Mikey Campbell
Apple in a pair of security updates for iOS and OS X on Monday addressed a FaceTime vulnerability that allows attackers to surreptitiously maintain audio connectivity in a seemingly terminated FaceTime call.
According to Apple, a nefarious agent in a "privileged network position" might take advantage of the now patched vulnerability to force audio transmission from a relayed FaceTime call that, for the user, appears to have ended. It is unclear if the flaw applies to both FaceTime video and FaceTime audio calls, or is limited to one particular format.
Reported to Apple by researcher Martin Vigo, the issue was disclosed in an post to the company's security update webpage today, listed among more than 35 fixes for OS X El Capitan and over 25 patches for iOS.
Beyond announcing a resolution, Apple does not offer specifics on the flaw impacting both OS X El Capitan 10.11 and above, and iOS 9. From the brief description offered through Apple's webpage, the flaw appears to allow for man-in-the-middle type attacks that could be of concern for avid FaceTime users, especially those who make calls at public Wi-Fi hotspots.
The vulnerability is reserved with the identifier CVE-2016-4635 in the Common Vulnerabilities and Exposures database, though details have yet to be published as of this writing. To protect against hacking attempts, it is common practice for the CVE to withhold information on a particular case until the flaw has been addressed by the software manufacturer.
The FaceTime vulnerability patch was included in a series of major platform updates pushed out earlier today as iOS 9.3.3, OS X 10.11.6, tvOS 9.2.2 and watchOS 2.2.2.
Charles Martin
Christine McKee
Wesley Hilliard
Malcolm Owen
Andrew Orr
William Gallagher
Sponsored Content
2 Comments
"a FaceTime vulnerability that allows attackers to surreptitiously maintain audio connectivity in a seemingly terminated FaceTime call" ...in reference to possible governing bodies...? :)
I am somewhat lost on this. Even though the call is handed off between iOS and Mac OS X isn't it encrypted end to end? So an attacker in a privileged network position could force the audio to continue even though the attacker can't listen in -- unless the attacker was one of the parties involved in the conversation. If this is true it's a quite minor problem.
I think AI got part of it incorrect stating it appears to allow a MITM attack.