![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/01\/FaceTime-spying-600x300.png\")
<\/p>\n<\/p>\n
UPDATE 2:<\/strong>\u00a0On Thursday, February 7, Apple\u00a0fixed the FaceTime vulnerabilities<\/a> in iOS 12.1.4 and a Supplemental Update for macOS Mojave 10.14.3.<\/p>\n On Monday, January 28, a serious flaw in FaceTime came to light that could allow a FaceTime caller to spy on a call recipient, even if the recipient ignored or declined the call. Apple has taken temporary measures to mitigate the flaw and has promised a complete fix “later this week.”\u00a0UPDATE 1:\u00a0<\/strong>Apple issued a statement<\/a> on Friday morning, formally apologizing for the FaceTime security bug and announcing that the promised client-side software update has been delayed until next week.<\/p>\n The flaw affects all devices running iOS 12.1 or later, and all devices running macOS Mojave 10.14.1 or later\u2014in other words, devices capable of participating in Group FaceTime calls. It is unclear whether Apple Watch or HomePod, which also support Group FaceTime, are affected.<\/p>\n https:\/\/twitter.com\/BmManski\/status\/1089967572307640325<\/p>\n As seen in various videos demonstrating the flaw, an attacker using an iPhone could initiate a FaceTime call with a victim, and while the call was still ringing, the attacker could swipe up, tap “Add Person” and select themself as a recipient, and FaceTime would immediately begin streaming audio from the victim’s device. No user interaction was required on the victim’s side.<\/p>\n But this attack isn’t limited to just audio; it was also possible to spy on the victim’s camera.<\/p>\n FaceTime video camera spying in action. Credit: MacRumors<\/a><\/p>\n If a victim attempted to decline the FaceTime call by pressing their iPhone’s power button, the victim’s device would instead immediately begin streaming video from their front-facing camera to the attacker. On the victim’s device, it would still appear as though the call was waiting to be answered, with no visual indicator that video was being streamed from their device. (Unlike Macs, iPhone and iPad notably lack an indicator light that shows when the camera is in use.)<\/p>\n On Monday evening, Apple took its Group FaceTime feature offline as a temporary mitigation for the problem. Meanwhile, the company promised to eliminate the spying bugs via a software update that will be released “later this week.”<\/p>\n Apple’s temporary fix is to disable Group FaceTime worldwide.<\/p>\n The issue hasn’t gone unnoticed outside of geek and social media circles.<\/p>\n New York governor Andrew Cuomo issued a “consumer alert” about the issue, saying he was “deeply concerned by this irresponsible bug that can be exploited for unscrupulous purposes,” and he urged Apple “to release the fix without delay.”<\/p>\n MORE: NY Gov. Cuomo issues \u201cconsumer alert\u201d on Apple FaceTime bug, calling for users to \u201ctemporarily disable the app until Apple issues a fix.\u201d https:\/\/t.co\/j1YZcXAO8E<\/a> pic.twitter.com\/UxCaYqpsGw<\/a><\/p>\n \u2014 ABC News (@ABC) January 29, 2019<\/a><\/p><\/blockquote>\n![\"Group](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/01\/Group-FaceTime-is-temporarily-unavailable.png\")
<\/p>\n\n