Jeff Bezos's phone 'hacked by Saudi crown prince' • Hacker News Board

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#251

Post by novaRom » Wed, Jan 22, 2020, 10:03 AM UTC

WilTimSon wrote: post #71

tasssko wrote: post #58

Is it that easy to be hacked with WhatsApp?

Well, here's a list of known WhatsApp hacks that were revealed in 2019: Call hack [0]: https://www.wired.com/story/whatsapp-hack-phone-call-voip-bu... Video hack [1]: https://thehackernews.com/2019/11/whatsapp-hacking-vulnerabi... GIF hack [2]: https://thehackernews.com/2019/10/whatsapp-rce-vulnerability... That call hack was famously used by NSO, hitting thousands of people [3]: https://thehackernews.com/2019/10/wha…

These are not hacks, it's called "Backdoor". There are probably tons more hidden backdoors left, we can only speculate. WhatsApp is a private non-open source project.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#252

Post by newscracker » Wed, Jan 22, 2020, 10:11 AM UTC

jek0 wrote: post #241

ShorsHammer wrote: post #170

Earlier quoted context omitted.

Its default settings are nothing to be desired from a messenger app. And for the paltry $200k they are offering for breaking it I'd bet you could find a magnitude more with little effort on the grey markets. But no, absolutely no proof the underlying crypto has been broken. It doesn't need to be when government requests for data stored on their servers does more than enough.

AFAIK, Telegram's private conversations are encrypted with private keys stored on device _only_ (not on the server). At least it's what they claim. If true, government requests for data stored on servers are probably not enough.

The secret chats are indeed end to end encrypted, but they have some important exclusions and limitations:

* Group chats can only use the default encryption, not end to end encryption.

* The end to end encrypted chats are tied to a single device, and there's no sync across devices (in contrast, all chats on Wire are end to end encrypted and sync across devices within a limited time period).

The default use cases of almost all users has the chat messages stored in plain text on the Telegram servers. This is one of the reasons search (done on the server side) is quite fast on Telegram.

P.S.: Despite these limitations, I prefer Telegram for its superior UX and for not having metadata shared with Facebook. My wish is that someday Telegram makes E2E the default everywhere.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#253

Post by newscracker » Wed, Jan 22, 2020, 10:15 AM UTC

PlasticTank wrote: post #180

vunie wrote: post #161

Earlier quoted context omitted.

Has there been any weakness found in Telegram's encryption?

I don't know of any directly related to it's encryption but multiple protest organizers were identified and arrested by the Hong Kong Police Force through Telegram, I'm not 100% sure but I believe they just added lists of suspected phone numbers onto their phones and looked in Telegram see which one's matched to Group admins.

What happened in Hong Kong was that the authorities created Telegram accounts and added thousands of phone numbers to their contact lists. From that, they got to know which numbers are using Telegram and then were able to do some more tracing. This flaw exists in WhatsApp and Signal too, where anyone who has your number in their contacts list (though you may not have their number in your contacts) will know the moment you join those platforms and will be able to see you on it.

When this design flaw came to be known, Telegram released a newer version where the user has more control on who can know that they're on Telegram. With that change, even if you had someone's number in your contacts list, you wouldn't know if/when they join/are available on Telegram unless they choose to make themselves visible.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#254

Post by newscracker » Wed, Jan 22, 2020, 10:16 AM UTC

PlasticTank wrote: post #228

Polylactic_acid wrote: post #206

Earlier quoted context omitted.

That theory is quite possible. If the police join the group, they know the usernames of all of the people in the group, they can then start adding numbers to their contacts and if any of the usernames from the group show up they can then look up who owns the phone number in the government database.

It surprises me that they don't require both of you to have each others phone numbers in your contacts lists before giving away identifiable information.

Telegram released a new version with that exact same requirement to enable visibility. The settings in Telegram have also been expanded for this. On the other hand, this same vulnerability exists (and continues to exist) in WhatsApp and Signal.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#255

Post by Scapeghost » Wed, Jan 22, 2020, 10:43 AM UTC

rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

> WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies.

This has been obvious in places like the United Arab Emirates (aka Dubai) where services like FaceTime etc. (sometimes even voice chat in games) are blocked by the government but they allow WhatsApp (but not WhatsApp voice calls).

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#256

Post by cies » Wed, Jan 22, 2020, 10:50 AM UTC

jchw wrote: post #250

cies wrote: post #249

Earlier quoted context omitted.

EDIT: Was under the impression Telegram served closed source clients. Turns out it does not. I stand corrected. OLD COMMENT: E2e using a client that is not opensource (on a system that is not trusted) is not helping much. E2e where the server is not open source should be okay, because the server-end can only snoop on some meta data (how much, when, what IP, chunk sizes, etc.) but not the content.

The Telegram clients are open source.

oops. i'll fix it. tnx for pointing out.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#257

Post by conston » Wed, Jan 22, 2020, 10:50 AM UTC

This is why for the past 7 years I have rejected any files sent to me, and insist on receiving cloud links such as google, dropbox etc.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#258

Post by ryanlol » Wed, Jan 22, 2020, 11:14 AM UTC

rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

Pavel Durov also shipped what looks very much like a intentional backdoor in Telegram https://m.habr.com/en/post/206900/

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#259

Post by ryanlol » Wed, Jan 22, 2020, 11:18 AM UTC

ta999999171 wrote: post #204

Analemma_ wrote: post #121

Earlier quoted context omitted.

Within days of their launch, Telegram was discovered to have huge vulnerabilities that resulted from them rolling their own crypto: https://news.ycombinator.com/item?id=6948742 , so I'm not sure they should be throwing stones about other people's bugs.

I don't even have to open the link to know those are still theoretical vulns at best...because as far as I know, there has been no successful implementation of them.

You’re full of shit. There’s nothing theoretical about that vulnerability (almost certainly a deliberately planted backdoor), it allows the Telegram servers to selectively MITM private chats.

> there has been no successful implementation of them.

What does this even mean? Only Telegram can perform this active attack, obviously you haven’t seen it implemented.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#260

Post by ryanlol » Wed, Jan 22, 2020, 11:21 AM UTC

Scapeghost wrote: post #255

rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

> WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. This has been obvious in places like the United Arab Emirates (aka Dubai) where services like FaceTime etc. (sometimes even voice chat in games) are blocked by the government but they allow WhatsApp (but not WhatsApp voice calls).

Not really, Dubai blocks VOIP because phone carriers lobbied for that. This has the added benefit of forcing people to make insecure, easy to intercept, regular phone calls.