5 ms·

first paragraph: The Amazon billionaire Jeff Bezos had his mobile phone “hacked” in 2018 after receiving a WhatsApp message that had apparently been sent from t

first paragraph: The Amazon billionaire Jeff Bezos had his mobile phone “hacked” in 2018 after receiving a WhatsApp message that had apparently been sent from the personal account of the crown prince of Saudi Arabia, sources have told the Guardian. So, not snapchat, but whatsapp. And it's quite surprising for me. So, Saudis have 0 days which work on whatsapp on iphone (I suppose Bezos uses iphone)? I mean, FB and AAPL, which both can afford tens of billions in security research, were pwned by saudi 0day? hmmm...

shyn3 7y ago
My guess is this gave them the ability to access anything WhatsApp could access with a code bug in the application and so maybe a Facebook issue more than an Apple issue.
- Nextgrid 7y ago
  If WhatsApp was given photo library access (which isn't unlikely considering you need it to send previously taken photos) then the exploit could access all his photos without a vulnerability on Apple's part.
  - Marsymars 7y ago
    > which isn't unlikely considering you need it to send previously taken photos To be clear for anyone else reading, photo library access is required to browse the photo library from within WhatsApp, it's not required to share arbitrary photos to WhatsApp from the photo app via the OS's built-in share feature.
spzb 7y ago
Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.
- nopriorarrests 7y ago
  Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?
  - icandoit 7y ago
    I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.
    - nopriorarrests 7y ago
      Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?
      - zulln 7y ago
        > what makes people work for nefarius inc? No idea about nefarius, but when I talked with someone in a similar role the answer was work conditions. It was apparently easier to get a remote role with a flexible schedule at a more "sketchy" company.
      - mywittyname 7y ago
        > what makes people work for nefarius inc? Very good pay; the ability to work remotely; pride/prestige; community; political reasons. Being a good digital thief is still very lucrative, especially for people living in low income areas with relatively lax law enforcement. These people can run encrypted computer extortions, steal bitcoin wallets, run/sell botnets, fence digital goods, run underground ad networks, and consult.
danso 7y ago
Thanks, I did make an error and I quickly edited Snapchat to Whatsapp, but didn't note it initially since no one had replied at that point.
p1necone 7y ago
Anyone can get pwned by a 0day. Most nation states probably have funds to buy a probably exclusive 0day and use it against a target.

shyn3 7y ago

My guess is this gave them the ability to access anything WhatsApp could access with a code bug in the application and so maybe a Facebook issue more than an Apple issue.

Nextgrid 7y ago
If WhatsApp was given photo library access (which isn't unlikely considering you need it to send previously taken photos) then the exploit could access all his photos without a vulnerability on Apple's part.
- Marsymars 7y ago
  > which isn't unlikely considering you need it to send previously taken photos To be clear for anyone else reading, photo library access is required to browse the photo library from within WhatsApp, it's not required to share arbitrary photos to WhatsApp from the photo app via the OS's built-in share feature.

spzb 7y ago

Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.

nopriorarrests 7y ago
Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?
- icandoit 7y ago
  I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.
  - nopriorarrests 7y ago
    Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?
    - zulln 7y ago
      > what makes people work for nefarius inc? No idea about nefarius, but when I talked with someone in a similar role the answer was work conditions. It was apparently easier to get a remote role with a flexible schedule at a more "sketchy" company.
    - mywittyname 7y ago
      > what makes people work for nefarius inc? Very good pay; the ability to work remotely; pride/prestige; community; political reasons. Being a good digital thief is still very lucrative, especially for people living in low income areas with relatively lax law enforcement. These people can run encrypted computer extortions, steal bitcoin wallets, run/sell botnets, fence digital goods, run underground ad networks, and consult.

danso 7y ago

Thanks, I did make an error and I quickly edited Snapchat to Whatsapp, but didn't note it initially since no one had replied at that point.

p1necone 7y ago

Anyone can get pwned by a 0day. Most nation states probably have funds to buy a probably exclusive 0day and use it against a target.