Apple has patched one of its creepiest vulnerabilities ever-a flaw in its FaceTime messenger app that made it possible for people to eavesdrop on audio and video captured by iPhones and Macs.
The bug in Group FaceTime, a feature that allows conference-call-style chats, made it trivial for someone to eavesdrop on someone else simply by initiating a FaceTime call, swiping up and choosing “add person,” and entering their own number to add themselves as a participant in a Group FaceTime call.
While people on the receiving end would see a call was coming through, they would have no idea that the person trying to connect could already hear nearby audio and, in many cases, see video.
The in-the-wild exploits could be severe because based on Apple’s vulnerability description, they fundamentally subvert Apple’s security model, which prevents apps from accessing other apps and from interacting with the security of iOS itself.
Earlier this week, Apple security came under scrutiny again when an 18-year-old named Linus Henze posted a video discussing what he said was a weakness in macOS that needlessly exposes passwords stored in the keychain to malicious apps.