The FaceTime Bug That Let You Hear Before They Answered

Audio before consent

In January 2019, a Group FaceTime flaw allowed a caller to hear a recipient before the call had been accepted. Apple subsequently disabled the group-call feature while preparing a repair. Its iOS 12.1.4 security advisory, released February 7, identifies a logic issue and says the fix improved state management.

The boundary between ringing and connected

The security requirement is simple: an incoming call must not authorize audio transmission on behalf of the person receiving it. A feature can appear to work in its normal path while another sequence of state transitions violates that requirement.

Apple's advisory establishes the logic and state-management problem. It does not publish a complete reconstruction of its internal implementation or testing. The engineering lesson is to test consent as an invariant across call states, participant changes and interrupted transitions, rather than assuming a working group call demonstrates that all paths are safe.

A report that struggled to reach the right team

Grant Thompson, a teenager in Arizona, discovered the problem while calling friends. His family tried to alert Apple before the issue became widely public. The Associated Press reported their unsuccessful attempts over more than a week, and Apple's promise to improve its procedures.

Apple credited Thompson in its security update. It also announced a reward and a contribution toward his education. Those steps and the software repair matter, but they address different parts of the incident: the code needed a fix, and the reporting process needed to get a credible warning to people who could investigate it.

Intake is part of security

A vulnerability reporting channel should work for someone who has clear evidence but no specialist account or established relationship with the company. Reports need acknowledgment, triage and a path to escalation. Organizations can test that path just as they test a technical control.

For product teams, pair tests of expected behavior with tests of forbidden behavior. For security teams, measure the time from an outsider's first report to qualified review. A report that cannot reach an owner does not protect users simply because someone outside the company has already found the defect.