Mac and iOS security flaw could expose your Siri conversations – but there’s a fix

A worrying issue whereby those using macOS and iOS devices might have their conversations with Siri snooped on and recorded by a malicious third-party in certain circumstances has fortunately been patched out by Apple.

This was a serious flaw impacting Mac and iPhone or iPad owners, and it was discovered by app developer Guilherme Rambo, as Apple Insider (opens in new tab) reports. Rambo found that any app with Bluetooth access could exploit the security hole and eavesdrop on the user’s Siri exchanges when using AirPods or a Beats headset (with Bluetooth connections).

Rambo explains (opens in new tab): “Finding out that I could get audio from AirPods without asking for permission to use the microphone on macOS was the first step.”

The developer than performed the same tricks on the iPhone and iPad, receiving audio of the user’s conversations (which the dev first thought might be encrypted, but turned out not to be).

Crucially, this flaw could be exploited by any piece of software with Bluetooth permission granted, and it happens with no request to access the mic, or any other clue to suggest to the user that anything untoward might be going on.

Rambo let Apple know about the issue on August 26 whereupon the company started an investigation process, subsequently implementing a fix (for vulnerability CVE-2022-32946) in the freshly arrived iOS 16.1 (and latest macOS build).

Analysis: Bug squashed and bounty received

It’s good news that this problem has been fixed before it became common knowledge, naturally, but we have no idea if the exploit might actually have been leveraged by a hacker anywhere to date. Hopefully not, and at least someone on the light side of the security fence brought it to Apple’s attention to get the fix deployed.

Obviously this is a good reason to grab the latest update for iOS and macOS, and bugs like these getting resolved are precisely why you should ensure updates are applied in a timely manner.

It doesn’t necessarily pay to jump on any given update within hours of it being released – early adopters can be testing the waters for unexpected problems which are introduced, of course – but you shouldn’t leave it too long before applying security updates in particular.

Rambo received $7,000 (US) for reporting the bug to Apple, and as seen on Twitter (opens in new tab), there are some who think that’s a little on the stingy side – observing that this is the reason sometimes folks go elsewhere with this kind of finding, rather than directly to the affected company. A worrying thought to end on…