Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/28/2019
09:30 PM
50%
50%

Turn Off FaceTime in Apple iOS Now, Experts Warn

Newly found bug reportedly allows callers to spy on you - even if you don't pick up.

[This is a developing story -- more updates to come]

Security experts are warning Apple iOS users to immediately disable FaceTime on their devices after word began to spread today about a newly discovered bug that allows anyone to call you via the app and access your audio and video even if you don't answer the call.

Apple told BuzzFeed that the company was "aware of this issue and we have identified a fix that will be released in a software update later this week."

A video of how to FaceTime people and listen in or see them via their cameras spread via social media today, and the blog 9to5Mac later posted the actual steps involved:

  • "Start a FaceTime Video call with an iPhone contact.
  • Whilst the call is dialling, swipe up from the bottom of the screen and tap Add Person.Add your own phone number in the Add Person screen.
  • You will then start a group FaceTime call including yourself and the audio of the person you originally called, even if they haven’t accepted the call yet."

The best protection for now is to disable or turn off FaceTime, experts say.

Read more here and here

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jason899889
50%
50%
jason899889,
User Rank: Apprentice
4/21/2019 | 11:17:40 AM
Re: Another level of hack
Not bad not bad)
MelBrandle
50%
50%
MelBrandle,
User Rank: Apprentice
2/26/2019 | 2:46:28 AM
So.. What then?
While I'm sure that this threat is legitimate in terms of allowing some strange person to access your phone and other tech devices, I can't fathom what kind of danger having access to sound and audio could make. I mean, how could this cause a disruption? Perhaps I'm not thinking like a terrorist, but I think that there wouldn't be much impale even if someone were to commandeer those functions of my mobile device?
ThomasMaloney
50%
50%
ThomasMaloney,
User Rank: Apprentice
2/14/2019 | 1:03:12 AM
Another level of hack
This is a huge breakthrough in the realm of security hacks so far. I have just disabled my FaceTime function and even pasted a small sticker to cover the front camera of my phone. I know I am not someone who anyone would want to even hack, but that level of paranoia is just erupting as we speak.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11559
PUBLISHED: 2019-09-17
A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.
CVE-2019-15729
PUBLISHED: 2019-09-17
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.
CVE-2016-10983
PUBLISHED: 2019-09-17
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
CVE-2016-10984
PUBLISHED: 2019-09-17
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
CVE-2016-10985
PUBLISHED: 2019-09-17
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.