Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jeff Bezos's phone 'hacked by Saudi crown prince'

theguardian.com

Post reply on HN
Print view View original

131–140 of 327 posts

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#131

Post by resters »

iudqnolq wrote: post #124
resters wrote: post #112

Earlier quoted context omitted.

I don't think Google has given us any reason to believe that it was not complicit. For instance, why not include warrant canaries on gmail accounts? There is not really any fundamental difference between abetting the data center breach and opting not to offer warrant canaries. Likely tens of thousands of Google users are searched every day due to easy FISC warrants and wide investigative nets. The state sponsored att…

Warrant cannaries are of dubious legality and have yet to be seriously tested in court. It makes total sense that a large company would not adopt something potentially illegal. A person on StackExchange put it well > The distinction between revealing the existence of the subpoena by action, rather than by inaction, is a false one. It's exactly the kind of cutesy legal formality that non-lawyers love to rely on, but r…

Your comment reinforces my point. Google would be extremely reluctant to utilize warrant canaries because of the uncertain legal consequences of doing so.

The same applies to declining to cooperate with government surveillance operations. We don't really know how the government likes it when a big company obstructs its surveillance goals.

On HN today was a headline about Apple reversing course on a business decision voluntarily, simply to please government.

> I'm also not sure how warrant canaries relate to your parents' point.

The points above I believe link the two business decisions.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#132

Post by peteretep »

kryogen1c wrote: post #92
davidw wrote: post #67

Earlier quoted context omitted.

All the facts above are correct. The opinion at the end seems pretty reasonable given things like this: https://www.theverge.com/2018/4/14/17233680/trump-amazon-bez...

[flagged]

> ive never even heard that word before

I'm not sure an argument from ignorance is the best logical fallacy to defend Trump

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#133

Post by Marsymars »

Nextgrid wrote: post #10
shyn3 wrote: post #6

Earlier quoted context omitted.

My guess is this gave them the ability to access anything WhatsApp could access with a code bug in the application and so maybe a Facebook issue more than an Apple issue.

If WhatsApp was given photo library access (which isn't unlikely considering you need it to send previously taken photos) then the exploit could access all his photos without a vulnerability on Apple's part.

> which isn't unlikely considering you need it to send previously taken photos

To be clear for anyone else reading, photo library access is required to browse the photo library from within WhatsApp, it's not required to share arbitrary photos to WhatsApp from the photo app via the OS's built-in share feature.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#134

Post by peteretep »

IfOnlyYouKnew wrote: post #17
Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

I guess Khashoggi must have really annoyed MBS. This has now cost the Saudis at least ten times as much goodwill as all anti-Saudi editorials in the Post and everywhere else together. That, or it was a favour to MBS American friends. The other people involved (David Pecker et al) and MBS do share a few friends in the White House, who also seem obsessed with the Washington Post and Bezos himself.

> I guess Khashoggi must have really annoyed MBS

Or MBS massively miscalculated. I can't imagine being Lord Emperor gives you many opportunities for people to tell you you're wrong about stuff

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#135

Post by peteretep »

amelius wrote: post #130
eatmyshorts wrote: post #88

Earlier quoted context omitted.

It doesn't matter. The Whatsapp exploit affected both IOS and Android: https://appleinsider.com/articles/19/05/13/whatsapp-vulnerab...

That's interesting. How would that work? Under Android, all apps effectively run inside a Java sandbox, right? So how would the attackers be able to install spyware through Whatsapp?

I may well be proven wrong by further revelations, but:

> Large amounts of data were exfiltrated from Bezos’s phone within hours

I could see a cross-platform WhatsApp message that leaked WhatsApp data?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#136

Post by asdfasgasdgasdg »

Arelius wrote: post #117
eljimmy wrote: post #91

Earlier quoted context omitted.

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

As an engineer that has basic permissions to our build and deployment system (unrelated non communication application) I could pretty easily think of multiple steps in the build where I could inject and link in pretty much arbitrary code. For instance, anything that can hook directly on a build machine, or artifact upload, or even just simply precompiled into one of the black-box 3rd party dependencies that basically…

Is the "our" you're referring to Whatsapp? If not, then I'm not sure how much we can derive from your experience. There are places that take build and deployment security much more seriously than what you're describing.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#137

Post by onlyrealcuzzo »

jessaustin wrote: post #73
victords wrote: post #59

Earlier quoted context omitted.

By that logic, nobody should care about the Khashoggi killing as well.

I don't agree that hacking an app and murder are the same. The state obviously has an interest in preventing murder.

But it doesn't have an interest in protecting your other rights? Interesting.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#138

Post by sangnoir »

rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

It's not as if non-WhatsApp zero-days are hard to come by for nation-states. If it wasn't a video shared by WhatsApp, it was going to be an iMessage text PDF appearing to be from one of his assistant's email. I don't think governments need to author vulnerable software: they can outsource that to the private sector for $0 by doing nothing and decompiling/fuzzing/analyzing whatever comes out.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#139

Post by iron0013 »

joe_the_user wrote: post #90
mirimir wrote: post #81

Earlier quoted context omitted.

I guess. But even before the Khashoggi assassination, MBS was arguably an obvious threat. I can't imagine considering him a "friend". I mean, I'd be gobsmacked if he mixed personal and business on the same devices. That could be disastrous, not just embarrassing. So a third device category doesn't seem unworkable. Edit: Also, wouldn't someone like Bezos have security advisers? And how could they have failed to warn h…

This reminds me of the way that Barrack Obama tried to keep his personal cellphone once he became president. Having a personal relationship with the wealthy and powerful is a unique thing since these are the ultimate decision makers. I would guess that Bezos or anyone like him chats frequently with very powerful people and that this is factor in him maintaining his own power and influence. And mobile devices would se…

I shudder to think what would have happened if Obama had ultimately refused to give up his personal phone, and every half-talented hacking group on the planet had pwned it six ways from Sunday—what a national security disaster that would have been! Oh wait

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#140

Post by [deleted] »

iudqnolq wrote: post #114
rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

Pavel Durov also said > The encryption of Signal (=WhatsApp, FB) was funded by the US Government. I predict a backdoor will be found there within 5 years from now. He seems to enjoy throwing out loosly supported accusations. He might be right in some of them, but stopped clocks and so forth. He's also been accused himself of deliberately sabotaging the security of his own encrypted messenger app (Telegram). There's n…

[deleted]
Post reply on HN