Apple today issued an apology for its major FaceTime security bug that allowed for eavesdropping on calls. "We have fixed the Group FaceTime security bug on Apple's servers and we will issue a software update to re-enable the feature for users next week," said Apple in a statement issued to MacRumors and other media outlets. For absolute clarity, we've since confirmed that this means Group ‌FaceTime‌ will remain permanently disabled on iOS 12.1 through iOS 12.1.3. To access Group ‌FaceTime‌, users will need to update their iPhone, iPad, or iPod touch to a software update coming next week that is likely to be iOS 12.1.4. Apple disabled Group FaceTime within hours of the bug making headlines, instantly preventing the bug from working. Widely publicized on Monday, the ‌FaceTime‌ bug allowed one person to call another person via ‌FaceTime‌, slide up on the interface and enter their own phone number, and automatically gain access to audio from the other person's device without that person accepting the call. In some cases, even video was accessible. play We have fixed the Group ‌FaceTime‌ security bug on Apple's servers and we will issue a software update to re-enable the feature for users next week. We thank the Thompson family for reporting the bug. We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone's patience as we complete this process. We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group ‌FaceTime‌ and began work on the fix. We are committed to improving the process by which we receive and escalate these reports, in order to get them to the right people as fast as possible. We take the security of our products extremely seriously and we are committed to continuing to earn the trust Apple customers place in us. Apple's full statement issued to MacRumors: The bug will presumably be fixed in a subsequent iOS 12.2 beta as well. Group ‌FaceTime‌ debuted with iOS 12.1 in October.<doc-sep>Craig Federighi, Apple’s senior vice president of Software Engineering, discussing Group FaceTime at the 2018 Apple Worldwide Developers Conference in San Francisco. Photo : Marcio Jose Sanchez ( AP ) A jaw-dropping flaw in Apple’s FaceTime software allows for users to eavesdrop on others while a call is still ringing, according to 9to5Mac. Advertisement The bug works by simply dialing another user, then swiping up and inserting the originating number via the “Add Person” screen before it is answered. FaceTime apparently is thus tricked into believing that a Group FaceTime conference call is occurring, transmitting audio from the recipient’s device whether or not they have accepted or rejected the call . Gizmodo was able to replicate the bug in a matter of seconds simply by following those steps. According to the Verge, this very serious security issue is compounded by another: While said “conference call” is happening, if the recipient hits the power or volume button to ignore the call, their device will start sending audio as well as video from its front-facing camera, again without any visual notification (though in this instance, it also activates the caller’s audio). That flaw was further confirmed by Mashable and BuzzFeed News, the latter of which noted that activating Do Not Disturb mode appears to at least block microphone access . According to 9to5Mac, the issue is even more serious with Mac computers: We have also replicated the problem with an iPhone calling a Mac. By default, the Mac rings for longer than a phone so it can act as a bug for an even longer duration. Advertisement Apple told BuzzFeed News in a statement that it is “aware of this issue and we have identified a fix that will be released in a software update later this week.” However, seeing as it appears as though any FaceTime user with a device that supports Group FaceTime (iOS 12.1/MacOS Mojave 10.14.1 or later) could potentially be streaming audio or video to anyone without their knowledge—and the steps required to do this are both trivial and currently making the rounds on the internet—everyone should absolutely disable FaceTime until Apple gets around to fixing this. On an iOS device, simply navigate to the Settings application and switch the toggle on the FaceTime icon to gray. On a Mac, open the FaceTime app, then click FaceTime in the menu bar and select “Turn off FaceTime.” Advertisement Update: 1/28/2019 at 11:15 p.m. ET: According to Bloomberg’s Mark Gurman, it looks like Apple is in the process of disabling Group FaceTime features. Advertisement [9to5Mac/The Verge/BuzzFeed News]<doc-sep>The Apple logo is seen hanging inside the Apple store on West 66th Street on October 5, 2011 in New York City. Apple's Newton device made its public debut at CES in 1992. Marketed as a computer that fits in the palm of your hand, the device never fully took off. Apple's Fitness+ wants to take on Peloton with at-home workouts CUPERTINO, CALIFORNIA - OCTOBER 13, 2020: Apple CEO Tim Cook talking about the value of 5G for customers during a special event at Apple Park in Cupertino, California. (Photo by Brooks Kraft/Apple Inc.) Here's what you need to know about the iPhone 12 Justin Long appeared in Intel's new PC vs Mac commercial as the "PC Guy" (Source: Intel) Apple CEO Tim Cook exits the stage during Apple's Worldwide Developers Conference in San Jose, California on June 5, 2017. (Photo by Josh Edelson / AFP) (Photo credit should read JOSH EDELSON/AFP via Getty Images) (CNN Business) — Fourteen-year old Grant Thompson was just trying to play video games with friends on a day off from school when he made an alarming discovery: a bug in Apple’s FaceTime tool that could turn iPhones into eavesdropping devices. On Monday, more than a week later, Apple (AAPL) disabled its Group FaceTime feature after other users detected the bug and posted videos of it in action on social media. Apple told CNN Business in a statement it identified a fix for the issue and plans to roll out a software update later this the week. In the nine days between Grant discovering the bug and Apple publicly addressing it, Grant’s mom, Michele Thompson, said she tried everything she could think of to get Apple’s attention. She emailed, called, tweeted at CEO Tim Cook and even faxed a letter on her law firm’s letterhead. An attorney in Tucson, Arizona, she wanted to make sure Apple fixed the problem before it fell “into the wrong hands.” On January 20, she posted about the issue on Facebook and Twitter: “My teen found a major security flaw in Apple’s new iOS. He can listen in to your iPhone/iPad without your approval. I have video. Submitted bug report to @AppleSupport…waiting to hear back to provide details. Scary stuff! ” She was careful not to share too many details on social media, so people wouldn’t know how to recreate it. My teen found a major security flaw in Apple’s new iOS. He can listen in to your iPhone/iPad without your approval. I have video. Submitted bug report to @AppleSupport...waiting to hear back to provide details. Scary stuff! #apple #bugreport @foxnews — Michele Thompson 😊✌🏻 (@MGT7500) January 21, 2019 On Friday, Grant’s mother emailed a bug report and a video to a representative in Apple’s Product Security department. Thompson hadn’t heard back before the bug’s discovery blew up on social media. “It’s exhausting and exasperating,” Michele Thompson said of the reporting process. “It’s very poorly set up especially for the average citizen. I feel like I went above and beyond.” Her son discovered the glitch when he FaceTimed a friend who didn’t pick up. He swiped up on his iPhone to add a friend to the Group chat, a feature that until it was disabled worked on iPhones and iPads running iOS 12.1, and Apple PCs running macOS Mojave. Brian Skoloff/AP Grant Thompson, 14, and his mother tried to warn Apple about a bug in the iPhone's FaceTime tool. Grant realized he could hear everything coming through the first friend’s iPhone, even though that person hadn’t answered. The friends immediately tried to recreate what happened. In some cases, users said, the bug could even access a recipient’s camera. “We tested a few more times and found out we could get people to force answer FaceTime calls,” Grant Thompson told CNN Business. “After we confirmed that it worked, I went and told my mom.” A freshman in high school, Grant told CNN Business he’s “pretty into technology and stuff,” and thinks it would be cool if Apple acknowledged his find. Like many tech companies, Apple has a bug bounty program that offers financial rewards for some discoveries. The program, launched in 2016, pays up to $200,000 for detecting bugs, but some third-party companies will offer more. Bug reports go through Apple’s developer site, but the company told Thompson non-developers can use it. However, most companies don’t have a public-facing way to report these types of bugs. “Apple has a clear reporting channel, and even pays rewards for certain bugs – a.k.a. bug bounties – but these channels are likely only obvious if you’re in the security industry and already know where to go to report. [It’s] not so clear for consumers,” Katie Moussouris, the CEO of Luta Security, which helps companies and governments work with hackers, said in an email. “Except in this case, the customer support team and the social media team (and whoever got that fax) didn’t quite know how to remove obstacles and friction from the reporting process.” It’s important for companies and government agencies to have a public-facing way to report bugs, according to Marten Mickos, CEO of HackerOne, a cybersecurity firm that connects security researchers with companies. “Even if millions of people find nothing to report, and thousands may report something that isn’t really a bug, it still is worth it when just one person finds and can describe the bug,” Mickos said. Apple did not respond to a request for comment about the Thompsons’ bug report or if other users flagged the issue. “Even if the bug had gotten to the right people on day one after discovery, under normal operations, the investigation alone might take a few days or longer for complex issues, let alone creating and testing a fix,” said Moussouris. Mickos said giving rewards serves a good purpose, such as setting a good example for everyone else and showing the company values cybersecurity, he said. After detecting the bug, Grant told his mom he was hoping to get a MacBook Pro, an iPhone X and some AirPods as a reward for spotting the bug.<doc-sep>UPDATE: Apple has taken Group FaceTime offline in an attempt to address the issue in the interim. A significant bug has been discovered in FaceTime and is currently spreading virally over social media. The bug lets you call anyone with FaceTime, and immediately hear the audio coming from their phone — before the person on the other end has accepted or rejected the incoming call. Apple says the issue will be addressed in a software update “later this week”. Naturally, this poses a pretty big privacy problem as you can essentially listen in on any iOS user, although it still rings like normal, so you can’t be 100% covert about it. Nevertheless, there is no indication on the recipient’s side that you could hear any of their audio. There’s a second part to this which can expose video too … 9to5Mac has reproduced the FaceTime bug with an iPhone X calling an iPhone XR, but it is believed to affect any pair of iOS devices running iOS 12.1 or later. Here’s how to do the iPhone FaceTime bug: Start a FaceTime Video call with an iPhone contact. Whilst the call is dialling, swipe up from the bottom of the screen and tap Add Person. Add your own phone number in the Add Person screen. You will then start a group FaceTime call including yourself and the audio of the person you originally called, even if they haven’t accepted the call yet. It will look like in the UI like the other person has joined the group chat, but on their actual device it will still be ringing on the Lock screen. Whilst the call is ringing, swipe up from the bottom of the screen and add yourself to the call. The damage potential here is real. You can listen in to soundbites of any iPhone user’s ongoing conversation without them ever knowing that you could hear them. Until Apple fixes the bug, it’s not clear how to defend yourself against this attack either aside from disabling FaceTime altogether. As it stands, if your phone is ringing with an incoming FaceTime request, the person on the other end could be listening in. What we have also found is that if the person presses the Power button from the Lock screen, their video is also sent to the caller — unbeknownst to them. In this situation, the receiver can now hear your own audio, but they do not know they are transmitting their audio and video back to you. From their perspective, all they can see is accept and decline. (Another update: It seems there are other ways of triggering the video feed eavesdrop too.) We have also replicated the problem with an iPhone calling a Mac. By default, the Mac rings for longer than a phone so it can act as a bug for an even longer duration. Apple has said the issue will be fixed in a software update later in the week. Until then, if you are concerned, you should disable FaceTime in iOS Settings. Now you can answer for yourself on FaceTime even if they don’t answer🤒#Apple explain this.. pic.twitter.com/gr8llRKZxJ — Benji Mobb™ (@BmManski) January 28, 2019 Check out 9to5Mac on YouTube for more Apple news: FTC: We use income earning auto affiliate links. More. Check out 9to5Mac on YouTube for more Apple news:<doc-sep>
Image : Apple After a massive FaceTime bug that allowed users to potentially listen in on others when using the Group feature surfaced Monday, Apple disabled Group FaceTime in a short-term fix to the problem. An update to address the problem was expected this week, but Apple said Friday that while it has fixed the issue on its servers, we won’t see an update to re-enable Group FaceTime until next week. In a statement to 9to5Mac, the company thanked the family of the teenager who discovered the bug and apologized “to our customers who were affected and all who were concerned about this security issue.” The company also appeared to address concerns that the problem was not immediately addressed despite the family’s claims that they made repeated attempts to flag the problem to Apple: We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix. We are committed to improving the process by which we receive and escalate these reports, in order to get them to the right people as fast as possible. We take the security of our products extremely seriously and we are committed to continuing to earn the trust Apple customers place in us. Grant Thompson, 14, reportedly learned of the bug accidentally while trying to start a Group FaceTime with two friends. When swiping up to connect with a second friend before the first one had answered, he discovered he was then instantly connected to the first friend’s phone even though they had not answered the call. The teen flagged the issue to his mother Michele Thompson, who told NBC News she then tried to escalate the glitch to Apple through multiple channels including by email and phone, but said she wasn’t able to connect with anyone to address the issue. Grant Thompson told MarketWatch that it was more than a week before they were able to connect with Apple, adding that his mother “contacted them almost every single day through email, calling, faxing.” Michele Thompson, a lawyer, told the site that there should be better systems in place for “for the average citizen to report things like this.” The bug could work on users whose devices supported Group FaceTime, which included those running iOS 12.1 and macOS Mojave 10.14.1 or later. Apple is already facing multiple lawsuits over the incident. Following news of the eavesdropping bug this week, New York Governor Andrew Cuomo issued a consumer alert about the bug, which he described as “an egregious breach of privacy that puts New Yorkers at risk.” Cuomo and Attorney General Letitia James later announced that New York state would be opening an investigation into the incident. “New Yorkers shouldn’t have to choose between their private communications and their privacy rights,” James said in a statement. “This FaceTime breach is a serious threat to the security and privacy of the millions of New Yorkers who have put their trust in Apple and its products over the years.” [9to5Mac]