There's a major bug in FaceTime right now that lets you connect to someone and hear their audio without the person even accepting the call.
This bug is making the rounds on social media, and as 9to5Mac points out, there are major privacy concerns involved. You can force a FaceTime call with someone and hear what they're saying, perhaps even without their knowledge.
We tested the bug at MacRumors and were able to initiate a FaceTime call with each other where we could hear the person on the other end without ever having pressed the button to accept the call. To exploit the bug, all you have to do is add your own phone number to a FaceTime call you've already initiated, which apparently creates a major FaceTime issue.
These are the steps:
1. Initiate a FaceTime call with someone.
2. While the call is ringing, swipe up from the bottom of the display.
3. Tap on the "Add Person" button.
4. Add your own phone number when it asks for the number of the person to add.
Adding your own phone number to Group FaceTime a second time causes the call between both parties to connect. You can hear the person on the other end and they can hear you, even though the call wasn't accepted.
When you force a connection this way, your screen looks like a standard Group FaceTime call sans video, but on the other person's screen, it still looks like the call hasn't been accepted.
For this reason, the other person can't necessarily tell that you're listening in to their audio, which has huge privacy implications, especially because the ringing stops as soon as the bug is initiated. We were able to get this to work on various iOS devices running iOS 12.1.3 and iOS 12.2, and on a Mac running the latest version of macOS Mojave.
There appears to be no way to avoid this bug short of disabling FaceTime on iOS and macOS entirely, so it's likely Apple will implement a fix quickly. This bug is an audio only bug, so the person FaceTiming you does not get access to your video feed.
We do not recommend or condone following these above steps to invade on other peoples' privacy, and we are sharing them only so MacRumors readers can be aware of the issue to protect themselves.
Update: As The Verge points out, you can also covertly see someone's video. If you follow the steps above and the person on the other end presses the power button on their device to make the call go away, it activates their video. Once their video is activated, all sound is muted, so there is no indication on their end that their video is visible to a third-party person who has FaceTimed them.
The video above demonstrates the issue and how easy it is to execute with just a few taps in the FaceTime app.
Update 2: Apple appears to have temporarily addressed the issue by disabling Group FaceTime calls server side. On Apple's System Status page, Group FaceTime is now listed as unavailable.
