Security Experts:

Connect with us

Hi, what are you looking for?


Incident Response

Apple Partially Fixes FaceTime Spying Bug

Apple reported on Friday that the FaceTime spying bug that has been making headlines in the past days has been partially fixed, but users will have to wait until next week for a software update.

Apple reported on Friday that the FaceTime spying bug that has been making headlines in the past days has been partially fixed, but users will have to wait until next week for a software update.

According to Apple, a server-side patch has been implemented, but the application update that re-enables the Group FaceTime feature will only be rolled out next week. The company initially promised to patch the flaw this week.

The security bug allows an attacker to spy on FaceTime users through their microphone and camera simply by calling the targeted user and adding the attacker’s own number to a group chat. While the hacker can hear and, in some cases, see the victim, on the victim’s side it appears as if the call still hasn’t been answered.Apple fixes FaceTime bug

Apple suspended the Group FaceTime feature after the bug became widely known, but it may have already been too late. A lawyer from Texas has filed a lawsuit against the tech giant, claiming that the vulnerability was exploited to record a client’s private deposition.

The flaw was discovered by Grant Thompson, a 14-year-old from Arizona, who, with the help of his mother, attempted to report the issue to Apple more than 10 days before its existence became public. They claimed that their attempts to inform the company were ignored.

In its latest statement, Apple has thanked the Thompson family for reporting the bug and it has promised to improve the process for receiving and escalating these types of reports to ensure that they get to the right people faster.

“We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone’s patience as we complete this process,” Apple stated.

“We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix,” it added.

This bug has caused a lot of problems for Apple. In addition to bad PR and a lawsuit, it also triggered an investigation in New York. The New York attorney general and governor announced a probe into the company’s failure to warn customers and its relatively slow response.

Related: Apple Patches Dozens of Vulnerabilities in iOS, macOS

Related: Apple Patches Passcode Bypass, FaceTime Flaws in iOS

Related: iOS Lockscreen Bypass Abuses New Group FaceTime Feature

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.