This article is more than

5 year old
Apple

How a high school student 'stumbled upon' Apple's FaceTime bug and tried to report it

January 30, 2019 at 10:34
AP iphone
AP iphone

"I stumbled upon this glitch that like the whole world knows about now," Thompson told ABC News in an interview Tuesday night.

The 14-year-old student in Tucson, Arizona, called his friend Nathan using FaceTime on Jan. 19, but he wasn't answering. So Thompson swiped up on his iPhone to add another friend, Diego, to the call, a now-disabled feature in the app that -- to Thompson's surprise -- immediately connected him to Nathan even though he still hadn't picked up.

"Once I added Diego, it forced my first friend Nathan to join [the FaceTime call]," Thompson told ABC News. "He hadn't answered yet, but it had that answering ring tone, and so I said, 'Hey, Nathan, what's up?'"

"He was like, 'Grant? You can hear me?" Thompson recalled. "He told me that he never even answered the call, yet both of us could hear each other crystal clear."


(MORE: Apple disables Group FaceTime after bug allows iPhone users to listen in before call starts)


 

PHOTO: Grant Thompson speaks to ABC News, Jan. 29, 2019. (ABC News)

The three friends spent the next half hour trying to recreate what happened on each other's iPhones -- and it worked every time.

"We were all shocked," Thompson said. "We realized this was an actual bug that forced people to answer the calls."

The teen shared the discovery with his mother, Michele Thompson, who was skeptical.

"At first she was pretty suspicious, she didn't really believe that I found a glitch," he said. "I used my phone, her phone and my sister's phone to make my mom's phone force answer, without ever clicking 'Accept.' And once that happened, she believed that I could really do this."


(MORE: Apple announces $1 billion campus in Texas, part of plan to create 20,000 US jobs by 2023)


 

PHOTO: Michele Thompson speaks to ABC News, Jan. 29, 2019. (ABC News)

Over the next week, the Thompsons tried to notify Apple of the bug via emails, telephone calls and social media -- but largely to no avail.

Michele Thompson said she even tried getting the tech company's attention through its bug bounty program, which offers monetary rewards for finding and reporting security flaws. The program, launched in 2016, pays up to $200,000 for detecting vulnerabilities in certain Apple software.

"I knew [Apple] had a bounty reward program, they had a security manual that was 80 pages that I looked at," Michelle Thompson told ABC News in an interview Tuesday night. "I didn't know if this qualified, and by no means am I a tech expert."

But the program wasn't user-friendly to non-developers like herself trying to flag a major flaw, she said.

"I do wish they had a better process to let a citizen report a bug," she added, "because it was a pretty complicated process."

Apple did not immediately respond to ABC news' request for comment Wednesday about the Thompsons' bug report.


PHOTO: Craig Federighi, Apple's senior vice president of Software Engineering, speaks about group FaceTime during an announcement of new products at the Apple Worldwide Developers Conference, June 4, 2018, in San Jose, Calif. (Marcio Jose Sanchez/AP)

On Monday, media outlets caught word of the glitch and the story went viral. That evening, Apple temporarily disabled its Group FaceTime app.

"We're aware of this issue and we have identified a fix that will be released in a software update later this week," an Apple spokesperson said in a statement to ABC News on Monday night.

Michele Thompson said she received an email from Apple's security team on Tuesday afternoon.

"It said, 'Dear Michele, we've received your bug report. We like to give credit to those who find bugs on our website. We'd like to know what name you'd like us to use.' And that's all it said," she told ABC News. "I think we've done our part, I reached out to them. I would love to talk with them further."

ABC News' Thomas Austen contributed to this report.

Keywords
You did not use the site, Click here to remain logged. Timeout: 60 second