CVE-2019-6223

What Is Group FaceTime?

Group FaceTime is Apple's multi-participant video/audio calling feature, built into iOS and macOS as part of the FaceTime app. It extended FaceTime's one-to-one calling model to support adding participants mid-call — a feature whose call-setup logic turned out to have a serious privacy flaw.

Overview

CVE-2019-6223, widely known as the "FaceTime eavesdropping bug," allowed a caller to add themselves as an additional participant to a FaceTime call they initiated before the recipient answered — which caused the recipient's device to begin transmitting audio (and, depending on device state, video) even though the recipient never accepted the call. This meant an attacker could listen in on — and in some cases see — a target through their own iPhone or Mac simply by placing a Group FaceTime call and following a specific sequence of actions, with essentially no indication to the victim that anything unusual was happening beyond the phone ringing.

Technical Details

The root cause was a logic flaw in how Group FaceTime's call-setup state machine handled adding a participant to an unanswered call. Normally, a FaceTime call only opens the audio/video stream once the recipient explicitly accepts it. By initiating a call and then using the "Add Person" feature to add the caller's own number as a participant before the original recipient answered, the call-setup logic prematurely established the audio stream on the recipient's device — effectively bypassing the "answer" gate entirely. No malware, exploit code, or memory corruption was involved; it was a pure logic/state-handling bug (informally, an authorization/control-flow flaw) exploitable using only the built-in FaceTime app.

Discovery

The bug was discovered by a 14-year-old, Grant Thompson, while trying to add friends to a Group FaceTime call with his mother, Michele Thompson. The Thompson family attempted to report it to Apple in late January 2019 through normal channels but had difficulty getting a response until the bug went viral on social media, at which point Apple immediately disabled Group FaceTime server-side and rushed a client-side fix.

Exploitation Context

Because the bug required no technical skill to trigger — just a specific sequence of taps in the FaceTime app — it saw widespread demonstration and abuse once it became public knowledge on January 28, 2019, prompting Apple to take the unusual step of disabling the entire Group FaceTime feature for all users worldwide within a day, before any patch existed. This incident significantly raised public awareness of "always-listening" risks in video calling apps and led Apple to award the Thompson family a bug bounty and make a charitable donation to Grant Thompson's school, alongside broader reviews of Apple's vulnerability reporting process.

Remediation

1. Update to iOS 12.1.4 or later (or the corresponding fixed macOS update), which restored Group FaceTime with the underlying logic flaw corrected.
2. Disable FaceTime entirely on devices where video/audio calling via this app is not needed, reducing exposure to any future similar flaws.
3. Review Apple's device settings for camera/microphone access indicators (the orange/green dots introduced in later iOS versions) as a general privacy safeguard against unauthorized audio/video capture.
4. Treat unexpected incoming calls with skepticism — organizational security awareness training can include this incident as an example of call-based privacy attacks.
5. Keep devices current with Apple security updates generally, since this incident demonstrated how quickly a purely logic-based flaw (no malware required) can become a real privacy threat once discovered.