Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jeff Bezos's phone 'hacked by Saudi crown prince'

theguardian.com

Post reply on HN
Print view View original

121–130 of 327 posts

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#121

Post by Analemma_ »

rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

Within days of their launch, Telegram was discovered to have huge vulnerabilities that resulted from them rolling their own crypto: https://news.ycombinator.com/item?id=6948742, so I'm not sure they should be throwing stones about other people's bugs.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#122

Post by CamperBob2 »

nopriorarrests wrote: post #18
spzb wrote: post #8

Earlier quoted context omitted.

Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

Same reason that putting a bounty on dead rats isn't a good way to get rid of your city's rat infestation.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#124

Post by iudqnolq »

resters wrote: post #112
aodin wrote: post #109

Earlier quoted context omitted.

Are you referring to the data center breaches exposed by the Snowden leaks? Because Google claimed that they were unaware of the breach and quickly took action to correct it [1]. Are you suggesting that Google was complicit? [1] https://www.zdnet.com/article/meet-muscular-nsa-accused-of-t...

I don't think Google has given us any reason to believe that it was not complicit. For instance, why not include warrant canaries on gmail accounts? There is not really any fundamental difference between abetting the data center breach and opting not to offer warrant canaries. Likely tens of thousands of Google users are searched every day due to easy FISC warrants and wide investigative nets. The state sponsored att…

Warrant cannaries are of dubious legality and have yet to be seriously tested in court. It makes total sense that a large company would not adopt something potentially illegal.

A person on StackExchange put it well

> The distinction between revealing the existence of the subpoena by action, rather than by inaction, is a false one. It's exactly the kind of cutesy legal formality that non-lawyers love to rely on, but real judges ignore. If you tell someone: "Hey, you know John Smith's three sons, Joe, Ted, and Bill? Joe and Ted are good people; they have never molested any children. As for Bill--well, I don't have anything to say about Bill." If Bill is not a child molester, you have defamed him, and you are not going to convince a judge otherwise. [1]

Here's how the EFF puts it.

> Are there any cases upholding warrant canaries?

> Not yet. EFF believes that warrant canaries are legal, and the government should not be able to compel a lie. To borrow a phrase from Winston Churchill, no one can guarantee success in litigation, but only deserve it.

I'm also not sure how warrant canaries relate to your parents' point.

[1]: https://law.stackexchange.com/a/333

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#125

Post by swarnie_ »

bb88 wrote: post #27
Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Where's the Feds on this? I don't find it comforting that attacks happening on the US's free press go unanswered by law enforcement. We should be indicting MBS.

Feds? As in US Feds?

Probably arranging another dummy president to fluff Mr. Bone Saw..... Just like the last 25 years.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#126

Post by kunglao »

eljimmy wrote: post #91
rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

Boeing's 737 MAX, despite heavy regulations, designed the software to depend on just one sensor. Didn't put any limit on how far down the plane could be pushed.

These are not any individual who would do deliberately. I bet these conversations go differently for ex need to certain kinds of debugging vs the improbability of actually pulling off an attack or prioritising a release dealing and making a design decision to implement a feature in a specific way which is intended to be updated later on opening up windows for attack. They would genuinely be improbable unless someone knows that they are there and committed enough to try.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#127

Post by tptacek »

iudqnolq wrote: post #114
rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

Pavel Durov also said > The encryption of Signal (=WhatsApp, FB) was funded by the US Government. I predict a backdoor will be found there within 5 years from now. He seems to enjoy throwing out loosly supported accusations. He might be right in some of them, but stopped clocks and so forth. He's also been accused himself of deliberately sabotaging the security of his own encrypted messenger app (Telegram). There's n…

Trevor Perrin and Moxie Marlinspike won the Levchin Prize at Real World Crypto for Signal's cryptography; the Levchin Prize referees are a who's who of academic cryptography, including Dan Boneh, Kenny Paterson, and Nigel Smart; other Levchin winners have included Hugo Krawczyk, Mihir Bellare, and Joan Daemon.

Any suggestion that Telegram's cryptography is somehow comparable owing to "half of them Ph.D's in math", or that Signal's extensively-reviewed cryptography is backdoored, is pretty clearly risible.

OTF, meanwhile, funded basically the whole of the privacy-preserving cryptography field, for years (they may still, for all I know); for many years, they were simply throwing money at privacy projects to hire 3rd party auditors, none of whom were at all affiliated with OTF (how I know this is that we participated). People who claim OTF is somehow a snakey USG backdooring enterprise are saying more about themselves than they are about any kind of sophisticated understanding of how crypto software is built.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#128

Post by trhway »

trianglem wrote: post #98
Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Well yeah, that’s what Bezos has been saying all along.

Wouldn't be surprising if Bezos rolls out Amazon's own messaging platform soon. In some sense Amazon is already half-way of being a social network on its own now - if they add personal feeds and "follow" they would become full blown FB+Instagram+Pinterest and adding messaging would complete the package. "Your margin is my opportunity", and the Zuck's margin is among the largest out there.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#130

Post by amelius »

eatmyshorts wrote: post #88
amelius wrote: post #55

What brand was the phone and OS?

It doesn't matter. The Whatsapp exploit affected both IOS and Android: https://appleinsider.com/articles/19/05/13/whatsapp-vulnerab...

That's interesting. How would that work? Under Android, all apps effectively run inside a Java sandbox, right? So how would the attackers be able to install spyware through Whatsapp?
Post reply on HN