7 ms·

Report on the Bezos Phone Hack [pdf]

213 points by bb88 7y ago

TekMol 7y ago
What does it mean that the malicious video was delivered via "an encrypted downloader hosted on WhatsApp's media server"?
- comex 7y ago
  It means that they don't know what they're talking about. A "downloader" refers to part of an exploit payload (or other malware) that downloads additional code. But an attacker can only use a downloader after triggering an exploit and getting code execution. If they're right about there being an exploit related to the video, it would presumably be in the video file itself; otherwise there would be no need to send an irrelevant video. But in that case, the exploit couldn't have been used to download the video in the first place. And why would you need to use some special code to download a video attachment, when that's presumably part of WhatsApp's builtin functionality? Also, even if there was a downloader involved, it would be, as the name suggests, the thing that does the downloading – not the thing that was downloaded. Whether or not there was an exploit, it seems almost certain that WhatsApp automatically downloaded the video like any other attachment, and the encryption was WhatsApp's own end-to-end encryption. Indeed, the report itself cites WhatsApp's end-to-end encryption in point 22, so it seems like they should be aware of that. Maybe they just don't know what "downloader" means, or maybe their ignorance is deeper; I can't really tell.
Natsu 7y ago
That's a really long document to say that they weren't able to find much of anything. They think his bandwidth usage went up for a long time after he got a WhatsApp message from MbS' number and couldn't actually analyze any malware. I have to wonder why they'd hack him with a video flying their own flag. The thing about the women looking similar is really reaching and doesn't make any sense. We already have other reports that Bezos' GF showed texts to her brother who sold them from other reports. Finally, what's with really rich people sending their electronics to 3rd party security firms and not letting the Feds analyze anything directly? You'd think that if this was really some matter of national security or whatever, you'd want an investigation by people with subpoena power. But I guess that doesn't matter for some reason?
- lawnchair_larry 7y ago
  Private companies keep it closely guarded and destroy any copies of it after the job is done. You can be reasonably confident that it won’t leave the analysis laptops. If you give it to the FBI, you have no guarantees. It’s property of the government and is archived and stored indefinitely as evidence. The FBI do not do private investigative services for important rich people, they investigate crimes.
  - Natsu 7y ago
    > The FBI do not do private investigative services for important rich people, they investigate crimes. I was under the distinct impression that hacking someone's phone was not legal. EDIT: Also, I don't know about the FBI specifically, but I would expect there to be someone to investigate reports of foreign espionage. And I have a lot of questions about whether anything from this report can be used in court now, should they identify anyone who can be held accountable. One last thing... isn't that also an implication that they think that keeping the contents of the phone secret is more important than national security? Just what else is on there?
  - comment_guy 7y ago
    Given the motivations of a private company or the FBI, who would you really choose? I'd go private with anything sensitive, they can't arrest me and they have a profit motive in protecting my data.
    - Natsu 7y ago
      It would be odd for them to arrest Bezos for having his own phone hacked.
- gdm85 7y ago
  The only part I appreciated is the description of the preparation of the lab, which sounded quite good and proper.
lawnchair_larry 7y ago
There is pretty much no actual evidence here and at least a few indications that they are not iOS forensics experts. Bezos did not choose the right company to handle this work. Some of their assumptions are really stretching, especially the bit about the picture of the woman looking vaguely like his girlfriend, as if that’s an indicator that they know about her. They seem to be working backwards from their conclusion and trying to stretch the evidence to the explain what they want to be true. I actually was more convinced that MBS was involved before reading the report. Now seeing this, plus the story that AMI paid her brother 200k for leaked texts that WSJ saw and verified, really has me doubting.
- arkadiyt 7y ago
  The report claimed they couldn't decrypt the whatsapp video, so Dino A. Dai Zovi (head of security for CashApp) published code [1] to do it. The report also concludes that they need to jailbreak the phone to do more analysis, but hadn't yet for undisclosed reasons. Bezos was using an iPhone X, which is trivial to jailbreak with checkra1n [2]. So yeah, FTI didn't know what they were doing. [1]: https://twitter.com/dinodaizovi/status/1221324029841244161 https://twitter.com/dinodaizovi/status/1221324029841244161 [2]: https://checkra.in/ https://checkra.in/
  - app4soft 7y ago
    > so Dino A. Dai Zovi (head of security for CashApp) published code to do it. Great! May be useful to decrypt also the whatsapp videos, mentioned in Lev Parnas' excerpts. FTR, Just found that there are many other tools available for decrypt whatsapp in last two years.[0] [0] https://github.com/search?o=desc&q=whatsapp+decrypt&s=updated&type=Repositories https://github.com/search?o=desc&q=whatsapp+decrypt&s=update...
  - deleted 7y ago
    [deleted]
- deleted 7y ago
  [deleted]
- Yuval_Halevi 7y ago
captnswing 7y ago
by downloading the pdf, will my iphone get infected? :)
nif2ee 7y ago
if this is true and MBS wants to silence Jeff Bezos just because his owned paper attacks him, mind you this paper just like every other major western paper attacks him day and night since the murder of the Saudi "journalist" so silencing one paper won't make any difference anyway. Why would he send this infected video which is probably linked to a backdoor only a very few have knowledge about, from his own Whatsapp account not from some associate or a friend of Bezos who is in his contacts? This whole story doesn't seem logical to me.
tasssko 7y ago
This is interesting, privacy and security work both ways. Protecting us and our data and enabling malicious actors. I have turned off Auto Downloads on Whatsapp.
- mk89 7y ago
  I never understood why that feature is not disabled by default. I am so tired of this madness for frictionless UX everywhere. Just because someone has to have everything readily available without having to click. Where is the UX when someone sends stupid dumb pictures constantly in groups you belong to? And those get downloaded automatically. Or where is the UX when someone hacks your phone thanks to this "feature" enabled? Even IE disabled this feature!
  - inapis 7y ago
    I’m still grateful that this feature is still available behind a toggle and not whatsapp using its smarts to decide what should be downloaded or not. But I can understand the desire for frictionless user experience because for vast majority of the population this is not an issue. If you hold something of significance it is upto you to practise and execute sensible security measures.
  - tasssko 7y ago
    Yes, I agree. It should be turned off by default.
ddalex 7y ago
So the billionaires of this world, Bezos and MBS, exchange memes with photos of pretty girls. And Bezos reads The Daily Mail. Just like the rest of us, except having way more $$$.
- ikeboy 7y ago
  The daily mail was loaded in the forensic test, likely as an ad in some other page.
beshrkayali 7y ago
Probably "technical" should be removed from the title.
- dang 7y ago
  Ok, removed. It doesn't seem to be how the article refers to itself, though I can't be sure because the thing is unsearchable.
  - gouggoug 7y ago
    I think the parent was being sarcastic, referring to the really poor quality of the report.
nodamage 7y ago
Two questions (which aren't really explained in this report): 1. Did he have to actually play the video, or was simply receiving the message enough to compromise his phone? 2. It says after his phone was compromised, a large amount of data was extracted from his phone. Was this only WhatsApp specific data (cached pics and videos from messages sent within the app) or did the malware actually have full access to all of the files on his phone? Because of iOS's sandboxing and permission system I would not have expected that a vulnerability in WhatsApp itself would be able to grant access to the entire phone. That seems like it would be much bigger news if it were the case.
- hedgehog 7y ago
  WhatsApp uses system address book for a few things, has photo sharing, and has video calling so it's reasonably likely it had been granted access to contacts, photos, camera, and microphone.
  - nodamage 7y ago
    Yeah I suppose we should not be surprised by that, I'm just curious whether the exploit 1) only gave access to data that WhatsApp would normally have permission to access, or 2) gave access to the entire phone regardless of permissions.
- sneak 7y ago
  These apps ask for camera roll and camera access permissions and usually get them, which would render sandboxing (for photos and videos) irrelevant.
  - Twisell 7y ago
    Pro-tip only give access to camera for social apps. If you want to share fast use camera from within app. If you want to share something from your photo library copy/paste between apps. It more tedious, but exploit on social don't automagically leak personal data from your OS library.
mikenew 7y ago
> Due to end-to-end encryption employed by WhatsApp, it is virtually impossible to decrypt the contents of the downloader to determine if it contained any malicious code in addition to the delivered video. I can't make any sense of that. The phone is the end in "end-to-end". It contains the decryption keys. Why would "the downloader" be any different to decrypt than the video? Also they show a screenshot of the video being sent through WhatsApp... but they're saying that the video was downloaded via some malicious executable? I would have thought the video would contain the malicious code. That makes no sense. > Advanced weapons grade mobile malware typically installs itself to the root filesystem of a device to maintain persistence and avoid detection. This report sounds like bullshit. It sounds like they looked at the cellular data use, noticed an increase after this whatsapp message was sent, and did a bunch of random stuff they barely understood to fill out the report. Their list of "forensic tools" or whatever includes like... grep. And virutalbox. They also didn't jailbreak the phone and look at the filesystem, so I'm not sure what they even looked at besides just sniffing the wifi traffic. EDIT: I reread the report. Jeff Bezos' phone was not hacked. They are claiming that a video attachment in whatsapp contained a malicious executable that gained full filesystem access to his iPhone based on absolutely nothing other than the fact that his cellular data upload increased. Most of that increase happened almost a year later. The guy just started using iCloud photo backups or sent someone videos via imessage or something. There are way simpler explanations for why the media got his text messages. Like, you know, the person he sent them to showed somebody.
thierryzoller 7y ago
His internal team could have done better.
3leggedcatman 7y ago
So another narcissist on the internet had his phone hacked. Big deal.
l33tman 7y ago
Does this refer to the GIF-parsing double-free remote whatsapp exploit discussed in detail on HN some months ago? https://news.ycombinator.com/item?id=21135424 https://news.ycombinator.com/item?id=21135424
gdm85 7y ago
They lost me at "encrypted downloader". The WhatsApp video attachment format allows for...a downloader? I strongly doubt that. Perhaps what they should have written is that they cannot decrypt the video and thus check for an exploit within it (it's commonly called payload, because it doesn't have to be a downloader...). I see from other comments here that I am not the only one doubting the report wording at the very least.
- eitland 7y ago
  Probably an exploit.
  - makomk 7y ago
    Nope, they seem to mean the encrypted file format used by WhatsApp to transmit and store attachments, which a competent forensics outfit should be able to decrypt: https://medium.com/@billmarczak/bezos-hack-mbs-mohammed-bin-salman-whatsapp-218e1b4e1242 https://medium.com/@billmarczak/bezos-hack-mbs-mohammed-bin-...
deleted 7y ago
[deleted]
imvetri 7y ago
Don't read. Read comments and save your time.
jonstewart 7y ago
“Former Chief of Staff of FBI’s Cyber Division” => Outlook Calendar Expert
zaroth 7y ago
This story has frustrated me from the very first Bezos blog post [1] as a fairly obvious counterintelligence operation. Now a year later the story has resurfaced and it’s all the same conspiracy theories based on nothing. This report demonstrates as clearly as you could hope that there was no real analysis and no real evidence of any of the absolutely extraordinary claims made by Besos and de Becker. [2] From what I can tell, the only reasonable conclusion is that this whole thing was a retaliatory attack on MBS and on AMI. Yet a year later, the news headlines are all parroting that the report proves MBS personally orchestrated this exploit. We are now at the point of theater of the absurd. This story has been a smoldering load of garbage from the very beginning. [3] I can’t believe it keeps coming around. The closest I can find to an honest accounting is this WSJ op-ed [4], which many here won’t like because it ties the totally flawed reporting on this story back to similar flaws in the Russiagate reporting. That is, a story the media wants to be true just a bit too badly. [1] - https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146e3922310f https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146... [2] - https://www.thedailybeast.com/jeff-bezos-investigation-finds-the-saudis-obtained-his-private-information https://www.thedailybeast.com/jeff-bezos-investigation-finds... [3] - https://news.ycombinator.com/item?id=19535965 https://news.ycombinator.com/item?id=19535965 https://news.ycombinator.com/item?id=19539943 https://news.ycombinator.com/item?id=19539943 [4] - https://www.wsj.com/articles/jeff-bezos-tries-to-wag-the-dog-11579909357 https://www.wsj.com/articles/jeff-bezos-tries-to-wag-the-dog...
- Natsu 7y ago
  The media doesn't shy even from starting wars over this stuff (the gas attacks that weren't in Syria, WMD in Iraq, etc.). Expect them to make many layers of conclusions like this to support some goal in, I dunno, replacing MbS with someone they like better after a while.
alexandercrohde 7y ago
tl; dr: nothing is proven yet in either direction. The report acknowledges "ongoing work" is needed to root the phone. Maybe they should have waited to publish until they did that.
ghostpepper 7y ago
I don't understand why they refer to the list of 192 URLs that all turned out to be legitimate as "IOCs" Why would a device reaching out to bing/wikipedia/medium be considered an indicator of compromise, or even a suspected IOC?
an-allen 7y ago
This report is a pure, unadulterated, dumpster fire. No one is explaining how a video file is a trojan vector. Also this report has way too much background of the “Hacking Team” that really sounds suspect from me. I just feel if you are trying to establish that this vector was the source of a trojan - youd actually prove that instead of giving a page or two of conjecture on where this code that you haven’t shown is malware - came from. Also, obligatory, correlation does not imply causation. This report hinges on the argument that “video received from MBS and shortly thereafter the total data egress increased”. Okay what data was egressed? Where was it egressed to? Just basic things are missing from this report that are relevant. Absolute garbage.
- mrobins 7y ago
  > Also this report has way too much background of the “Hacking Team” that really sounds suspect from me. Consultants write like high school students with a ten page research paper requirement. If you don’t have real content pad it with extra background, bulleted lists and superfluous tables. The final product needs to be long enough so people think real work was done but boring enough that they don’t actually read it.
Slartie 7y ago
This was really boring from a security or forensics perspective. Nothing really substantial in there. But fortunately there are other angles to view this document from: if this is authentic, it says that the richest man on the entire planet... ...uses a two year old phone. I mean, I like my iPhone X too, but hey, if I had like north of 100 billion dollars, I would certainly spend about 1500 of those dollars for the newest iPhone generation every year (especially if my older generation has an unfixable bootloader bug compromising its entire security architecture). ...exchanges silly meme pictures with ostensibly funny texts with his billionaire friends.
- gizmodo59 7y ago
  May be he did not find any good reason to upgrade? Sometimes its just not worth the time rather than the money part. I'm sure a lot of people here feel the same even though they have the means to buy one every year.
- coolspot 7y ago
  Well, at least it is not a Nokia 3310. This is part of his personality, here billionaire Jeff Bezos explaining why he is driving old Honda Accord: https://youtu.be/iJQdj9EhQoQ https://youtu.be/iJQdj9EhQoQ – “It’s perfectly good car”.
ComodoHacker 7y ago
Well, no direct evidence, just co-timed egress data spikes, which no one noticed for 9 months. If there was a hack, it was a pretty successful one.

213 points by bb88 7y ago

What does it mean that the malicious video was delivered via "an encrypted downloader hosted on WhatsApp's media server"?

comex 7y ago
It means that they don't know what they're talking about. A "downloader" refers to part of an exploit payload (or other malware) that downloads additional code. But an attacker can only use a downloader after triggering an exploit and getting code execution. If they're right about there being an exploit related to the video, it would presumably be in the video file itself; otherwise there would be no need to send an irrelevant video. But in that case, the exploit couldn't have been used to download the video in the first place. And why would you need to use some special code to download a video attachment, when that's presumably part of WhatsApp's builtin functionality? Also, even if there was a downloader involved, it would be, as the name suggests, the thing that does the downloading – not the thing that was downloaded. Whether or not there was an exploit, it seems almost certain that WhatsApp automatically downloaded the video like any other attachment, and the encryption was WhatsApp's own end-to-end encryption. Indeed, the report itself cites WhatsApp's end-to-end encryption in point 22, so it seems like they should be aware of that. Maybe they just don't know what "downloader" means, or maybe their ignorance is deeper; I can't really tell.

Natsu 7y ago

That's a really long document to say that they weren't able to find much of anything. They think his bandwidth usage went up for a long time after he got a WhatsApp message from MbS' number and couldn't actually analyze any malware. I have to wonder why they'd hack him with a video flying their own flag. The thing about the women looking similar is really reaching and doesn't make any sense. We already have other reports that Bezos' GF showed texts to her brother who sold them from other reports. Finally, what's with really rich people sending their electronics to 3rd party security firms and not letting the Feds analyze anything directly? You'd think that if this was really some matter of national security or whatever, you'd want an investigation by people with subpoena power. But I guess that doesn't matter for some reason?

lawnchair_larry 7y ago
Private companies keep it closely guarded and destroy any copies of it after the job is done. You can be reasonably confident that it won’t leave the analysis laptops. If you give it to the FBI, you have no guarantees. It’s property of the government and is archived and stored indefinitely as evidence. The FBI do not do private investigative services for important rich people, they investigate crimes.
- Natsu 7y ago
  > The FBI do not do private investigative services for important rich people, they investigate crimes. I was under the distinct impression that hacking someone's phone was not legal. EDIT: Also, I don't know about the FBI specifically, but I would expect there to be someone to investigate reports of foreign espionage. And I have a lot of questions about whether anything from this report can be used in court now, should they identify anyone who can be held accountable. One last thing... isn't that also an implication that they think that keeping the contents of the phone secret is more important than national security? Just what else is on there?
- comment_guy 7y ago
  Given the motivations of a private company or the FBI, who would you really choose? I'd go private with anything sensitive, they can't arrest me and they have a profit motive in protecting my data.
  - Natsu 7y ago
    It would be odd for them to arrest Bezos for having his own phone hacked.
gdm85 7y ago
The only part I appreciated is the description of the preparation of the lab, which sounded quite good and proper.

lawnchair_larry 7y ago

There is pretty much no actual evidence here and at least a few indications that they are not iOS forensics experts. Bezos did not choose the right company to handle this work. Some of their assumptions are really stretching, especially the bit about the picture of the woman looking vaguely like his girlfriend, as if that’s an indicator that they know about her. They seem to be working backwards from their conclusion and trying to stretch the evidence to the explain what they want to be true. I actually was more convinced that MBS was involved before reading the report. Now seeing this, plus the story that AMI paid her brother 200k for leaked texts that WSJ saw and verified, really has me doubting.

arkadiyt 7y ago
The report claimed they couldn't decrypt the whatsapp video, so Dino A. Dai Zovi (head of security for CashApp) published code [1] to do it. The report also concludes that they need to jailbreak the phone to do more analysis, but hadn't yet for undisclosed reasons. Bezos was using an iPhone X, which is trivial to jailbreak with checkra1n [2]. So yeah, FTI didn't know what they were doing. [1]: https://twitter.com/dinodaizovi/status/1221324029841244161 https://twitter.com/dinodaizovi/status/1221324029841244161 [2]: https://checkra.in/ https://checkra.in/
- app4soft 7y ago
  > so Dino A. Dai Zovi (head of security for CashApp) published code to do it. Great! May be useful to decrypt also the whatsapp videos, mentioned in Lev Parnas' excerpts. FTR, Just found that there are many other tools available for decrypt whatsapp in last two years.[0] [0] https://github.com/search?o=desc&q=whatsapp+decrypt&s=updated&type=Repositories https://github.com/search?o=desc&q=whatsapp+decrypt&s=update...
- deleted 7y ago
  [deleted]
deleted 7y ago
[deleted]
Yuval_Halevi 7y ago

captnswing 7y ago

by downloading the pdf, will my iphone get infected? :)

nif2ee 7y ago

if this is true and MBS wants to silence Jeff Bezos just because his owned paper attacks him, mind you this paper just like every other major western paper attacks him day and night since the murder of the Saudi "journalist" so silencing one paper won't make any difference anyway. Why would he send this infected video which is probably linked to a backdoor only a very few have knowledge about, from his own Whatsapp account not from some associate or a friend of Bezos who is in his contacts? This whole story doesn't seem logical to me.

tasssko 7y ago

This is interesting, privacy and security work both ways. Protecting us and our data and enabling malicious actors. I have turned off Auto Downloads on Whatsapp.

mk89 7y ago
I never understood why that feature is not disabled by default. I am so tired of this madness for frictionless UX everywhere. Just because someone has to have everything readily available without having to click. Where is the UX when someone sends stupid dumb pictures constantly in groups you belong to? And those get downloaded automatically. Or where is the UX when someone hacks your phone thanks to this "feature" enabled? Even IE disabled this feature!
- inapis 7y ago
  I’m still grateful that this feature is still available behind a toggle and not whatsapp using its smarts to decide what should be downloaded or not. But I can understand the desire for frictionless user experience because for vast majority of the population this is not an issue. If you hold something of significance it is upto you to practise and execute sensible security measures.
- tasssko 7y ago
  Yes, I agree. It should be turned off by default.

ddalex 7y ago

So the billionaires of this world, Bezos and MBS, exchange memes with photos of pretty girls. And Bezos reads The Daily Mail. Just like the rest of us, except having way more $$$.

ikeboy 7y ago
The daily mail was loaded in the forensic test, likely as an ad in some other page.

beshrkayali 7y ago

Probably "technical" should be removed from the title.

dang 7y ago
Ok, removed. It doesn't seem to be how the article refers to itself, though I can't be sure because the thing is unsearchable.
- gouggoug 7y ago
  I think the parent was being sarcastic, referring to the really poor quality of the report.

nodamage 7y ago

Two questions (which aren't really explained in this report): 1. Did he have to actually play the video, or was simply receiving the message enough to compromise his phone? 2. It says after his phone was compromised, a large amount of data was extracted from his phone. Was this only WhatsApp specific data (cached pics and videos from messages sent within the app) or did the malware actually have full access to all of the files on his phone? Because of iOS's sandboxing and permission system I would not have expected that a vulnerability in WhatsApp itself would be able to grant access to the entire phone. That seems like it would be much bigger news if it were the case.

hedgehog 7y ago
WhatsApp uses system address book for a few things, has photo sharing, and has video calling so it's reasonably likely it had been granted access to contacts, photos, camera, and microphone.
- nodamage 7y ago
  Yeah I suppose we should not be surprised by that, I'm just curious whether the exploit 1) only gave access to data that WhatsApp would normally have permission to access, or 2) gave access to the entire phone regardless of permissions.
sneak 7y ago
These apps ask for camera roll and camera access permissions and usually get them, which would render sandboxing (for photos and videos) irrelevant.
- Twisell 7y ago
  Pro-tip only give access to camera for social apps. If you want to share fast use camera from within app. If you want to share something from your photo library copy/paste between apps. It more tedious, but exploit on social don't automagically leak personal data from your OS library.

mikenew 7y ago

> Due to end-to-end encryption employed by WhatsApp, it is virtually impossible to decrypt the contents of the downloader to determine if it contained any malicious code in addition to the delivered video. I can't make any sense of that. The phone is the end in "end-to-end". It contains the decryption keys. Why would "the downloader" be any different to decrypt than the video? Also they show a screenshot of the video being sent through WhatsApp... but they're saying that the video was downloaded via some malicious executable? I would have thought the video would contain the malicious code. That makes no sense. > Advanced weapons grade mobile malware typically installs itself to the root filesystem of a device to maintain persistence and avoid detection. This report sounds like bullshit. It sounds like they looked at the cellular data use, noticed an increase after this whatsapp message was sent, and did a bunch of random stuff they barely understood to fill out the report. Their list of "forensic tools" or whatever includes like... grep. And virutalbox. They also didn't jailbreak the phone and look at the filesystem, so I'm not sure what they even looked at besides just sniffing the wifi traffic. EDIT: I reread the report. Jeff Bezos' phone was not hacked. They are claiming that a video attachment in whatsapp contained a malicious executable that gained full filesystem access to his iPhone based on absolutely nothing other than the fact that his cellular data upload increased. Most of that increase happened almost a year later. The guy just started using iCloud photo backups or sent someone videos via imessage or something. There are way simpler explanations for why the media got his text messages. Like, you know, the person he sent them to showed somebody.

thierryzoller 7y ago

His internal team could have done better.

3leggedcatman 7y ago

So another narcissist on the internet had his phone hacked. Big deal.

l33tman 7y ago

Does this refer to the GIF-parsing double-free remote whatsapp exploit discussed in detail on HN some months ago? https://news.ycombinator.com/item?id=21135424 https://news.ycombinator.com/item?id=21135424

gdm85 7y ago

They lost me at "encrypted downloader". The WhatsApp video attachment format allows for...a downloader? I strongly doubt that. Perhaps what they should have written is that they cannot decrypt the video and thus check for an exploit within it (it's commonly called payload, because it doesn't have to be a downloader...). I see from other comments here that I am not the only one doubting the report wording at the very least.

eitland 7y ago
Probably an exploit.
- makomk 7y ago
  Nope, they seem to mean the encrypted file format used by WhatsApp to transmit and store attachments, which a competent forensics outfit should be able to decrypt: https://medium.com/@billmarczak/bezos-hack-mbs-mohammed-bin-salman-whatsapp-218e1b4e1242 https://medium.com/@billmarczak/bezos-hack-mbs-mohammed-bin-...

deleted 7y ago

[deleted]

imvetri 7y ago

Don't read. Read comments and save your time.

jonstewart 7y ago

“Former Chief of Staff of FBI’s Cyber Division” => Outlook Calendar Expert

zaroth 7y ago

This story has frustrated me from the very first Bezos blog post [1] as a fairly obvious counterintelligence operation. Now a year later the story has resurfaced and it’s all the same conspiracy theories based on nothing. This report demonstrates as clearly as you could hope that there was no real analysis and no real evidence of any of the absolutely extraordinary claims made by Besos and de Becker. [2] From what I can tell, the only reasonable conclusion is that this whole thing was a retaliatory attack on MBS and on AMI. Yet a year later, the news headlines are all parroting that the report proves MBS personally orchestrated this exploit. We are now at the point of theater of the absurd. This story has been a smoldering load of garbage from the very beginning. [3] I can’t believe it keeps coming around. The closest I can find to an honest accounting is this WSJ op-ed [4], which many here won’t like because it ties the totally flawed reporting on this story back to similar flaws in the Russiagate reporting. That is, a story the media wants to be true just a bit too badly. [1] - https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146e3922310f https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146... [2] - https://www.thedailybeast.com/jeff-bezos-investigation-finds-the-saudis-obtained-his-private-information https://www.thedailybeast.com/jeff-bezos-investigation-finds... [3] - https://news.ycombinator.com/item?id=19535965 https://news.ycombinator.com/item?id=19535965 https://news.ycombinator.com/item?id=19539943 https://news.ycombinator.com/item?id=19539943 [4] - https://www.wsj.com/articles/jeff-bezos-tries-to-wag-the-dog-11579909357 https://www.wsj.com/articles/jeff-bezos-tries-to-wag-the-dog...

Natsu 7y ago
The media doesn't shy even from starting wars over this stuff (the gas attacks that weren't in Syria, WMD in Iraq, etc.). Expect them to make many layers of conclusions like this to support some goal in, I dunno, replacing MbS with someone they like better after a while.

alexandercrohde 7y ago

tl; dr: nothing is proven yet in either direction. The report acknowledges "ongoing work" is needed to root the phone. Maybe they should have waited to publish until they did that.

ghostpepper 7y ago

I don't understand why they refer to the list of 192 URLs that all turned out to be legitimate as "IOCs" Why would a device reaching out to bing/wikipedia/medium be considered an indicator of compromise, or even a suspected IOC?

an-allen 7y ago

This report is a pure, unadulterated, dumpster fire. No one is explaining how a video file is a trojan vector. Also this report has way too much background of the “Hacking Team” that really sounds suspect from me. I just feel if you are trying to establish that this vector was the source of a trojan - youd actually prove that instead of giving a page or two of conjecture on where this code that you haven’t shown is malware - came from. Also, obligatory, correlation does not imply causation. This report hinges on the argument that “video received from MBS and shortly thereafter the total data egress increased”. Okay what data was egressed? Where was it egressed to? Just basic things are missing from this report that are relevant. Absolute garbage.

mrobins 7y ago
> Also this report has way too much background of the “Hacking Team” that really sounds suspect from me. Consultants write like high school students with a ten page research paper requirement. If you don’t have real content pad it with extra background, bulleted lists and superfluous tables. The final product needs to be long enough so people think real work was done but boring enough that they don’t actually read it.

Slartie 7y ago

This was really boring from a security or forensics perspective. Nothing really substantial in there. But fortunately there are other angles to view this document from: if this is authentic, it says that the richest man on the entire planet... ...uses a two year old phone. I mean, I like my iPhone X too, but hey, if I had like north of 100 billion dollars, I would certainly spend about 1500 of those dollars for the newest iPhone generation every year (especially if my older generation has an unfixable bootloader bug compromising its entire security architecture). ...exchanges silly meme pictures with ostensibly funny texts with his billionaire friends.

gizmodo59 7y ago
May be he did not find any good reason to upgrade? Sometimes its just not worth the time rather than the money part. I'm sure a lot of people here feel the same even though they have the means to buy one every year.
coolspot 7y ago
Well, at least it is not a Nokia 3310. This is part of his personality, here billionaire Jeff Bezos explaining why he is driving old Honda Accord: https://youtu.be/iJQdj9EhQoQ https://youtu.be/iJQdj9EhQoQ – “It’s perfectly good car”.

ComodoHacker 7y ago

Well, no direct evidence, just co-timed egress data spikes, which no one noticed for 9 months. If there was a hack, it was a pretty successful one.