while they worked on a proper patch. Apple says that patch should land later this week, but it sounds like that won’t be the end of it for the company.

New York Attorney General Letitia James and Governor Andrew Cuomo have just announced their intent to investigate the matter — how it happened, and what they call Apple’s “slow response.”

While Apple responded with its temporary fix once the bug started going viral, reports suggest that at least two users — a 14-year-old from Arizona and his mother — had been trying to no avail to warn Apple of this matter for more than a week prior.

While bugs happen, this is a particularly egregious and mystifying one. It’s like the perfect storm of bugs — there’s the bug that turns on the microphone early, then a second stage of the bug that for some logic-defying reason turns on the camera if the call recipient hits the power button to try to decline the call. Then it slipped through QA. Then, finally, it gets noticed by someone with good intentions who tries many ways to bring it to Apple’s attention, unsuccessfully. It slowly spreads from person to person, then goes viral on Twitter. This is the kind of bug that people will be reading about in their software engineering textbooks for years.

We’ve reached out to Apple for comment on the investigation, but none was given at the time of publishing.</s>Apple is working on a fix to a FaceTime problem that could see people spy on your conversations.

The company acknowledged on Monday that its chatting app FaceTime has a bug that would allow people to call unsuspecting victims and listen in on them before the recipient answers the call. Apple-tracking blog 9to5Mac found that the issue also affects video and could allow people to look at the recipient before they decide to take or ignore the FaceTime chat.

Unsurprisingly, the problem has caused a stir among privacy advocates and those who are simply concerned about being spied on. And Apple responded on Monday evening by turning off FaceTime Group Chatting from the server to effectively kill the bug and render FaceTime chatting useless until Apple launches a fix.

For many, that fix alone would be enough to stop the bug from affecting them. If people can’t call with requests to hold a chat, there’s no way for them to spy on unsuspecting victims. But even then, it’s always good to take matters into your own hands. And once Apple turns the feature back on, there’s no telling whether an update will indeed address the problem.

Therefore, many security experts are recommending people turn off FaceTime in their iOS settings. You can do that by going to your Settings, scrolling down to FaceTime and tapping it, and then toggling it off in that menu. Since the flaw also affects Mac users, you’ll want to open your FaceTime app on the Mac, go to Preferences, and uncheck “Enable this account” to turn it off.

In addition to turning off the affected FaceTime feature, Apple (aapl) said this week that it’s working on a software update that will fix the bug. The company is planning to release the update later this week.

Until then, it’d be a good idea to keep FaceTime turned off and it’s confirmed that the fix actually works.
A bug in Apple Inc's FaceTime software is reported to have allowed users to spy on other devices.