19 ms·

Jeff Bezos's phone 'hacked by Saudi crown prince'

834 points by mnem 7y ago

clubm8 7y ago
I wonder how often less high profile folks get hit with stuff like this? On one hand, zero days are rare and expensive. OTOH someone who isn't the CEO of a major company might not notice the malware, or if they do, not know they should forward it to an organization like Citizen Lab.
- OrgNet 7y ago
  > zero days are rare really?
  - bob33212 7y ago
    Zero days are plentiful. But there are only a handful that you could buy today which could potentially give you access to a CEO's phone. The only other option is to build your own team to find a zero day for you, which is not cheap or quick.
  - clubm8 7y ago
    A better saying is that zero days are... fragile? You use zero, someone notice, it gets fixed. And yes, they are rare compared to the vast # of known vulns. Ideally if given the choice, you'd utilize a known vuln against outdated software rather than risk burning your zero day.
- sn41 7y ago
  If you aren't a high profile target, you may not be worthy of being targeted specifically. Of course, as in the Ashley Madison and Equifax cases, you might be compromised along with thousands of others. Zero days are expensive for individuals and small companies, but what happens when state actors are involved?
  - clubm8 7y ago
    >If you aren't a high profile target, you may not be worthy of being targeted specifically. That's what I am questioning. There are many sysadmins, key executives in tech companies, or open source contributors who may not be "high profile" in the traditional sense but be juicy targets. Arguably there are more useful targets to hack than a CEO who's assuming their every move is being studied and always keeps truly sensitive conversations verbal.
    - alexis_fr 7y ago
      Some CEOs have “cube” as their password and got their company hacked. Please don’t say who, but it happens.
      - clubm8 7y ago
        I can't say who since I don't know but my interest is piqued. It worries me no one would brief a CEO (who crosses borders presumably) to at least use a passphrase.
saberience 7y ago
Let's assume this is how Bezos's phone was hacked for a second, does anyone think Trump would do anything about it? Sanction Saudia Arabia? Trump didn't lift a finger after the Jamal Khashoggi killing and his son-in-law is deep in various business dealings with MBS and his goons. Hell, Trump is probably happy the Saudis are hacking the phone of his perceived "enemy".
- Mountain_Skies 7y ago
  Doubt he or any other president would do anything about it. When was the last time any administration gave the Saudi government more than a weak reprimand for their antics? Some of our "allies" can do no wrong.
- jessaustin 7y ago
  Is this something a President or anyone in government employ should care about? A private citizen using a commercial app on a private phone granted that app some permissions he later regretted. Why should USA taxpayers care about that?
  - Apocryphon 7y ago
    Will Bezos's divorce affect the Amazon empire in any way? Wondering if that personal move will somehow have corporate, technological infrastructural, and thus national security repercussions.
  - victords 7y ago
    By that logic, nobody should care about the Khashoggi killing as well.
    - jessaustin 7y ago
      I don't agree that hacking an app and murder are the same. The state obviously has an interest in preventing murder.
      - 7y ago
danso 7y ago
> This analysis found it “highly probable” that the intrusion into the phone was triggered by an infected video file sent from the account of the Saudi heir to Bezos, the owner of the Washington Post. Any more information on how this type of attack works? Is it a vulnerability in Whatsapp, or was whatsapp just the delivery platform?
- nopriorarrests 7y ago
  first paragraph: The Amazon billionaire Jeff Bezos had his mobile phone “hacked” in 2018 after receiving a WhatsApp message that had apparently been sent from the personal account of the crown prince of Saudi Arabia, sources have told the Guardian. So, not snapchat, but whatsapp. And it's quite surprising for me. So, Saudis have 0 days which work on whatsapp on iphone (I suppose Bezos uses iphone)? I mean, FB and AAPL, which both can afford tens of billions in security research, were pwned by saudi 0day? hmmm...
  - shyn3 7y ago
    My guess is this gave them the ability to access anything WhatsApp could access with a code bug in the application and so maybe a Facebook issue more than an Apple issue.
    - Nextgrid 7y ago
      If WhatsApp was given photo library access (which isn't unlikely considering you need it to send previously taken photos) then the exploit could access all his photos without a vulnerability on Apple's part.
      - Marsymars 7y ago
        > which isn't unlikely considering you need it to send previously taken photos To be clear for anyone else reading, photo library access is required to browse the photo library from within WhatsApp, it's not required to share arbitrary photos to WhatsApp from the photo app via the OS's built-in share feature.
henryw 7y ago
I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931 https://www.facebook.com/security/advisories/cve-2019-11931
- danso 7y ago
  At the time, FB said it didn't believe the bug had been exploited: In this instance there is no reason to believe users were impacted. [0] The alleged hack of Bezos happened in May 2018, about 18 months after the Nov 2019 bug fix. I wonder if FB's statement was just boilerplate PR or if they really did substantial forensics to have "no reason to believe users were impacted". [0] https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-now-mp4-video-bug-exposes-your-messages/ https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-...
  - penagwin 7y ago
    Anecdotal, but a lot of times phrases similar to that are used because the real answer is "We don't have any way of knowing if users were actually impacted" and it's obviously far better for PR to phrase it that way.
    - BelleOfTheBall 7y ago
      It does sound better but here's the thing: this is Jeff Bezos. He's one of the most high-profile people on the planet. If his phone was hacked through WhatsApp, he clearly filed a complaint and told them what had happened. They just didn't manage to patch it for over a year and then stated they 'had no way of knowing' even though this clearly proves it happened.
  - moralestapia 7y ago
    s/after/before/
  - khc 7y ago
    do you mean 18 months before?
  - 7y ago
Apocryphon 7y ago
So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?
- IfOnlyYouKnew 7y ago
  I guess Khashoggi must have really annoyed MBS. This has now cost the Saudis at least ten times as much goodwill as all anti-Saudi editorials in the Post and everywhere else together. That, or it was a favour to MBS American friends. The other people involved (David Pecker et al) and MBS do share a few friends in the White House, who also seem obsessed with the Washington Post and Bezos himself.
  - jonknee 7y ago
    Well, MBS certainly has his own reasons to not like the owner of the Washington Post.
  - lawnchair_larry 7y ago
    Khashoggi wrote for the Washington Post, so it wouldn’t be a favor for Trump. It would be consistent with his own motivations for murdering Khashoggi.
    - tw04 7y ago
      Great theory, except for the fact David Pecker was directly involved and more or less admitted it was a favor for Trump which he had been doing for decades.
      - davidw 7y ago
        David Pecker was, IIRC, the guy who also directed the 'catch and kill' with Stormy Daniels just before the 2016 election. https://www.thedailybeast.com/how-trumps-fixers-silenced-stormy-daniels-just-days-before-the-2016-election https://www.thedailybeast.com/how-trumps-fixers-silenced-sto...
lawnchair_larry 7y ago
This sounded plausible until I read the first sentence. Why would MBS be the one executing the attack, and using his personal account to do it?
- notadoc 7y ago
  Presumably because the attacker(s) assumption was that Bezos would open a message coming directly from someone he trusted and had direct communication with, in this case being MBS? That brings a lot more questions though; who actually sent the message? Was it a man-in-the-middle situation? Was MBS's WhatsApp account compromised? Did someone else use MBS physical phone to do this? Was it a third party? Interesting and strange story all around.
- caf 7y ago
  It seems unlikely it would be MBS himself pressing the button, but a reason why Saudi intelligence might use his personal account is because Bezos would be far more likely to open a video sent from MBS than from some random account.
  - lawnchair_larry 7y ago
    But the obvious thing to do would be to pick anybody else that Jeff would also talk to and send it from their account instead. Only the most incompetent intelligence agency imaginable would do an op and intentionally attribute it to their own head of state.
    - ceejayoz 7y ago
      Is there reason to believe Bezos regularly corresponds on WhatsApp with other Saudis?
      - lawnchair_larry 7y ago
        Why would it have to come from another Saudi?
goldcd 7y ago
My gut response to this is "bullshit" Not based on the Saudi's not buying zero-day-exploits, but on them using them from the crown prince's account directly against Jeff.
- ceejayoz 7y ago
  Bezos is presumably savvy enough not to open a WhatsApp message from some random person, and given the Khashoggi situation (employed by the WaPo, which Bezos owns) it's not surprising he'd be on the Saudi's target list to compromise.
- zelon88 7y ago
  I can see it. The Saudi's control over their own media means that their population will likely never find out, and the ones that do will support the government anyway. Outside of that the rest of the world is in the perfect place to accept whatever lies the Saudi's shrug this off with. Authoritarianism is on a rise and truth is in decline. Trust in media is probably the worst its ever been. Your post proves it. There would be no impact on their foreign policy efforts even if it were true.
- Zooper 7y ago
  Why? Bezos isn't going to open any other videos from someone else. The US executive branch won't do a thing, in case the Saudis decide to stop buying US treasury bonds in exchange for oil. Then they might stop buying weapons, which funds the inflated military industry, and then they might buy weapons from someone else and begin keeping larger reserves of their currency. This exchange is worth more to those in power than Bezos' love life.
- OrgNet 7y ago
  The Russians used a Saudi account....
nif2ee 7y ago
>Jeff Bezos chatting with Mohammed bin Salman on WhatsApp Not sure whether this is a yet another fake story sponsored by the Qataris, who infiltrated the liberal western media with their isalmist and ultra left minions all over in the name of diversity, since their rift with the Saudis in mid 2017 or the richest man on Earth is actually retarded enough to chat with a head of state like Saudi Arabia on fucking WhatsApp
amelius 7y ago
What brand was the phone and OS?
- chrisbrandow 7y ago
  It is very odd. Every article I've read recently or when it occurred seem to leave this detail out.
- eatmyshorts 7y ago
  It doesn't matter. The Whatsapp exploit affected both IOS and Android: https://appleinsider.com/articles/19/05/13/whatsapp-vulnerability-left-ios-open-to-spyware-attack https://appleinsider.com/articles/19/05/13/whatsapp-vulnerab...
  - amelius 7y ago
    That's interesting. How would that work? Under Android, all apps effectively run inside a Java sandbox, right? So how would the attackers be able to install spyware through Whatsapp?
    - peteretep 7y ago
      I may well be proven wrong by further revelations, but: > Large amounts of data were exfiltrated from Bezos’s phone within hours I could see a cross-platform WhatsApp message that leaked WhatsApp data?
    - verroq 7y ago
      There are more exploit chains for Android and iOS that can be used once RCE is achieved.
    - all_blue_chucks 7y ago
      They only had to spy on whatsapp, so they could do it all in the same sandbox.
    - angry_octet 7y ago
      Since WhatsApp whines incessantly unless you give it various permissions it might have already had the ability to access photos etc. As well as sending whatever is in its directory or using a local priv escalation.
kshacker 7y ago
Whatsapp allows desktop clients. I use it too. It is technically possible for someone to hijack this desktop client and do this without MBS's involvement, as long as MBS authorized that desktop. I think you need proximity, but you can have a computer near the prince, and that computer being remotely controlled by someone sitting far away. Not saying this happened ... but there are many ways to blame it on prince and many ways to defend him (and blame a subordinate).
- jessriedel 7y ago
  I thought the Whatsapp desktop client was just a glorified remote control for the phone, and could not actually function as a standalone client by itself?
  - rapsey 7y ago
    Going through a remote control or to your phone directly makes no difference. So the remote control is an additional point of failure.
  - kshacker 7y ago
    It is a remote control, but a case could be made that even though the prince had the phone with him, someone did it from his computer [ Of course assuming he was not looking at his phone at that time. ] I am not on prince's side, just saying ...
    - Totoradio 7y ago
      If you're thinking of a private actor, I think that once you have access to MBS phone, you run to Doha before attacking Bezos. Qatar would pay a ton of money for that access. If you're thinking of a state actor except Saudi Arabia, I think there would be much easier and more discreet vectors to Jeff Bezos Whatsapp than MBS phone (literally almost any of Bezos other contacts would be less risky).
tasssko 7y ago
Is it that easy to be hacked with WhatsApp?
- WilTimSon 7y ago
  Well, here's a list of known WhatsApp hacks that were revealed in 2019: Call hack [0]: https://www.wired.com/story/whatsapp-hack-phone-call-voip-buffer-overflow/ https://www.wired.com/story/whatsapp-hack-phone-call-voip-bu... Video hack [1]: https://thehackernews.com/2019/11/whatsapp-hacking-vulnerability.html https://thehackernews.com/2019/11/whatsapp-hacking-vulnerabi... GIF hack [2]: https://thehackernews.com/2019/10/whatsapp-rce-vulnerability.html https://thehackernews.com/2019/10/whatsapp-rce-vulnerability... That call hack was famously used by NSO, hitting thousands of people [3]: https://thehackernews.com/2019/10/whatsapp-nso-group-malware.html https://thehackernews.com/2019/10/whatsapp-nso-group-malware... Hack that let anyone crash the apps for all members of a group chat [4]: https://thehackernews.com/2019/12/whatsapp-group-crash.html https://thehackernews.com/2019/12/whatsapp-group-crash.html I think I'm actually missing one more. These are just the widely known ones, mind you, and just for 2019.
  - TwoBit 7y ago
    "The flaw (CVE-2019-3568) successfully allowed attackers to silently install the spyware app on targeted phones by merely placing a WhatsApp video call with specially crafted requests, even when the call was not answered." Geez that seems pretty incompetent.
  - novaRom 7y ago
    These are not hacks, it's called "Backdoor". There are probably tons more hidden backdoors left, we can only speculate. WhatsApp is a private non-open source project.
rmsaksida 7y ago
Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109 https://t.me/s/durov/109
- eljimmy 7y ago
  That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?
  - resters 7y ago
    Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data center breach and likely many other cases. At WhatsApp/Google scale the attack is extremely cost effective.
    - ghostpepper 7y ago
      Can you elaborate on the google data center breach? Are you saying it was orchestrated by google?
      - resters 7y ago
        Not orchestrated, but happily tolerated. All Google needs is to be able to plausibly deny complicity, but the other practices of Google (such as not offering warrant canaries on all Google accounts) indicate that Google is eager to cooperate and please governments, so it would have been easy to leave a few doors unlocked, hire a plant (with solid itsec skills), etc.
        ghostpepper 7y ago
hloiuweri 7y ago
One thing which this article doesn't address at all, is what is the beef between MBS and Bezos? Why would the Saudi prince leak this data? How did Amazon upset him?
- dwd 7y ago
  Join the dots... Who had a beef with Bezos and was friendly with MBS?
  - executive 7y ago
    Tim Cook, for one.
    - dwd 7y ago
      Ricky Gervais better watch his back then.
- chongli 7y ago
  I think MBS has a beef with the Washington Post (also owned by Bezos), not Amazon. It also fits with the murder of Khashoggi, a WaPo journalist.
- chance_state 7y ago
  Perhaps as a favor to Trump who constantly whines about WaPo and Bezos?
  - dwd 7y ago
    I think at the very least they would have bet on the WH looking the other way while they conducted an attack on a prominent US citizen. At worst it could be another "favour" attached to military procurement.
  - not_kurt_godel 7y ago
    Very curious about the downvotes on this one. Trump has clearly demonstrated time and again that he is not above egregiously and obviously breaking the law to further his personal interests. He has been willing to overlook cold-blooded murder by MBS specifically. So this speculation is very comfortably (or uncomfortably, as it were) within the realm of reasonable speculation, is it not?
mirimir 7y ago
OK, so I'm just a random anonymous coward. And arguably obsessed with my hobby. But I'm puzzled that Bezos would be corresponding with MBS on the same device that he uses for potentially embarrassing personal stuff. Isn't that just a totally obvious OPSEC fail? Edit: But that's what he did, isn't it? And how could that be considered safe?
- joe_the_user 7y ago
  I think this a good question. The problem is that even the head of a ginormous company with a strong connection to computer security generally (through AWS) is going to take actions based on convenience rather than OPSEC discipline. I think it's natural for any given human to chat with all one's friend on the same level, with the same device and so-forth. A given individual can train themselves to have hard walls in their personal dealings but I'd suspect that individual would be a mid-level specialist, not the owner/manager/CEO who gets their position by their ability to manage and connect with people, not through technical expertise.
  - mirimir 7y ago
    I guess. But even before the Khashoggi assassination, MBS was arguably an obvious threat. I can't imagine considering him a "friend". I mean, I'd be gobsmacked if he mixed personal and business on the same devices. That could be disastrous, not just embarrassing. So a third device category doesn't seem unworkable. Edit: Also, wouldn't someone like Bezos have security advisers? And how could they have failed to warn him? One could make a similar argument about MBS, of course.
    - joe_the_user 7y ago
      This reminds me of the way that Barrack Obama tried to keep his personal cellphone once he became president. Having a personal relationship with the wealthy and powerful is a unique thing since these are the ultimate decision makers. I would guess that Bezos or anyone like him chats frequently with very powerful people and that this is factor in him maintaining his own power and influence. And mobile devices would seem to magnify that ability of the very topmost people to connect directly with each other - ie, this was all done by secretaries and through protocol but that's slower and can let one big boss instantly sway another. Of MBS doing his own spying and hacking is another way topmost people are becoming "do it yourself-ers".
mzs 7y ago
Pegasus as expected according to another person claiming to have been hacked, also a report expected out in the coming months https://twitter.com/iyad_elbaghdadi/status/1219741773301452800 https://twitter.com/iyad_elbaghdadi/status/12197417733014528...
derefr 7y ago
So, anyone want to hazard a guess on why the prince would want the optics of being seen to have been responsible for the hack (as opposed to trying to cover that up by, say, not using his very own account)?
- p0rkbelly 7y ago
  Simple. To flex and show that he is untouchable and that nobody ever holds him accountable.
- angry_octet 7y ago
  Firstly, he's an idiot. His staff obviously don't brief him on the likely consequences of actions, they just go do it. Because he's a brutal dictator who has disloyal people executed. Secondly, Saudi's don't have their own advanced cyber capabilities (unlike Iran, UAE, Israel, etc), they rely on buying help. And single use, no interaction, 0day RCEs for recent phones (and we can assume latest iOS or Pixel) are not that available. So they used what they could get their hands on. It beats me that they couldn't steal the phone of someone else in Bezos's WhatsApp contacts and impersonate them. Maybe Bezos wouldn't have opened the attachment. But overall, I think they are just dumb. There remains a small possibility that someone hacked the phone of MbS (I mean, everyone has thoughts about doing that) and then pivoted to attacking people in his contacts. But the whole NSO group involvement makes me think it wasn't that.
deleted 7y ago
[deleted]
angry_octet 7y ago
Talk about lousy deniability. I wonder how many Alexas there are in Saudi.
ineedasername 7y ago
Is there any detail on the nature of the exploit? It seems to have been triggered by receipt of a video in WhatsApp. Was the flaw in WhatsApp itself? Or would the exploit have occurred regardless of which messaging/transfer mechanism was used to deliver the video? Has this been fixed? Is it even a documented exploit or is it simply known that it had something to do with the WhatsApp video, but not the actual methodology?
schalab 7y ago
Explanation 1: Lauren Sanchez(bezos' new girfiend) along with her brother Michael(who is also her agent), leaked the story to force Bezos to divorce his wife and get along with her. Explanation 2: The crown prince of Saudi Arabia personally sent a trojan file, downloaded all the data, distributed it through a gossip rag he happens to be friends with, for some kind of revenge/message I get why Bezos has to go with explanation 2 because explanation 1 would indicate the girl he wants to have sex with or her brother is manipulative. I dont see why the rest of us have to go along with this. Even this anonymous source says he has "high confidence" not anywhere near certainty.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- streb-lo 7y ago
  Is explanation 2 supposed to be outlandish? A country like Saudia Arabia is going to use every tactic possible to combat their asymmetry with the West. It's not the crown prince personally having someone cook up a trojan for him -- it's their national apparatus deciding that free potential leverage over influential Americans is a worthwhile pursuit.
- AshwinDurairaj 7y ago
  The motives for explanation 2 are currently not known. MBS might have had numerous reasons, ranging from WaPo or AWS. But regardless, there could have been many reasons to target Bezos. The part that doesn't sit right with me is the leaks, since it would have burned the 0day and connected Saudis to hacking phones which I doubt they would have wanted.
- tiles 7y ago
  If you take into account that MBS murdered an employee of Bezos, explanation #2 sounds plausible.
neycoda 7y ago
Yay
dizzru600 7y ago
Oohhhh noo taviel
WaPo16Hits1Day 7y ago
How am I supposed to trust WaPo that took out 16 hit pieces in a single day against Sanders? Perhaps they're trying to malign Salman like they do to anyone not establishment?
tasubotadas 7y ago
This gives me tremendous respect for Jeff. Most likely his marriage fell apart because of this costing him personally ~25B. But that means that he didn't give in to whatever Mr Prince wanted.
- deleted 7y ago
  [deleted]
- aedron 7y ago
  Yes, it seems he was pretty hardcore about it. "Go ahead, publish it." Since J. Edgar Hoover, it is has been an open secret that blackmail drives the upper echelon of politics and media. The Bill Clinton thing is another example, pretty sure he put his foot down and said fuck it, hence Lewinsky turning up with a tainted dress from 8 months ago, and down goes the U.S. president. How many just acquiesce and play along quietly? More people should have guts like Bezos (probably did). Though at some point, I'm sure the shadow people will just fall back on good old violence, like the Epstein case.
busymom0 7y ago
I am not buying this story. With all the other possible options, why would someone like MBS do it from his very own phone which this article claims? It sounds more like someone is trying to frame MBS.
krn 7y ago
I pointed this out 11 months ago: https://news.ycombinator.com/item?id=19122206 https://news.ycombinator.com/item?id=19122206
- deleted 7y ago
  [deleted]
- nsajko 7y ago
  Some informative links to make you scared about democracy, or just your safety: https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware) https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-new-abuse-cases/ https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-n... https://citizenlab.ca/2018/06/government-spyware-surveillance-mexico/ https://citizenlab.ca/2018/06/government-spyware-surveillanc... https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware/ https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware... https://citizenlab.ca/ https://citizenlab.ca/
  - dmamills 7y ago
    Why are these down voted? I'd say these Citizen Lab reports are HIGHLY relevant to this discussion topic.
ptah 7y ago
as per usual there will be zero consequences
conston 7y ago
This is why for the past 7 years I have rejected any files sent to me, and insist on receiving cloud links such as google, dropbox etc.
turkthrower123 7y ago
Considering the Saudi Arabian government slaughtered 3,000 people on 9/11, I don't understand why America does business with them.
LatteLazy 7y ago
Don't deal with the Saudis. History will look back on you the same way it looks back on people shaking hands with Hitler. I'm not kidding.
- lgl 7y ago
  The US is the world's largest weapons exporter and Saudi Arabia is the world's largest weapon importer. I'm not sure even a Hitler level calamity would make the US stop dealing with them. They're holding their hands and complementing their "leadership skills" ffs...
  - LatteLazy 7y ago
    I think the oil will run out (or we'll transition to other energy sources), then Saudi will just wither and the special relationship will disappear. But yeah, it won't end because of morality.
LatteLazy 7y ago
The wider question here is how to handle Saudi Arabian trades in Western markets. Every and any deal undertaken by a state actor (MBS, any of the 1000s of princes the place is littered with, the sovereign wealth fund or the state or semi state companies) could well be the result of insider trading... And thats just the public markets. Imagine the advantage you would have in startup investing if you could covertly read all the internal discussions, the founders texts and emails, remotely access their meetings with lawyers, accountants and other VCs. No wonder SA is suddenly interested in Silicon Valley
patja 7y ago
Last time I stayed at an AirBnb in Prague, the owners preferred method of communication was WhatsApp. When I went to install it I was confronted with no other choice than allowing it to import all my contacts, even though there was only one person I wanted to communicate with. I was aware of these vulnerabilities and generally am protective of handing out PII, especially information others have entrusted to me. So I didn't give it access to hundreds of business and personal contacts spanning decades of work and life. How do others deal with this who perhaps don't have the choice to just say "I'm going to text you instead for the 4 days we are going to have a need to communicate"? Do you keep a full set of contact data outside your phone's contacts for information you don't want shared? Private and public contacts?
- st1ck 7y ago
  Somewhat recent Android versions have work profile which at the very least gives you a sandbox for all apps you want to be isolated from the main profile. Unfortunately, all those work profile apps still share data between themselves. Maybe it was improved lately.
nlh 7y ago
Apparently I’m the only person on earth who wants to know what kind of phone Bezos was using, which OS version, etc. It seems like this detail is conveniently being left out of every story. Anyone have any additional details? I understand that it was a WhatsApp vulnerability (Pegasus?) but I’d still like to know more about the device.
- mizaru 7y ago
  iPhone X https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacked-jeff-bezos-phone-technical-report https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacke...
- stiGGG 7y ago
  According to vice [1] he was using an iPhone X. 1: https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacked-jeff-bezos-phone-technical-report?utm_campaign=sharebutton https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacke...
- mzs 7y ago
  Office of the High Commissioner for Human Rights report confirms it was iOS (page 2) https://www.ohchr.org/Documents/Issues/Expression/SRsSumexFreedexAnnexes.pdf https://www.ohchr.org/Documents/Issues/Expression/SRsSumexFr... more: https://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=25488 https://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?N...
- rbolla 7y ago
  iphone X A1901. Hacked by Al Qahtani and co. soon after the video was sent, the egress on the iphone has increased astonishingly to 29000 %.

834 points by mnem 7y ago

I wonder how often less high profile folks get hit with stuff like this? On one hand, zero days are rare and expensive. OTOH someone who isn't the CEO of a major company might not notice the malware, or if they do, not know they should forward it to an organization like Citizen Lab.

OrgNet 7y ago
> zero days are rare really?
- bob33212 7y ago
  Zero days are plentiful. But there are only a handful that you could buy today which could potentially give you access to a CEO's phone. The only other option is to build your own team to find a zero day for you, which is not cheap or quick.
- clubm8 7y ago
  A better saying is that zero days are... fragile? You use zero, someone notice, it gets fixed. And yes, they are rare compared to the vast # of known vulns. Ideally if given the choice, you'd utilize a known vuln against outdated software rather than risk burning your zero day.
sn41 7y ago
If you aren't a high profile target, you may not be worthy of being targeted specifically. Of course, as in the Ashley Madison and Equifax cases, you might be compromised along with thousands of others. Zero days are expensive for individuals and small companies, but what happens when state actors are involved?
- clubm8 7y ago
  >If you aren't a high profile target, you may not be worthy of being targeted specifically. That's what I am questioning. There are many sysadmins, key executives in tech companies, or open source contributors who may not be "high profile" in the traditional sense but be juicy targets. Arguably there are more useful targets to hack than a CEO who's assuming their every move is being studied and always keeps truly sensitive conversations verbal.
  - alexis_fr 7y ago
    Some CEOs have “cube” as their password and got their company hacked. Please don’t say who, but it happens.
    - clubm8 7y ago
      I can't say who since I don't know but my interest is piqued. It worries me no one would brief a CEO (who crosses borders presumably) to at least use a passphrase.

saberience 7y ago

Let's assume this is how Bezos's phone was hacked for a second, does anyone think Trump would do anything about it? Sanction Saudia Arabia? Trump didn't lift a finger after the Jamal Khashoggi killing and his son-in-law is deep in various business dealings with MBS and his goons. Hell, Trump is probably happy the Saudis are hacking the phone of his perceived "enemy".

Mountain_Skies 7y ago
Doubt he or any other president would do anything about it. When was the last time any administration gave the Saudi government more than a weak reprimand for their antics? Some of our "allies" can do no wrong.
jessaustin 7y ago
Is this something a President or anyone in government employ should care about? A private citizen using a commercial app on a private phone granted that app some permissions he later regretted. Why should USA taxpayers care about that?
- Apocryphon 7y ago
  Will Bezos's divorce affect the Amazon empire in any way? Wondering if that personal move will somehow have corporate, technological infrastructural, and thus national security repercussions.
- victords 7y ago
  By that logic, nobody should care about the Khashoggi killing as well.
  - jessaustin 7y ago
    I don't agree that hacking an app and murder are the same. The state obviously has an interest in preventing murder.
    - 7y ago

danso 7y ago

> This analysis found it “highly probable” that the intrusion into the phone was triggered by an infected video file sent from the account of the Saudi heir to Bezos, the owner of the Washington Post. Any more information on how this type of attack works? Is it a vulnerability in Whatsapp, or was whatsapp just the delivery platform?

nopriorarrests 7y ago
first paragraph: The Amazon billionaire Jeff Bezos had his mobile phone “hacked” in 2018 after receiving a WhatsApp message that had apparently been sent from the personal account of the crown prince of Saudi Arabia, sources have told the Guardian. So, not snapchat, but whatsapp. And it's quite surprising for me. So, Saudis have 0 days which work on whatsapp on iphone (I suppose Bezos uses iphone)? I mean, FB and AAPL, which both can afford tens of billions in security research, were pwned by saudi 0day? hmmm...
- shyn3 7y ago
  My guess is this gave them the ability to access anything WhatsApp could access with a code bug in the application and so maybe a Facebook issue more than an Apple issue.
  - Nextgrid 7y ago
    If WhatsApp was given photo library access (which isn't unlikely considering you need it to send previously taken photos) then the exploit could access all his photos without a vulnerability on Apple's part.
    - Marsymars 7y ago
      > which isn't unlikely considering you need it to send previously taken photos To be clear for anyone else reading, photo library access is required to browse the photo library from within WhatsApp, it's not required to share arbitrary photos to WhatsApp from the photo app via the OS's built-in share feature.

henryw 7y ago

I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931 https://www.facebook.com/security/advisories/cve-2019-11931

danso 7y ago
At the time, FB said it didn't believe the bug had been exploited: In this instance there is no reason to believe users were impacted. [0] The alleged hack of Bezos happened in May 2018, about 18 months after the Nov 2019 bug fix. I wonder if FB's statement was just boilerplate PR or if they really did substantial forensics to have "no reason to believe users were impacted". [0] https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-now-mp4-video-bug-exposes-your-messages/ https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-...
- penagwin 7y ago
  Anecdotal, but a lot of times phrases similar to that are used because the real answer is "We don't have any way of knowing if users were actually impacted" and it's obviously far better for PR to phrase it that way.
  - BelleOfTheBall 7y ago
    It does sound better but here's the thing: this is Jeff Bezos. He's one of the most high-profile people on the planet. If his phone was hacked through WhatsApp, he clearly filed a complaint and told them what had happened. They just didn't manage to patch it for over a year and then stated they 'had no way of knowing' even though this clearly proves it happened.
- moralestapia 7y ago
  s/after/before/
- khc 7y ago
  do you mean 18 months before?
- 7y ago

Apocryphon 7y ago

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

IfOnlyYouKnew 7y ago
I guess Khashoggi must have really annoyed MBS. This has now cost the Saudis at least ten times as much goodwill as all anti-Saudi editorials in the Post and everywhere else together. That, or it was a favour to MBS American friends. The other people involved (David Pecker et al) and MBS do share a few friends in the White House, who also seem obsessed with the Washington Post and Bezos himself.
- jonknee 7y ago
  Well, MBS certainly has his own reasons to not like the owner of the Washington Post.
- lawnchair_larry 7y ago
  Khashoggi wrote for the Washington Post, so it wouldn’t be a favor for Trump. It would be consistent with his own motivations for murdering Khashoggi.
  - tw04 7y ago
    Great theory, except for the fact David Pecker was directly involved and more or less admitted it was a favor for Trump which he had been doing for decades.
    - davidw 7y ago
      David Pecker was, IIRC, the guy who also directed the 'catch and kill' with Stormy Daniels just before the 2016 election. https://www.thedailybeast.com/how-trumps-fixers-silenced-stormy-daniels-just-days-before-the-2016-election https://www.thedailybeast.com/how-trumps-fixers-silenced-sto...

lawnchair_larry 7y ago

This sounded plausible until I read the first sentence. Why would MBS be the one executing the attack, and using his personal account to do it?

notadoc 7y ago
Presumably because the attacker(s) assumption was that Bezos would open a message coming directly from someone he trusted and had direct communication with, in this case being MBS? That brings a lot more questions though; who actually sent the message? Was it a man-in-the-middle situation? Was MBS's WhatsApp account compromised? Did someone else use MBS physical phone to do this? Was it a third party? Interesting and strange story all around.
caf 7y ago
It seems unlikely it would be MBS himself pressing the button, but a reason why Saudi intelligence might use his personal account is because Bezos would be far more likely to open a video sent from MBS than from some random account.
- lawnchair_larry 7y ago
  But the obvious thing to do would be to pick anybody else that Jeff would also talk to and send it from their account instead. Only the most incompetent intelligence agency imaginable would do an op and intentionally attribute it to their own head of state.
  - ceejayoz 7y ago
    Is there reason to believe Bezos regularly corresponds on WhatsApp with other Saudis?
    - lawnchair_larry 7y ago
      Why would it have to come from another Saudi?

goldcd 7y ago

My gut response to this is "bullshit" Not based on the Saudi's not buying zero-day-exploits, but on them using them from the crown prince's account directly against Jeff.

ceejayoz 7y ago
Bezos is presumably savvy enough not to open a WhatsApp message from some random person, and given the Khashoggi situation (employed by the WaPo, which Bezos owns) it's not surprising he'd be on the Saudi's target list to compromise.
zelon88 7y ago
I can see it. The Saudi's control over their own media means that their population will likely never find out, and the ones that do will support the government anyway. Outside of that the rest of the world is in the perfect place to accept whatever lies the Saudi's shrug this off with. Authoritarianism is on a rise and truth is in decline. Trust in media is probably the worst its ever been. Your post proves it. There would be no impact on their foreign policy efforts even if it were true.
Zooper 7y ago
Why? Bezos isn't going to open any other videos from someone else. The US executive branch won't do a thing, in case the Saudis decide to stop buying US treasury bonds in exchange for oil. Then they might stop buying weapons, which funds the inflated military industry, and then they might buy weapons from someone else and begin keeping larger reserves of their currency. This exchange is worth more to those in power than Bezos' love life.
OrgNet 7y ago
The Russians used a Saudi account....

nif2ee 7y ago

>Jeff Bezos chatting with Mohammed bin Salman on WhatsApp Not sure whether this is a yet another fake story sponsored by the Qataris, who infiltrated the liberal western media with their isalmist and ultra left minions all over in the name of diversity, since their rift with the Saudis in mid 2017 or the richest man on Earth is actually retarded enough to chat with a head of state like Saudi Arabia on fucking WhatsApp

amelius 7y ago

What brand was the phone and OS?

chrisbrandow 7y ago
It is very odd. Every article I've read recently or when it occurred seem to leave this detail out.
eatmyshorts 7y ago
It doesn't matter. The Whatsapp exploit affected both IOS and Android: https://appleinsider.com/articles/19/05/13/whatsapp-vulnerability-left-ios-open-to-spyware-attack https://appleinsider.com/articles/19/05/13/whatsapp-vulnerab...
- amelius 7y ago
  That's interesting. How would that work? Under Android, all apps effectively run inside a Java sandbox, right? So how would the attackers be able to install spyware through Whatsapp?
  - peteretep 7y ago
    I may well be proven wrong by further revelations, but: > Large amounts of data were exfiltrated from Bezos’s phone within hours I could see a cross-platform WhatsApp message that leaked WhatsApp data?
  - verroq 7y ago
    There are more exploit chains for Android and iOS that can be used once RCE is achieved.
  - all_blue_chucks 7y ago
    They only had to spy on whatsapp, so they could do it all in the same sandbox.
  - angry_octet 7y ago
    Since WhatsApp whines incessantly unless you give it various permissions it might have already had the ability to access photos etc. As well as sending whatever is in its directory or using a local priv escalation.

kshacker 7y ago

Whatsapp allows desktop clients. I use it too. It is technically possible for someone to hijack this desktop client and do this without MBS's involvement, as long as MBS authorized that desktop. I think you need proximity, but you can have a computer near the prince, and that computer being remotely controlled by someone sitting far away. Not saying this happened ... but there are many ways to blame it on prince and many ways to defend him (and blame a subordinate).

jessriedel 7y ago
I thought the Whatsapp desktop client was just a glorified remote control for the phone, and could not actually function as a standalone client by itself?
- rapsey 7y ago
  Going through a remote control or to your phone directly makes no difference. So the remote control is an additional point of failure.
- kshacker 7y ago
  It is a remote control, but a case could be made that even though the prince had the phone with him, someone did it from his computer [ Of course assuming he was not looking at his phone at that time. ] I am not on prince's side, just saying ...
  - Totoradio 7y ago
    If you're thinking of a private actor, I think that once you have access to MBS phone, you run to Doha before attacking Bezos. Qatar would pay a ton of money for that access. If you're thinking of a state actor except Saudi Arabia, I think there would be much easier and more discreet vectors to Jeff Bezos Whatsapp than MBS phone (literally almost any of Bezos other contacts would be less risky).

tasssko 7y ago

Is it that easy to be hacked with WhatsApp?

WilTimSon 7y ago
Well, here's a list of known WhatsApp hacks that were revealed in 2019: Call hack [0]: https://www.wired.com/story/whatsapp-hack-phone-call-voip-buffer-overflow/ https://www.wired.com/story/whatsapp-hack-phone-call-voip-bu... Video hack [1]: https://thehackernews.com/2019/11/whatsapp-hacking-vulnerability.html https://thehackernews.com/2019/11/whatsapp-hacking-vulnerabi... GIF hack [2]: https://thehackernews.com/2019/10/whatsapp-rce-vulnerability.html https://thehackernews.com/2019/10/whatsapp-rce-vulnerability... That call hack was famously used by NSO, hitting thousands of people [3]: https://thehackernews.com/2019/10/whatsapp-nso-group-malware.html https://thehackernews.com/2019/10/whatsapp-nso-group-malware... Hack that let anyone crash the apps for all members of a group chat [4]: https://thehackernews.com/2019/12/whatsapp-group-crash.html https://thehackernews.com/2019/12/whatsapp-group-crash.html I think I'm actually missing one more. These are just the widely known ones, mind you, and just for 2019.
- TwoBit 7y ago
  "The flaw (CVE-2019-3568) successfully allowed attackers to silently install the spyware app on targeted phones by merely placing a WhatsApp video call with specially crafted requests, even when the call was not answered." Geez that seems pretty incompetent.
- novaRom 7y ago
  These are not hacks, it's called "Backdoor". There are probably tons more hidden backdoors left, we can only speculate. WhatsApp is a private non-open source project.

rmsaksida 7y ago

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109 https://t.me/s/durov/109

eljimmy 7y ago
That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?
- resters 7y ago
  Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data center breach and likely many other cases. At WhatsApp/Google scale the attack is extremely cost effective.
  - ghostpepper 7y ago
    Can you elaborate on the google data center breach? Are you saying it was orchestrated by google?
    - resters 7y ago
      Not orchestrated, but happily tolerated. All Google needs is to be able to plausibly deny complicity, but the other practices of Google (such as not offering warrant canaries on all Google accounts) indicate that Google is eager to cooperate and please governments, so it would have been easy to leave a few doors unlocked, hire a plant (with solid itsec skills), etc.
      - ghostpepper 7y ago

hloiuweri 7y ago

One thing which this article doesn't address at all, is what is the beef between MBS and Bezos? Why would the Saudi prince leak this data? How did Amazon upset him?

dwd 7y ago
Join the dots... Who had a beef with Bezos and was friendly with MBS?
- executive 7y ago
  Tim Cook, for one.
  - dwd 7y ago
    Ricky Gervais better watch his back then.
chongli 7y ago
I think MBS has a beef with the Washington Post (also owned by Bezos), not Amazon. It also fits with the murder of Khashoggi, a WaPo journalist.
chance_state 7y ago
Perhaps as a favor to Trump who constantly whines about WaPo and Bezos?
- dwd 7y ago
  I think at the very least they would have bet on the WH looking the other way while they conducted an attack on a prominent US citizen. At worst it could be another "favour" attached to military procurement.
- not_kurt_godel 7y ago
  Very curious about the downvotes on this one. Trump has clearly demonstrated time and again that he is not above egregiously and obviously breaking the law to further his personal interests. He has been willing to overlook cold-blooded murder by MBS specifically. So this speculation is very comfortably (or uncomfortably, as it were) within the realm of reasonable speculation, is it not?

mirimir 7y ago

OK, so I'm just a random anonymous coward. And arguably obsessed with my hobby. But I'm puzzled that Bezos would be corresponding with MBS on the same device that he uses for potentially embarrassing personal stuff. Isn't that just a totally obvious OPSEC fail? Edit: But that's what he did, isn't it? And how could that be considered safe?

joe_the_user 7y ago
I think this a good question. The problem is that even the head of a ginormous company with a strong connection to computer security generally (through AWS) is going to take actions based on convenience rather than OPSEC discipline. I think it's natural for any given human to chat with all one's friend on the same level, with the same device and so-forth. A given individual can train themselves to have hard walls in their personal dealings but I'd suspect that individual would be a mid-level specialist, not the owner/manager/CEO who gets their position by their ability to manage and connect with people, not through technical expertise.
- mirimir 7y ago
  I guess. But even before the Khashoggi assassination, MBS was arguably an obvious threat. I can't imagine considering him a "friend". I mean, I'd be gobsmacked if he mixed personal and business on the same devices. That could be disastrous, not just embarrassing. So a third device category doesn't seem unworkable. Edit: Also, wouldn't someone like Bezos have security advisers? And how could they have failed to warn him? One could make a similar argument about MBS, of course.
  - joe_the_user 7y ago
    This reminds me of the way that Barrack Obama tried to keep his personal cellphone once he became president. Having a personal relationship with the wealthy and powerful is a unique thing since these are the ultimate decision makers. I would guess that Bezos or anyone like him chats frequently with very powerful people and that this is factor in him maintaining his own power and influence. And mobile devices would seem to magnify that ability of the very topmost people to connect directly with each other - ie, this was all done by secretaries and through protocol but that's slower and can let one big boss instantly sway another. Of MBS doing his own spying and hacking is another way topmost people are becoming "do it yourself-ers".

mzs 7y ago

Pegasus as expected according to another person claiming to have been hacked, also a report expected out in the coming months https://twitter.com/iyad_elbaghdadi/status/1219741773301452800 https://twitter.com/iyad_elbaghdadi/status/12197417733014528...

derefr 7y ago

So, anyone want to hazard a guess on why the prince would want the optics of being seen to have been responsible for the hack (as opposed to trying to cover that up by, say, not using his very own account)?

p0rkbelly 7y ago
Simple. To flex and show that he is untouchable and that nobody ever holds him accountable.
angry_octet 7y ago
Firstly, he's an idiot. His staff obviously don't brief him on the likely consequences of actions, they just go do it. Because he's a brutal dictator who has disloyal people executed. Secondly, Saudi's don't have their own advanced cyber capabilities (unlike Iran, UAE, Israel, etc), they rely on buying help. And single use, no interaction, 0day RCEs for recent phones (and we can assume latest iOS or Pixel) are not that available. So they used what they could get their hands on. It beats me that they couldn't steal the phone of someone else in Bezos's WhatsApp contacts and impersonate them. Maybe Bezos wouldn't have opened the attachment. But overall, I think they are just dumb. There remains a small possibility that someone hacked the phone of MbS (I mean, everyone has thoughts about doing that) and then pivoted to attacking people in his contacts. But the whole NSO group involvement makes me think it wasn't that.

deleted 7y ago

[deleted]

angry_octet 7y ago

Talk about lousy deniability. I wonder how many Alexas there are in Saudi.

ineedasername 7y ago

Is there any detail on the nature of the exploit? It seems to have been triggered by receipt of a video in WhatsApp. Was the flaw in WhatsApp itself? Or would the exploit have occurred regardless of which messaging/transfer mechanism was used to deliver the video? Has this been fixed? Is it even a documented exploit or is it simply known that it had something to do with the WhatsApp video, but not the actual methodology?

schalab 7y ago

Explanation 1: Lauren Sanchez(bezos' new girfiend) along with her brother Michael(who is also her agent), leaked the story to force Bezos to divorce his wife and get along with her. Explanation 2: The crown prince of Saudi Arabia personally sent a trojan file, downloaded all the data, distributed it through a gossip rag he happens to be friends with, for some kind of revenge/message I get why Bezos has to go with explanation 2 because explanation 1 would indicate the girl he wants to have sex with or her brother is manipulative. I dont see why the rest of us have to go along with this. Even this anonymous source says he has "high confidence" not anywhere near certainty.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
streb-lo 7y ago
Is explanation 2 supposed to be outlandish? A country like Saudia Arabia is going to use every tactic possible to combat their asymmetry with the West. It's not the crown prince personally having someone cook up a trojan for him -- it's their national apparatus deciding that free potential leverage over influential Americans is a worthwhile pursuit.
AshwinDurairaj 7y ago
The motives for explanation 2 are currently not known. MBS might have had numerous reasons, ranging from WaPo or AWS. But regardless, there could have been many reasons to target Bezos. The part that doesn't sit right with me is the leaks, since it would have burned the 0day and connected Saudis to hacking phones which I doubt they would have wanted.
tiles 7y ago
If you take into account that MBS murdered an employee of Bezos, explanation #2 sounds plausible.

neycoda 7y ago

Yay

dizzru600 7y ago

Oohhhh noo taviel

WaPo16Hits1Day 7y ago

How am I supposed to trust WaPo that took out 16 hit pieces in a single day against Sanders? Perhaps they're trying to malign Salman like they do to anyone not establishment?

tasubotadas 7y ago

This gives me tremendous respect for Jeff. Most likely his marriage fell apart because of this costing him personally ~25B. But that means that he didn't give in to whatever Mr Prince wanted.

deleted 7y ago
[deleted]
aedron 7y ago
Yes, it seems he was pretty hardcore about it. "Go ahead, publish it." Since J. Edgar Hoover, it is has been an open secret that blackmail drives the upper echelon of politics and media. The Bill Clinton thing is another example, pretty sure he put his foot down and said fuck it, hence Lewinsky turning up with a tainted dress from 8 months ago, and down goes the U.S. president. How many just acquiesce and play along quietly? More people should have guts like Bezos (probably did). Though at some point, I'm sure the shadow people will just fall back on good old violence, like the Epstein case.

busymom0 7y ago

I am not buying this story. With all the other possible options, why would someone like MBS do it from his very own phone which this article claims? It sounds more like someone is trying to frame MBS.

krn 7y ago

I pointed this out 11 months ago: https://news.ycombinator.com/item?id=19122206 https://news.ycombinator.com/item?id=19122206

deleted 7y ago
[deleted]
nsajko 7y ago
Some informative links to make you scared about democracy, or just your safety: https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware) https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-new-abuse-cases/ https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-n... https://citizenlab.ca/2018/06/government-spyware-surveillance-mexico/ https://citizenlab.ca/2018/06/government-spyware-surveillanc... https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware/ https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware... https://citizenlab.ca/ https://citizenlab.ca/
- dmamills 7y ago
  Why are these down voted? I'd say these Citizen Lab reports are HIGHLY relevant to this discussion topic.

ptah 7y ago

as per usual there will be zero consequences

conston 7y ago

This is why for the past 7 years I have rejected any files sent to me, and insist on receiving cloud links such as google, dropbox etc.

turkthrower123 7y ago

Considering the Saudi Arabian government slaughtered 3,000 people on 9/11, I don't understand why America does business with them.

LatteLazy 7y ago

Don't deal with the Saudis. History will look back on you the same way it looks back on people shaking hands with Hitler. I'm not kidding.

lgl 7y ago
The US is the world's largest weapons exporter and Saudi Arabia is the world's largest weapon importer. I'm not sure even a Hitler level calamity would make the US stop dealing with them. They're holding their hands and complementing their "leadership skills" ffs...
- LatteLazy 7y ago
  I think the oil will run out (or we'll transition to other energy sources), then Saudi will just wither and the special relationship will disappear. But yeah, it won't end because of morality.

LatteLazy 7y ago

The wider question here is how to handle Saudi Arabian trades in Western markets. Every and any deal undertaken by a state actor (MBS, any of the 1000s of princes the place is littered with, the sovereign wealth fund or the state or semi state companies) could well be the result of insider trading... And thats just the public markets. Imagine the advantage you would have in startup investing if you could covertly read all the internal discussions, the founders texts and emails, remotely access their meetings with lawyers, accountants and other VCs. No wonder SA is suddenly interested in Silicon Valley

patja 7y ago

Last time I stayed at an AirBnb in Prague, the owners preferred method of communication was WhatsApp. When I went to install it I was confronted with no other choice than allowing it to import all my contacts, even though there was only one person I wanted to communicate with. I was aware of these vulnerabilities and generally am protective of handing out PII, especially information others have entrusted to me. So I didn't give it access to hundreds of business and personal contacts spanning decades of work and life. How do others deal with this who perhaps don't have the choice to just say "I'm going to text you instead for the 4 days we are going to have a need to communicate"? Do you keep a full set of contact data outside your phone's contacts for information you don't want shared? Private and public contacts?

st1ck 7y ago
Somewhat recent Android versions have work profile which at the very least gives you a sandbox for all apps you want to be isolated from the main profile. Unfortunately, all those work profile apps still share data between themselves. Maybe it was improved lately.

nlh 7y ago

Apparently I’m the only person on earth who wants to know what kind of phone Bezos was using, which OS version, etc. It seems like this detail is conveniently being left out of every story. Anyone have any additional details? I understand that it was a WhatsApp vulnerability (Pegasus?) but I’d still like to know more about the device.

mizaru 7y ago
iPhone X https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacked-jeff-bezos-phone-technical-report https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacke...
stiGGG 7y ago
According to vice [1] he was using an iPhone X. 1: https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacked-jeff-bezos-phone-technical-report?utm_campaign=sharebutton https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacke...
mzs 7y ago
Office of the High Commissioner for Human Rights report confirms it was iOS (page 2) https://www.ohchr.org/Documents/Issues/Expression/SRsSumexFreedexAnnexes.pdf https://www.ohchr.org/Documents/Issues/Expression/SRsSumexFr... more: https://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=25488 https://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?N...
rbolla 7y ago
iphone X A1901. Hacked by Al Qahtani and co. soon after the video was sent, the egress on the iphone has increased astonishingly to 29000 %.