Apple reported on Friday that the FaceTime spying bug that has been making headlines in the past days has been partially fixed, but users will have to wait until next week for a software update.
According to Apple, a server-side patch has been implemented, but the application update that re-enables the Group FaceTime feature will only be rolled out next week. The company initially promised to patch the flaw this week.
The security bug allows an attacker to spy on FaceTime users through their microphone and camera simply by calling the targeted user and adding the attacker’s own number to a group chat. While the hacker can hear and, in some cases, see the victim, on the victim’s side it appears as if the call still hasn’t been answered.
Apple suspended the Group FaceTime feature after the bug became widely known, but it may have already been too late. A lawyer from Texas has filed a lawsuit against the tech giant, claiming that the vulnerability was exploited to record a client’s private deposition.
The flaw was discovered by Grant Thompson, a 14-year-old from Arizona, who, with the help of his mother, attempted to report the issue to Apple more than 10 days before its existence became public. They claimed that their attempts to inform the company were ignored.
In its latest statement, Apple has thanked the Thompson family for reporting the bug and it has promised to improve the process for receiving and escalating these types of reports to ensure that they get to the right people faster.
“We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone’s patience as we complete this process,” Apple stated.
“We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix,” it added.
This bug has caused a lot of problems for Apple. In addition to bad PR and a lawsuit, it also triggered an investigation in New York. The New York attorney general and governor announced a probe into the company’s failure to warn customers and its relatively slow response.
Related: Apple Patches Dozens of Vulnerabilities in iOS, macOS
Related: Apple Patches Passcode Bypass, FaceTime Flaws in iOS
Related: iOS Lockscreen Bypass Abuses New Group FaceTime Feature
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Tags: 
