2

According to CNN Business the FaceTime eavesdropping bug affects iOS 12.1 with group calling, but I'm wondering if anyone was able to reproduce a variant of this bug on pre-iOS12? CNN Business seems to suggest it can be reproduced even in one-on-one calls, but I'm not sure how reliable their tech articles are.

Is anyone aware of this, or a similar eavesdropping bug, being reproduced on older iOS versions?

  • 1
    The tense is wrong. The bug hasn’t been active since 2019-01-28 in the afternoon pacific time. Also, asking for the absence of reports of vulnerabilities is hard and ends up being a yes/no situation. Hopefully votes and references help out if anyone says “yes” iOS 11 is vulnerable or can back it up if so. – bmike Feb 3 at 21:49
  • I believe the tense is correct. Consider this: eventually apple will reenable the feature once they release a bug fix, but this fix will only come out on 12.1.x, so any pre-iOS 12 devices could potentially become vulnerable again. (For the sake of not derailing the discussion, let's assume a particular device can't upgraded to 12.x for whatever reason and must remain on 11.x.) – Vladimir Feb 3 at 22:27
5

There are no public vulnerabilities for iOS 11 being affected by this specific bug or any of similar function or scope.

As far as the bug from late January on iOS 12 - Group FaceTime is disabled globally since 1/28 so no devices are vulnerable.

Before the service was suspended, only devices with Group FaceTime capabilities could be exploited or considered vulnerable.

Devices on iOS 11 were not affected and won’t be until/unless that feature is added to an update to iOS 11.

Looking back, the steps to reproduce the bug involved dialing a contact via FaceTime, and before they picked up, dialing a second contact to initiate a Group FaceTime. So, anyone can convince themselves that the issue is mitigated and also test once the service presumably gets re-enabled on patched devices.

  • Thanks, Matt. I was assuming the same, but seeing the CNN article I referenced, they mentioned it's reproducible with one-on-one calls. – Vladimir Feb 3 at 19:54
  • I'm hoping that someone can give a concrete yes or no, hopefully with references to research done by some security company or themselves. I was not able to find such information, hence reaching out on here. – Vladimir Feb 3 at 19:57
  • 1
    gotcha! Sorry I don't have more info at the moment but I'll keep my eyes peeled and add more here if found – Matt Mills Feb 3 at 20:25
  • 1
    I’ve edited this to be more conclusive. Apple’s statement to the press is very clear - it was reported, but not escalated internally to the correct groups. Within hours of the correct escalation, the bug was disabled globally until patches and fixes can be tested and rolled out. – bmike Feb 3 at 21:48
  • Thank you, @bmike! I agree, that makes sense. It's curious what would happen once apple reenables group chat after the fix goes in. What would happen if an iOS 12 device (without the bug fix) tries to initiate a group chat with an iOS 11 device after apple reenables the service? These kind of questions are left unaddressed in apple's official communication, but I hope security analytics firms are looking into them. – Vladimir Feb 3 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .