Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jeff Bezos's phone 'hacked by Saudi crown prince'

theguardian.com

Post reply on HN
Print view View original

101–110 of 327 posts

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#101

Post by rtkwe »

eljimmy wrote: post #91
rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

My first pass at a way would have some point in the code where various hooks can be triggered for a feature like downloading a file under the guise of creating previews of various types of files and simply have the production build sent to the Google Play store include an additional small plugin that looks for a specific header and then hands over the keys to the kingdom to whatever payload it finds. It's simple and there's generally a very small portion of people looking at the disassembled code from the Play Store. You could even have it produce two versions one for any internal testing on the live version and one with the small backdoor plugin.

Doing it this way you only really have to control a core part of the release team to hide the slight of hand between the published version and the clean 'published' version.

Alternatively just bury the same thing deep in the codebase using techniques like people use for the Obfuscated C competition every year. Any changes could be delayed/deprioritized/handled by a team in the know about the backdoor.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#102

Post by rconti »

kryogen1c wrote: post #92
davidw wrote: post #67

Earlier quoted context omitted.

All the facts above are correct. The opinion at the end seems pretty reasonable given things like this: https://www.theverge.com/2018/4/14/17233680/trump-amazon-bez...

[flagged]

Which is it? Is "fake news" a dangerous sentiment, or do journalists actually get the facts wrong more often than they get them right?

Do journalists try to get the facts correct? When they get them wrong, do they issue retractions? Or do they not?

Do you think you can draw an equivalency between their accuracy and the President's relationship with the truth?

This is not the same as saying "TV is bad for you, mmkay?" This is about actual journalism, which may take place in newspapers or on television.

You're treading on dangerous false equivalency here. I get that it's hip to say "the mainstream media gets it wrong all the time, amirite" in lieu of having an actual nuanced opinion, but I certainly don't think it's remotely accurate.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#103

Post by ehsankia »

slg wrote: post #37
Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

That was what Bezos's camp has been saying from almost the very beginning. The news here isn't the suspected involvement of the Saudis, the news is that MBS is directly implicated.

And more specifically the potential exploit / vector used.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#104

Post by empath75 »

mirimir wrote: post #66

OK, so I'm just a random anonymous coward. And arguably obsessed with my hobby. But I'm puzzled that Bezos would be corresponding with MBS on the same device that he uses for potentially embarrassing personal stuff. Isn't that just a totally obvious OPSEC fail? Edit: But that's what he did, isn't it? And how could that be considered safe?

Sure. Maybe he wasn’t super worried about getting caught cheating on his wife. A few billion dollars pays for a lot of alimony and lawyers.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#105

Post by ghostpepper »

resters wrote: post #93
eljimmy wrote: post #91

Earlier quoted context omitted.

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data center breach and likely many other cases. At WhatsApp/Google scale the attack is extremely cost effective.

Can you elaborate on the google data center breach? Are you saying it was orchestrated by google?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#106

Post by [deleted] »

resters wrote: post #93
eljimmy wrote: post #91

Earlier quoted context omitted.

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data center breach and likely many other cases. At WhatsApp/Google scale the attack is extremely cost effective.

[deleted]

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#107

Post by tmpz22 »

rtkwe wrote: post #101
eljimmy wrote: post #91

Earlier quoted context omitted.

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

My first pass at a way would have some point in the code where various hooks can be triggered for a feature like downloading a file under the guise of creating previews of various types of files and simply have the production build sent to the Google Play store include an additional small plugin that looks for a specific header and then hands over the keys to the kingdom to whatever payload it finds. It's simple and…

Its probably easier to just bribe/compromise the on-site DBA who has access to the physical hardware. Dump the raw data and decrypt/analyze it offsite.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#108

Post by ehsankia »

trianglem wrote: post #98
Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Well yeah, that’s what Bezos has been saying all along.

The headline is not that interesting, but the bigger news here is the vector used (WhatsApp, Pegasus), and how the exploit message was sent directly from MBS' number soon after they shared contact information.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#109

Post by aodin »

resters wrote: post #93
eljimmy wrote: post #91

Earlier quoted context omitted.

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data center breach and likely many other cases. At WhatsApp/Google scale the attack is extremely cost effective.

Are you referring to the data center breaches exposed by the Snowden leaks? Because Google claimed that they were unaware of the breach and quickly took action to correct it [1]. Are you suggesting that Google was complicit?

[1] https://www.zdnet.com/article/meet-muscular-nsa-accused-of-t...

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#110

Post by sn41 »

clubm8 wrote: post #15

I wonder how often less high profile folks get hit with stuff like this? On one hand, zero days are rare and expensive. OTOH someone who isn't the CEO of a major company might not notice the malware, or if they do, not know they should forward it to an organization like Citizen Lab.

If you aren't a high profile target, you may not be worthy of being targeted specifically. Of course, as in the Ashley Madison and Equifax cases, you might be compromised along with thousands of others.

Zero days are expensive for individuals and small companies, but what happens when state actors are involved?

Post reply on HN