César Salza / CNET Apple has closed the Group FaceTime security bug that put users at risk of eavesdropping. The company said in a statement Friday that it has fixed the vulnerability on its servers and that it will issue a software update to re-enable Group FaceTime next week. The bug had meant that any Apple device -- including iPhones, iPads and Macs -- could inadvertently or intentionally be turned into a listening device. It was all in how you entered the number of someone you were looping into the video chat. Group FaceTime, which arrived with iOS 12.1 at the end of October, allows up to 32 people to be on the same call. Apple also apologized to users who were affected. "We take the security of our products extremely seriously and we are committed to continuing to earn the trust Apple customers place in us," the company said. Now playing: Watch this: Apple’s FaceTime bug and why iPhone sales are slowing... The bug was another black eye for a company that prides itself on its efforts to protect its users' information. CEO Tim Cook has advocated for more privacy regulation and taken subtle shots at companies that use our data to create personalized ads. It didn't help matters that Apple missed an opportunity to fix the problem more promptly. In its statement, Apple thanked the Thompson family for reporting the bug. Michele Thompson's teenaged son had discovered the vulnerability while playing Fortnite, CNET reported, and she spent a week trying, through a variety of means, to get the company to pay attention. "I tried my best to report it to them, and they didn't listen," Thompson told CNET. The bug allowed FaceTime users to call another device and hear audio on the other end before the recipient answered the call. That is, it turned the device into a hot mic without the user's knowledge. In an awkward turn of events, the news broke on Data Privacy Day. Apple said it's working on improving its process for receiving and escalating tips. Here's Apple's full statement: We have fixed the Group FaceTime security bug on Apple's servers and we will issue a software update to re-enable the feature for users next week. We thank the Thompson family for reporting the bug. We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone's patience as we complete this process. We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix. We are committed to improving the process by which we receive and escalate these reports, in order to get them to the right people as fast as possible. We take the security of our products extremely seriously and we are committed to continuing to earn the trust Apple customers place in us. Privacy fight: Apple restores Facebook's permission to run internal apps The return of the iPhone SE: The phone's available in the box, not as a refurb.<doc-sep>Grant Thompson, a 14-year-old high school student in Tucson, Arizona, just wanted to chat with friends and play some "Fortnite" when he discovered a major bug in Apple's popular FaceTime feature. On Jan. 19, Thompson called his friend Nathan using FaceTime, but Nathan didn't pick up. So Thompson swiped up and added another friend, a move that instantly connected him with Nathan, whose phone was still ringing. "We were pretty shocked at first because it was still ringing on his phone," he said in an interview. "After that we tested it for about half an hour to see if it worked every time." It did. Thompson had discovered a bug that allowed him to force other iPhones to answer a FaceTime call, even if the other person doesn't take any action. Apple has since disabled the "Group FaceTime" feature, and a software update to fix the bug is expected to be released, but not before users expressed widespread shock at the flaw in an Apple device typically known for security. Thompson brought his discovery to his mother, Michele Thompson, a lawyer. She could hardly believe it herself. "I was doubtful," she said. "He showed it to me on my iPhone and it worked." For the next week, Michele Thompson, 43, tried to notify Apple of the flaw through a variety of avenues, many of which were dead ends. "It was very frustrating getting them to respond," she said. "I get it. I'm sure they get all sorts of kooks that try to report things to them." Thompson provided emails to NBC News that showed her efforts to contact Apple, including an Apple representative who directed her to the company's "bug reporter" program and bug bounty program. Thompson said she initially withheld the details of what her son had found in hopes of finding the right person at Apple to explain the problem. She also tweeted and tagged the company. Thompson also tried to alert the media, tweeting what her son had found. Apple did not respond to requests for comment. My teen found a major security flaw in Apple’s new iOS. He can listen in to your iPhone/iPad without your approval. I have video. Submitted bug report to @AppleSupport...waiting to hear back to provide details. Scary stuff! #apple #bugreport @foxnews — MGT7 (@MGT7500) January 21, 2019 Turning to the bounty program, Thompson said she registered as a developer so that she could bring it to the company's attention. Thompson said that she hoped her son might be able to claim a bounty for the bug but that the process required technical knowledge she didn't have. Bug bounty programs, in which people are given monetary rewards for finding security flaws, have become popular with companies that hope to find problems before they can be exploited. Apple launched its bug bounty program in August 2016. Payouts can range from $25,000 to $200,000. The bug comes at an inopportune time for Apple. The company reports quarterly earnings on Tuesday afternoon, financial updates that the company has already warned will come in under analysts' expectations. Apple has also positioned itself as a champion of privacy in the social media age, with CEO Tim Cook routinely espousing the company's dedication to keeping users safe. Cook's most recent tweet, sent Monday, heralds "#DataPrivacyDay." We must keep fighting for the kind of world we want to live in. On this #DataPrivacyDay let us all insist on action and reform for vital privacy protections. The dangers are real and the consequences are too important. — Tim Cook (@tim_cook) January 28, 2019 With few other options, Thompson, who specializes in medical malpractice defense, sent a letter on her firm's letterhead on Jan. 22 to Apple's general counsel. The letter was headed: "Urgent Security Issue Regarding iOS 12.1.3." There was no response. With little success in getting the company's attention, Thompson said her son convinced her to reveal the full details of the bug. The family made a video and uploaded it to YouTube (it is unlisted and Thompson asked that it not be made public since it contains their phone numbers) on Jan. 25, walking through the bug. She then sent the company a two-page letter explaining the issue with a link to the video, according to emails she shared with NBC News. Thompson said she planned to wait a week before sending the video to the press. Then, on Monday, the Apple-centric tech publication 9to5Mac broke the story of the bug. The story was picked up by dozens of news outlets. "All of a sudden, lo and behold, last night my friend said, 'Hey, I just saw this report on CNBC,'" Thompson said. Benjamin Mayo, the app developer and blogger who broke the story for 9to5Mac, said that he did see Thompson's tweet after his article was published but that she did not have anything to do with his reporting. Theresa Payton, CEO of cybersecurity consultancy Fortalice Solutions and a former White House chief information officer, said the Apple flaw shows that while most people have embraced smartphones, they are still devices with cameras and microphones that can violate users' privacy. Payton noted that companies should be also working to make sure that they are responsive to people who find security flaws. "I think it would behoove Apple to take a look at their process and figure out what went wrong here," Payton said. Payton added that she understands the challenges companies can face in terms of the sheer volume of false alarms, but noted that language-processing technologies can help comb through responses to help determine which ones are likely to be legitimate. "I think again this is another one of those kind of situations where customer service has not been able to keep pace with the hockey stick-like growth that big tech companies and social media companies have experienced," Payton said. Thompson said she has not heard back from Apple concerning her attempts to alert the company about the bug since it was publicly revealed. She added that she would not have done anything differently. And she'll still be an iPhone user. "I love Apple products and will continue to use them," Thompson said. "Obviously I am disappointed and concerned that this happened and hope they address the issue quickly."<doc-sep>Apple's Group FaceTime bug that went viral Monday, allowing callers to listen in on unsuspecting recipients took the world by surprise. But someone actually tried to warn the electronics giant about it. Last week. A Twitter user by the handle of @MGT7500, and identified by The Wall Street Journal as Michele Thompson, wrote on the social media platform on Jan. 20, tagging Apple's Support page as well as Fox News to try and attract media attention. "My teen found a major security flaw in Apple’s new iOS. He can listen in to your iPhone/iPad without your approval," Thompson wrote, "I have video. Submitted bug report to @AppleSupport...waiting to hear back to provide details. Scary stuff! #apple #bugreport @foxnews." After news of the bug went viral Monday night, fellow Twitter user John H. Meyer discovered Thompson's tweet, reaching out and sharing the video evidence that the bug was, indeed, exploitable last week. According to the Journal, the bug was discovered by Thompson's son Grant while he was playing "Fortnite" and FaceTiming with friends. More:Worried about FaceTime eavesdropping bug? How to disable the app More:Apple FaceTime bug lets people eavesdrop on your iPhone or Mac without your knowledge Meyer, a venture capitalist at Transpire Ventures, tells USA TODAY in a Twitter direct message that after quickly looking over Thompson's profile he realized "that she’s been trying for a week to bring attention to this by tweeting at Apple and many different news orgs," with Meyer eventually speaking with Thompson over the phone Tuesday morning. In subsequent tweets, Meyer, who has over 9,100 followers on the platform and is a "verified" user, shared additional information. Thompson, Meyer says, is an attorney based in Arizona and the mother of a 14-year old who discovered the bug "around" Saturday, Jan. 19. While Thompson tweeted at Apple on Jan. 20, she also sent a formal notice to the company on Jan. 25 alerting them of the bug. Meyer shares screenshots provided by the mother, including an email sent to Apple's product-security@apple.com email address that the company lists as a way for users to report issues to the company. The email notes it includes a link to the private, unlisted YouTube video posted on Jan. 23 demonstrating the exploit. In subsequent tweets, Thompson says that Apple wanted her to register as a developer to submit the bug report, which she did even though she is not "tech savvy." Meyer even shared a screenshot of the bug report the mother sent to Apple on Jan. 25. In responding to other users on Twitter, the mother notes that while she wanted her son to be rewarded for discovering the bug -- some tech companies offer thousands of dollars to people who report issues as an incentive -- she says that she did call and fax the company details of the exploit. After news of the bug went viral Monday Apple finally disabled Group FaceTime late Monday night. The company said in a statement provided to USA TODAY and other media outlets Monday night that it is “aware of this issue and we have identified a fix that will be released in a software update later this week.” Apple declined to elaborate further when USA TODAY asked about Thompson's attempts to contact the company. As for Meyer, he says he was "was absolutely baffled that this could be the case." "I thought it was fake at first, before I then successfully replicated the issue by calling my girlfriend. When I learned very early this morning that this was discovered by a 14 year old, who's mom then spent multiple days trying to bring this to attention at Apple, I was even more surprised (and quite angry)," he writes in a Direct Message message with USA TODAY. "Angry at the fact that she seemed to be ignored for quite a bit of time... While reporting an issue that could affect millions of people's privacy, as well as our national security," noting that government workers use iPhones. Contributing: Edward C. Baig Follow Eli Blumenthal on Twitter @eliblumenthal<doc-sep>
Group FaceTime will be returning to iPhones, iPads and Macs next week. After a bug in the software that allowed people to eavesdrop using the video calling app went viral on Monday, Apple announced on Friday that it has fixed the issue and will re-enable it for users next week. “We have fixed the Group FaceTime security bug on Apple’s servers and we will issue a software update to re-enable the feature for users next week," the company said in a statement Friday. "We thank the Thompson family for reporting the bug. We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone’s patience as we complete this process." Michele Thompson, an Arizona attorney, tried to warn the company last week about the exploit after her son Grant discovered it while playing "Fortnite" with his friends. Thompson tried several ways to bring the issue to the company's attention, including faxing a letter, tweeting at the company and submitting an official bug report often used by developers but to no avail. His mom tried to warn Apple:A 14-year-old discovered the Group FaceTime bug As news of the exploit went viral, Apple disabled the feature from its servers Monday night. It originally said that the software update would be released this week. In addition to fixing the bug, Apple also played a bit of damage control, both on how it handled this issue and how it says it will improve the process in the future. "We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix," the company's statement continued. "We are committed to improving the process by which we receive and escalate these reports, in order to get them to the right people as fast as possible. We take the security of our products extremely seriously and we are committed to continuing to earn the trust Apple customers place in us.” Allegations of broken attorney-client privilege:Attorney says it listened to testimony Apple currently is facing a lawsuit from Houston attorney over the bug, claiming that the FaceTime exploit let an unknown person eavesdrop on a private discussion with a client while New York governor Andrew Cuomo and Attorney General Letitia James announced Wednesday that they have launched an investigation into the bug. Follow Eli Blumenthal @eliblumenthal