8 ms·
Putting aside the politics / personal matters here, a nerd question (this is HN after all!): Does anyone have a sense (even broadly) of the specific methods th
by nlh 8y ago
Putting aside the politics / personal matters here, a nerd question (this is HN after all!):
Does anyone have a sense (even broadly) of the specific methods that were used to intercept Bezos' texts? Did he use an iOS or Android device? Were the cell towers attacked? Was he the victim of a good 'ol zero day piece of malware? (I presume Bezos isn't the kind of guy to click on random email attachments on his phone).
Just curious what universe they were playing in.
(Speculation welcome!)
- pen2l 8y agoProbably the same spyware that was used to spy on Khashoggi's iPhone -- spyware sold to them by the NSO group of Israel: https://www.nytimes.com/2018/12/02/world/middleeast/saudi-khashoggi-spyware-israel.html https://www.nytimes.com/2018/12/02/world/middleeast/saudi-kh...
- MagicPropmaker 8y agoThere's absolutely no evidence of this, and NSO says they didn't do this. Why should we believe your stories?
- deleted 8y ago[deleted]
- Iamhisalt 8y agoHi Mosad!
- amsau 8y agoYes there is. It’s been reported by many reporters. Citizen labs did an amazing job investigating NSO hacked phones. https://www.haaretz.com/israel-news/report-israel-authorized-nso-s-sale-of-spyware-to-saudi-arabia-1.6725044 https://www.haaretz.com/israel-news/report-israel-authorized... Then an ex mossad tried to get citizen labs to say antiemetic statement. Undercover agents target cybersecurity watchdog https://www.apnews.com/9f31fa2aa72946c694555a5074fc9f42 https://www.apnews.com/9f31fa2aa72946c694555a5074fc9f42 I had to edit my comment to add these two very important links from CNN and khashoggi twitter. khashoggi funded a Saudi group (they called themselves the Bees) who were working to counterattack Saudi bots and trend manipulation. His conversation and planning with them was all intercepted by the Saudi using NSO software. The group with khashoggi were able to push their hashtag and had it trending just 12 days before his murder Khashoggi tweet with the hashtag #what_do_you_know_about_the_bees. https://twitter.com/jkhashoggi/status/1043028035455221760?s=21 https://twitter.com/jkhashoggi/status/1043028035455221760?s=... CNN: WhatsApp conversation with the bee group intercepted by Saudi using NSO https://www-m.cnn.com/2018/12/02/middleeast/jamal-khashoggi-whatsapp-messages-intl/index.html?r=https%3A%2F%2Fwww.google.com%2F&rm=1 https://www-m.cnn.com/2018/12/02/middleeast/jamal-khashoggi-... QUOTING GAVIN DE BECKER “Bezos to sign would have required that I make a public statement, composed by them and then widely disseminated, saying that my investigation had concluded they hadn’t relied upon “any form of electronic eavesdropping or hacking in their news-gathering process.” Note here that I’d never publicly said anything about electronic eavesdropping or hacking—and they wanted to be sure I couldn’t” ——- Looks like NSO doesn’t want us to know think it’s their software..
- MagicPropmaker 8y agoIt's not. This is as wacky as people on the Left who blame everything on the Koch brothers, or people on the right who blame everything on Soros or the Clintons.
- thezofran 8y ago> say antiemetic statement Don't mess with the Zofran
- krn 8y agoI have pointed this out 49 days ago: https://news.ycombinator.com/item?id=19122206 https://news.ycombinator.com/item?id=19122206
- amsau 8y agoThank you! It’s widely accepted and known in Saudi Arabia and other Arab countries that NSO is used by their dictators. Not sure why israel gov, the only democracy in that part of the world, is helping dictators by approving NSO to be sold to counties like Saudi Arabia, UAE and Mexico!! It’s just shocking to see some people not only reject that its NSO but go beyond and above their ways to defend NSO, like the commentator we are relying to.. So many comments here are again insisting it’s the brother who leaked it when this article was SPECIFICALLY written by Gavin de Becker to say it’s the Saudis and not the brother... please when you make a statement or reject an accusation cite a reputable source. Check out this psygroup proposal to blackmail people name/shame by Psy-group. It says in the proposal that these methods of blackmailing often work to silence target. https://www.newyorker.com/news/news-desk/how-a-private-israeli-intelligence-firm-spied-on-pro-palestinian-activists-in-the-us https://www.newyorker.com/news/news-desk/how-a-private-israe... Worth mentioning that the smear campaign against Bezos on twitter is identical to what proposed to trumps son in his meeting at trump tower with George Nader Here is psy group proposal https://www.nytimes.com/2018/10/08/us/politics/rick-gates-psy-group-trump.html https://www.nytimes.com/2018/10/08/us/politics/rick-gates-ps...
- barry-cotter 8y ago> Thank you! It’s widely accepted and known in Saudi Arabia and other Arab countries that NSO is used by their dictators. Not sure why israel gov, the only democracy in that part of the world, is helping dictators by approving NSO to be sold to counties like Saudi Arabia, UAE and Mexico! Dictatorial and royal Arab governments are much friendlier to Israel than any democratic government would be. They’re not willing to officially regularise relations because they know how much their populace hates Israel but they’re perfectly willing to work with Israel. Israel knows this. That’s why they’re willing to work with these governments; they’re the closest to friends and allies they’re ever going to get as neighbours.
- graeme 8y agoDoes NSO make software other than Pegasus? That software exploited a bug in ios prior to 9.3.5, which was patched in August 2016. I’m wondering if there are new exploits, or if Bezos or his girlfriend ran really old ios versions. The latter seems unlikely. https://en.m.wikipedia.org/wiki/Pegasus_(spyware) https://en.m.wikipedia.org/wiki/Pegasus_(spyware)
- leroy_masochist 8y agoPurely speculation, but from a commercial perspective it would certainly make sense to have the highest-tier version of your product available only to select, high-paying customers; hypothetically this might include zero day exploits of up-to-date software. Pure speculation.
- c0nducktr 8y agoWould payments for this be higher than the potential costs of leaving known exploits active on their devices?
- heavenlyblue 8y agoExploits are only used to access the system. You can delete them from memory afterwards.
- goatsi 8y agoThey would only need to find a new exploit to install the malware, not rewrite the malware entirely. They have given demos as recently as 2018 where they have demonstrated a 0 interaction remote iphone 0day. https://motherboard.vice.com/en_us/article/qvakb3/inside-nso-group-spyware-demo https://motherboard.vice.com/en_us/article/qvakb3/inside-nso... >The entrepreneur, who spoke to Motherboard on condition of anonymity because he was not authorized to talk about the meeting, agreed, but said that NSO would have to target his other iPhone, which he brought with him and had a foreign phone number. He gave NSO that phone number and put the phone on the desk. >After “five or seven minutes,” the contents of his phone’s screen appeared on a large display that was set up in the meeting room, all without him even clicking on a malicious link, he said. >“I see clicking on all kinds of icons: email icon, SMS icon, and other icons,” he told Motherboard. “And suddenly I saw all my messages in there and I saw all the email in there and they were capable to open any information that was on my [iPhone].”
- yellow_lead 8y agoI would assume that a malicious CLEC on SS7 could easily intercept SMS or MMS messages like these .
- ardy42 8y agoIf anyone else is curious about those acronyms, this is what I think they might mean: CLEC: https://en.wikipedia.org/wiki/Competitive_local_exchange_carrier https://en.wikipedia.org/wiki/Competitive_local_exchange_car... SS7: https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...
- whoisjuan 8y ago(Speculation) Probably this: https://motherboard.vice.com/en_us/article/qvakb3/inside-nso-group-spyware-demo https://motherboard.vice.com/en_us/article/qvakb3/inside-nso...
- lawnchair_larry 8y agoIt sounds like the investigator has no evidence that the Saudis did anything at all. But yes, most governments that do any intelligence work at all do develop and/or buy Android and IOS 0day and rootkit tools from shady private companies.
- meowface 8y agoWhy do you say they have no evidence? They claim to have a lot of evidence but decided not to disclose it here due to officials currently investigating the case. Sure, they could be lying, or the evidence could be not as strong as they suggest, but they seem confident that there is strong evidence that the Saudi government accessed Bezos' phone.
- jjeaff 8y agoThat's not what the article says. De Becker claims to have extensive evidence that the Saudi's did it.
- fogetti 8y agoDe Becker claims to have evidence and lawnchair_harry claims there is none (we haven't seen any at least). De Becker has all the reasons to bluff while lawnchair_harry has all the reasons to be skeptical. I am not sure why is he downvoted.
- deleted 8y ago[deleted]
- archgoon 8y agoWhat reason does de Becker have to falsely accuse the Saudi Government of hacking Jeff's phone? I don't see any upside for Bezos and de Becker to make themselves enemies of the Saudi Arabian government.
- nindalf 8y agoThere’s no downside. Bezos and the Saudis are already enemies because of the Washington Post’s coverage. What’s this article going to do? Make MBS feel sad?
- deleted 8y ago[deleted]
- philip1209 8y agoWould stingrays accomplish this kind of breach?
- leroy_masochist 8y agoWe don't know for sure what kind of breach compromised the data on Bezos's phone. However, public reports have tied the Saudis to groups such as NSO (Pegasus zero-day malware for iOS) and Hacking Team (numerous Android exploits). So, from what has come out, pattern would suggest that it was some kind of zero-day malware activated via link embedded in an email - this would not be a Stingray use case.
- zaroth 8y agoKeeping in mind that we have seen exactly zero evidence that Bezos's texts were ever intercepted at all. Hopefully at this point we're long past taking claims in an op-ed at face value?
- ehsankia 8y agoCould also be that her texts were leaked, right?
- peteretep 8y agoNo, sorry, I don’t agree at all. I consider Gavin de Becker to be exceptionally credible, and think any idea that “all op-eds are the same” is beyond disingenuous.
- zaroth 8y agoI don’t know anything about Gavin. Not that I particularly trust journalists but they are supposed to be neutral third parties reporting facts. I agree that something that I didn’t say would have been disingenuous, but I’m not sure why you would bring it up. I’m sure you would agree that it being an op-ed tells us primarily that this article was not written by a neutral third party. We would not be surprised if it makes little to no effort to present opposing views. As an op-ed it is free to make unsupported conjectures and should probably be approached with a higher bar of skepticism and should be expected to provide facts or evidence to back up any of its novel claims. In short, op-eds are not news, and should not be treated as such. Not that “news” is particularly deserving of the distinction these days. I said simply that we should not take op-ed claims at face value. You said you don’t agree at all. I mean, you are perfectly free to take the claims at face value if you like, but appeal to authority is hardly compelling and perhaps even a bit disingenuous itself.
- morrbo 8y agoYes, this entire article is bullshit. I'd bet 99% her phone/email/whatever were hacked from password reuse in a prior leak. Convenient this all happened when he divorced his wife (aka someone knew who she was to target her specifically) and figured they'd extort Amazon and likely short the stock. I've read the article, it really doesn't say anything. I'm so tired with these pseuso-SOC style reports detailing <some group> from the US, north Korea (lol?), Saudis, <whatever> just because someone changed a path of a binary to /home/valdimir and made a post on a Russian underground forum. Ockham's razor here, she reused passwords, got pwned, he sent her dick pics, as 80% of the people of this world do these days, and they got recovered.
- anonymous_i 8y agoI came across this. May be theres more than one way to skin a cat. https://www.nbcnews.com/politics/donald-trump/national-enquirer-paid-200-000-mistress-brother-bezos-texts-report-n984756 https://www.nbcnews.com/politics/donald-trump/national-enqui...
- int_19h 8y agoThis story is specifically referenced in the article, which then explains why there's more to it.
- rjf72 8y agoApple, Google, Microsoft, and various other major US tech companies participate in PRISM. [1] The NSA internally described PRISM as "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details. Quoting Snowden in regards to this, "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want." Note this includes live communications! So this opens a pretty big question. How? One extremely conspicuous point is that when companies initially tried to deny being involved in PRISM, they all claimed something more or less the same. 'We do not allow any government agency to have DIRECT access to our servers.': - Apple - "We do not provide any government agency with direct access to our servers" - Facebook - "We do not provide any government organization with direct access to Facebook servers" - Google - "We have not joined any program that would give the U.S. government —or any other government— direct access to our servers" And so on. This is conspicuous enough to have it effectively said that access to the NSA is facilitated through some "indirect" means. The exact technical implementation of this totally-not-a-backdoor is not as relevant as the fact that this totally-not-a-backdoor can be exploited by other actors if the means are discovered. And of course there's plain old social engineering and spy games in play. Or even plain old greed. NSA worker #235,123 gets evidence that the world's wealthiest man, arguably the single most relevant economic player in the world, is cheating on his wife with some rather extreme and embarrassing evidence of such? That's going to be worth a whole lot to many people who would like to use that information against him, and an NSA worker would be just the sort of person to know who'd be interested in it. The US got very very lucky that Snowden seems to have been patriotic and ethical, but nonetheless his actions emphasize that all the scrutiny and profiling in the world can't really predict what people will do. And as we continue to expand our surveillance state, it means the damage a single disgruntled worker can do continues to grow in proportion. [1] - https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program)
- kerng 8y agoI think the "direct access" refers to that these companies will give access when required by law. But still, there is no plugin model where the government pulls the data whenever they want. Government asks, company supplies. There is little insight however on how much is supplied.
- gcb0 8y agoMore importantly, it doesn't matter. As a fellow nerd, I can sympathize why you ask. To try to prevent for yourself (or close sphere of influence). But you will either not get a true answer, or will be unable to prevent it.
- 3xblah 8y agoWas it only his phone that was targeted? What about the phone his mistress was using?