7 ms·

Jeff Bezos, Amazon CEO, got his phone hacked and embarrassing text messages stolen off it from a vulnerability in the video parsing library in WhatsApp in a me

Jeff Bezos, Amazon CEO, got his phone hacked and embarrassing text messages stolen off it from a vulnerability in the video parsing library in WhatsApp in a message sent to him by Saudi Crown Prince Mohammed bin Salman in 2018. So Amazon as a company is now very sensitive to what applications are installed on staff devices and how data on those devices can be extracted from vulnerabilities in other installed apps. This may be an outcome of that. https://www.businessinsider.com/jeff-bezos-phone-hacked-saudi-crown-prince-mbs-whatsapp-report-2020-1 https://www.businessinsider.com/jeff-bezos-phone-hacked-saud...

swyx 6y ago
is the jury still out on whether MBS knowingly sent him that hack? that is, not to put too fine a point on it, a fast path to becoming even more of an international pariah than he already is
- puranjay 6y ago
  I fail to see any situation where MBS would be an international pariah while still controlling Saudi Arabia
- Natsu 6y ago
  The jury is still out on whether there was even a hack to begin with. The analysis team claimed they couldn't decrypt WhatsApp messages, so they never actually analyzed any malware at all. HN called them out on that failure: https://github.com/ddz/whatsapp-media-decrypt https://github.com/ddz/whatsapp-media-decrypt They never responded with an actual malware analysis on the file they claimed might be responsible. The only evidence left after that was a claim of higher data usage which has to be weighed against the alternate explanation for how this got out: https://www.forbes.com/sites/martingiles/2020/01/24/report-bezos-texts-leaked-first-from-his-girlfriend-to-her-brother-according-to-prosecutors/ https://www.forbes.com/sites/martingiles/2020/01/24/report-b...
  - swyx 6y ago
    TIL, thank you. if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.
    - Natsu 6y ago
      You're welcome and I agree, the lack of follow-up after being called out publicly like that is not a good look.
- jessaustin 6y ago
  Tricking a [EDIT: thanks 'spyspy!] WaPo journalist into visiting a consulate and then chopping him into pieces with a saw while he screamed and cursed you? Dropping bombs to kill hundreds of thousands of Yemeni children? Making the people of Saudi Arabia somehow less free? Those things were pretty bad sir! But now you've gone too far! How dare you peep on our first trillionaire while he's courting outside his marriage?!? At long last, have you no shame?!??
  - pc86 6y ago
    > In Comments > Be kind. Don't be snarky...Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - jessaustin 6y ago
      You're going to have to spell this one out for me. To my (admittedly poor) judgment, the above comment does not violate the guidelines. I provide relevant examples of behavior that reasonable people would consider far worse than hacking some rich dude's iPhone.
      - pc86 6y ago
        Sure. To the first point, I think it's pretty evident the comment is snarky (even if it has a good point in there). I'm guilty of that too, more often than I'd like and I do get called out on it occasionally. And I don't think that alone is an excuse to just flippantly toss the guidelines at someone, which admittedly is basically what I did. To the second point, however, I do think you took the worst possible interpretation of swyx's comment, which was basically "nobody cares that the person in question is a murderous tyrant, but he hacked Bezos's phone and so is a bad person now." I don't think that's what he was saying at all, especially given the end about "more than he already is." Whether we like it or not, one of the primary reasons that Saudi Arabia is tolerated in the West is their economic importance, and their connections to the elite, almost entirely because of their wealth. That starts to crack if they go after the elites directly. So I took the comment as basically saying that it didn't seem to serve MBS at all to hack Bezos directly, as it would only (further) delegitimize him interntionally.
tester756 6y ago
>in the image parsing library in WhatsApp in a picture message sent to him by Your link says >Bezos' phone appeared to be infiltrated after he opened a video file sent from the crown prince's number on WhatsApp.
- albatross 6y ago
  A video is a series of pictures, so not "technically" inaccurate...
  - catalogia 6y ago
    A sort of "motion picture" if you will.
RavlaAlvar 6y ago
Does anyone have any technical detail of that story. It is hard to imagine how a bug in the image parse library can be utilise to steal text message.
- shp0ngle 6y ago
  oh bugs in the parsing libraries are the things MOSTLY used for attacks like this. Parsing is hard, and parsers are buggy and lead to all kind of unsafe C code
  - voxic11 6y ago
    Exactly, parsers are complicated, generally involve a lot of manipulation of memory buffers, and for performance reasons are usually written in a language without memory safety (though this is starting to change with languages like https://github.com/p-org/P https://github.com/p-org/P and rust).
- bigtones 6y ago
  Sure, the blog post below covers it, and the vulnerability was probably CVE-2019-11931. You can do an awful lot with a buffer overflow if you're clever. https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsapp-hack-means-for-app-security/ https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsa...
  - sevencolors 6y ago
    Does anyone have a "explain it like I'm 5 but took some CS classes back in college"? I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function. But how do you know what parts will get overwritten? Does that mean the new function can do almost anything?
    - Natsu 6y ago
      There are multiple techniques that might be used (and countermeasures that might have to be bypassed) but these links should get you started - https://stackoverflow.com/questions/14760587/how-does-a-nop-sled-work https://stackoverflow.com/questions/14760587/how-does-a-nop-... https://stackoverflow.com/questions/49620893/return-into-libc-attack https://stackoverflow.com/questions/49620893/return-into-lib... And yes, arbitrary code execution is a common goal of these exploits, though it may not always be possible--sometimes you only get a DoS attack or such.
krm01 6y ago
How about making Whatsapp not permitted on Amazon employee’s phones?
- viklove 6y ago
  How about making Jeff Bezos not permitted on phones with access to Amazon email?
mc32 6y ago
Looks like the DNC is also disallowing the app on their employees’s phones too.[1] Don’t blame them, they don’t want the kind of leaks that happened last cycle. [1] https://www.kdrv.com/content/news/571708792.html https://www.kdrv.com/content/news/571708792.html

swyx 6y ago

is the jury still out on whether MBS knowingly sent him that hack? that is, not to put too fine a point on it, a fast path to becoming even more of an international pariah than he already is

puranjay 6y ago
I fail to see any situation where MBS would be an international pariah while still controlling Saudi Arabia
Natsu 6y ago
The jury is still out on whether there was even a hack to begin with. The analysis team claimed they couldn't decrypt WhatsApp messages, so they never actually analyzed any malware at all. HN called them out on that failure: https://github.com/ddz/whatsapp-media-decrypt https://github.com/ddz/whatsapp-media-decrypt They never responded with an actual malware analysis on the file they claimed might be responsible. The only evidence left after that was a claim of higher data usage which has to be weighed against the alternate explanation for how this got out: https://www.forbes.com/sites/martingiles/2020/01/24/report-bezos-texts-leaked-first-from-his-girlfriend-to-her-brother-according-to-prosecutors/ https://www.forbes.com/sites/martingiles/2020/01/24/report-b...
- swyx 6y ago
  TIL, thank you. if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.
  - Natsu 6y ago
    You're welcome and I agree, the lack of follow-up after being called out publicly like that is not a good look.
jessaustin 6y ago
Tricking a [EDIT: thanks 'spyspy!] WaPo journalist into visiting a consulate and then chopping him into pieces with a saw while he screamed and cursed you? Dropping bombs to kill hundreds of thousands of Yemeni children? Making the people of Saudi Arabia somehow less free? Those things were pretty bad sir! But now you've gone too far! How dare you peep on our first trillionaire while he's courting outside his marriage?!? At long last, have you no shame?!??
- pc86 6y ago
  > In Comments > Be kind. Don't be snarky...Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - jessaustin 6y ago
    You're going to have to spell this one out for me. To my (admittedly poor) judgment, the above comment does not violate the guidelines. I provide relevant examples of behavior that reasonable people would consider far worse than hacking some rich dude's iPhone.
    - pc86 6y ago
      Sure. To the first point, I think it's pretty evident the comment is snarky (even if it has a good point in there). I'm guilty of that too, more often than I'd like and I do get called out on it occasionally. And I don't think that alone is an excuse to just flippantly toss the guidelines at someone, which admittedly is basically what I did. To the second point, however, I do think you took the worst possible interpretation of swyx's comment, which was basically "nobody cares that the person in question is a murderous tyrant, but he hacked Bezos's phone and so is a bad person now." I don't think that's what he was saying at all, especially given the end about "more than he already is." Whether we like it or not, one of the primary reasons that Saudi Arabia is tolerated in the West is their economic importance, and their connections to the elite, almost entirely because of their wealth. That starts to crack if they go after the elites directly. So I took the comment as basically saying that it didn't seem to serve MBS at all to hack Bezos directly, as it would only (further) delegitimize him interntionally.

tester756 6y ago

>in the image parsing library in WhatsApp in a picture message sent to him by Your link says >Bezos' phone appeared to be infiltrated after he opened a video file sent from the crown prince's number on WhatsApp.

albatross 6y ago
A video is a series of pictures, so not "technically" inaccurate...
- catalogia 6y ago
  A sort of "motion picture" if you will.

RavlaAlvar 6y ago

Does anyone have any technical detail of that story. It is hard to imagine how a bug in the image parse library can be utilise to steal text message.

shp0ngle 6y ago
oh bugs in the parsing libraries are the things MOSTLY used for attacks like this. Parsing is hard, and parsers are buggy and lead to all kind of unsafe C code
- voxic11 6y ago
  Exactly, parsers are complicated, generally involve a lot of manipulation of memory buffers, and for performance reasons are usually written in a language without memory safety (though this is starting to change with languages like https://github.com/p-org/P https://github.com/p-org/P and rust).
bigtones 6y ago
Sure, the blog post below covers it, and the vulnerability was probably CVE-2019-11931. You can do an awful lot with a buffer overflow if you're clever. https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsapp-hack-means-for-app-security/ https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsa...
- sevencolors 6y ago
  Does anyone have a "explain it like I'm 5 but took some CS classes back in college"? I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function. But how do you know what parts will get overwritten? Does that mean the new function can do almost anything?
  - Natsu 6y ago
    There are multiple techniques that might be used (and countermeasures that might have to be bypassed) but these links should get you started - https://stackoverflow.com/questions/14760587/how-does-a-nop-sled-work https://stackoverflow.com/questions/14760587/how-does-a-nop-... https://stackoverflow.com/questions/49620893/return-into-libc-attack https://stackoverflow.com/questions/49620893/return-into-lib... And yes, arbitrary code execution is a common goal of these exploits, though it may not always be possible--sometimes you only get a DoS attack or such.

krm01 6y ago

How about making Whatsapp not permitted on Amazon employee’s phones?

viklove 6y ago
How about making Jeff Bezos not permitted on phones with access to Amazon email?

mc32 6y ago

Looks like the DNC is also disallowing the app on their employees’s phones too.[1] Don’t blame them, they don’t want the kind of leaks that happened last cycle. [1] https://www.kdrv.com/content/news/571708792.html https://www.kdrv.com/content/news/571708792.html