Jeff Bezos's phone 'hacked by Saudi crown prince' • Hacker News Board

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#21

Post by icandoit » Tue, Jan 21, 2020, 10:02 PM UTC

nopriorarrests wrote: post #18

spzb wrote: post #8

Earlier quoted context omitted.

Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

I would like to see bounties offered no questioned asked too.

That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#22

Post by fooey » Tue, Jan 21, 2020, 10:04 PM UTC

nopriorarrests wrote: post #18

spzb wrote: post #8

Earlier quoted context omitted.

Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

It's not worth anything like $100m to facebook.

They pay barely enough to say they're willing to pay, but they don't really care.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#23

Post by jessaustin » Tue, Jan 21, 2020, 10:06 PM UTC

saberience wrote: post #2

Let's assume this is how Bezos's phone was hacked for a second, does anyone think Trump would do anything about it? Sanction Saudia Arabia? Trump didn't lift a finger after the Jamal Khashoggi killing and his son-in-law is deep in various business dealings with MBS and his goons. Hell, Trump is probably happy the Saudis are hacking the phone of his perceived "enemy".

Is this something a President or anyone in government employ should care about? A private citizen using a commercial app on a private phone granted that app some permissions he later regretted. Why should USA taxpayers care about that?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#24

Post by lawnchair_larry » Tue, Jan 21, 2020, 10:07 PM UTC

This sounded plausible until I read the first sentence. Why would MBS be the one executing the attack, and using his personal account to do it?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#25

Post by dickjocke » Tue, Jan 21, 2020, 10:09 PM UTC

nopriorarrests wrote: post #18

spzb wrote: post #8

Earlier quoted context omitted.

Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. I think the problem is these 0 days are worth more to bad actors than the bad press costs companies.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#26

Post by nopriorarrests » Tue, Jan 21, 2020, 10:09 PM UTC

icandoit wrote: post #21

nopriorarrests wrote: post #18

Earlier quoted context omitted.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.

Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#27

Post by bb88 » Tue, Jan 21, 2020, 10:09 PM UTC

Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Where's the Feds on this? I don't find it comforting that attacks happening on the US's free press go unanswered by law enforcement.

We should be indicting MBS.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#28

Post by notadoc » Tue, Jan 21, 2020, 10:14 PM UTC

lawnchair_larry wrote: post #24

This sounded plausible until I read the first sentence. Why would MBS be the one executing the attack, and using his personal account to do it?

Presumably because the attacker(s) assumption was that Bezos would open a message coming directly from someone he trusted and had direct communication with, in this case being MBS?

That brings a lot more questions though; who actually sent the message? Was it a man-in-the-middle situation? Was MBS's WhatsApp account compromised? Did someone else use MBS physical phone to do this? Was it a third party?

Interesting and strange story all around.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#29

Post by nopriorarrests » Tue, Jan 21, 2020, 10:14 PM UTC

dickjocke wrote: post #25

nopriorarrests wrote: post #18

Earlier quoted context omitted.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. I think the problem is these 0 days are worth more to bad actors than the bad press costs companies.

>I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch.

Depends on your personal risk profile, I guess. If I was a highly professional security researcher (one can dream!), the one can find 0 day RCE in whatsapp, well, I would happily accept 10-20M bounty from FB and retire for life, instead of bargaining with wealthy monarch and accepting non-trivial risk of being dismembered with some blunt tools in embassy of Turkey or somewhere else.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#30

Post by notadoc » Tue, Jan 21, 2020, 10:15 PM UTC

Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Or someone/group/agency who was able to compromise MBS phone or WhatsApp account.

There are a lot of possibilities here, what a wild story.