Jeff Bezos's phone 'hacked by Saudi crown prince' • Hacker News Board

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#281

Post by dmamills » Wed, Jan 22, 2020, 3:24 PM UTC

nsajko wrote: post #274

krn wrote: post #244

I pointed this out 11 months ago: https://news.ycombinator.com/item?id=19122206

Some informative links to make you scared about democracy, or just your safety: https://en.wikipedia.org/wiki/Pegasus_(spyware) https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-n... https://citizenlab.ca/2018/06/government-spyware-surveillanc... https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware... https://citizenlab.ca/

Why are these down voted? I'd say these Citizen Lab reports are HIGHLY relevant to this discussion topic.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#282

Post by koheripbal » Wed, Jan 22, 2020, 3:26 PM UTC

bb88 wrote: post #27

Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Where's the Feds on this? I don't find it comforting that attacks happening on the US's free press go unanswered by law enforcement. We should be indicting MBS.

When a foreign government does something, the legal system is not the appropriate mechanism to enforce international norms.

It lacks both jurisdiction as well as enforceability.

There is no global legal system. We are not a united planet.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#283

Post by tw04 » Wed, Jan 22, 2020, 3:35 PM UTC

lawnchair_larry wrote: post #84

tw04 wrote: post #69

Earlier quoted context omitted.

Great theory, except for the fact David Pecker was directly involved and more or less admitted it was a favor for Trump which he had been doing for decades.

What weight does that hold when MBS actually killed the WaPo journalist? The proof is right in front of us.

What are you talking about? Nobody is refuting that MBS killed Kashoggi. What I'm refuting is that the Bezos hack wasn't a favor to Trump. It clearly was.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#284

Post by patja » Wed, Jan 22, 2020, 4:01 PM UTC

Last time I stayed at an AirBnb in Prague, the owners preferred method of communication was WhatsApp. When I went to install it I was confronted with no other choice than allowing it to import all my contacts, even though there was only one person I wanted to communicate with.

I was aware of these vulnerabilities and generally am protective of handing out PII, especially information others have entrusted to me. So I didn't give it access to hundreds of business and personal contacts spanning decades of work and life.

How do others deal with this who perhaps don't have the choice to just say "I'm going to text you instead for the 4 days we are going to have a need to communicate"? Do you keep a full set of contact data outside your phone's contacts for information you don't want shared? Private and public contacts?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#285

Post by nlh » Wed, Jan 22, 2020, 4:05 PM UTC

Apparently I’m the only person on earth who wants to know what kind of phone Bezos was using, which OS version, etc. It seems like this detail is conveniently being left out of every story.

Anyone have any additional details? I understand that it was a WhatsApp vulnerability (Pegasus?) but I’d still like to know more about the device.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#286

Post by eeZah7Ux » Wed, Jan 22, 2020, 4:06 PM UTC

kevml wrote: post #183

eeZah7Ux wrote: post #158

Earlier quoted context omitted.

It's very easy: hire more developers than security engineers. Vulnerabilities will appear and be discovered by the security analysts in your government. Whey they suspect other countries have the same 0days they'll notify you of it and you fix it.

What if I hire 20 mediocre security engineers and 1 malicious product engineer? This argument can go both ways...

What argument? What's your point?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#287

Post by lowdose » Wed, Jan 22, 2020, 4:08 PM UTC

Erlich_Bachman wrote: post #266

wruza wrote: post #215

Earlier quoted context omitted.

Meanwhile, whatsapp still not blocked in Russia and there is no good explanation for that besides: So far, Roskomnadzor has "no urgent request" to include Viber and WhatsApp messengers in the register of organizers and distributors of information. According to Interfax, this was stated by the head of the Department, Alexander Zharov. He was asked when these companies will be included in the register. "We had a stormy…

If you know some basic things about Russian government, this can easily be explained by the fact that policy makers are very inefficient, incompetent in technical matters and more often than not decisions are very poorly researched. Just look at the fact that Telegram still works everywhere or the way that even the supposedly most secret russian organization (the secret military police GRU) have handled the poisoning…

On the other hand it could also be done on purpose in both cases you mention. Deliberately showing incompetence of your digital capabilities is a very efficient way of counter intelligence. The Skripal case was and is a very effective way for the Kremlin to spread fear. Vladimir Putin was most important person of the year for 5 years at Fortune while controlling a GDP of Italy. Vladimir Putin is maximizing the resources he has in a very good way irrespectively what one thinks about his actions and consequences specifically. As long as most people think incompetence every investment he makes will have a significant better outcome.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#288

Post by ghostpepper » Wed, Jan 22, 2020, 4:14 PM UTC

londons_explore wrote: post #240

ghostpepper wrote: post #212

Earlier quoted context omitted.

Is there any C in WhatsApp?

Yes - all the media decoders are in C

Cool, that actually does sound like a rather large attack surface for an innocent-looking attachment to wind up executing code

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#289

Post by [deleted] » Wed, Jan 22, 2020, 4:23 PM UTC

tptacek wrote: post #127

iudqnolq wrote: post #114

Earlier quoted context omitted.

Pavel Durov also said > The encryption of Signal (=WhatsApp, FB) was funded by the US Government. I predict a backdoor will be found there within 5 years from now. He seems to enjoy throwing out loosly supported accusations. He might be right in some of them, but stopped clocks and so forth. He's also been accused himself of deliberately sabotaging the security of his own encrypted messenger app (Telegram). There's n…

Trevor Perrin and Moxie Marlinspike won the Levchin Prize at Real World Crypto for Signal's cryptography; the Levchin Prize referees are a who's who of academic cryptography, including Dan Boneh, Kenny Paterson, and Nigel Smart; other Levchin winners have included Hugo Krawczyk, Mihir Bellare, and Joan Daemon. Any suggestion that Telegram's cryptography is somehow comparable owing to "half of them Ph.D's in math", or…

[deleted]

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#290

Post by bitL » Wed, Jan 22, 2020, 4:26 PM UTC

tptacek wrote: post #127

iudqnolq wrote: post #114

Earlier quoted context omitted.

Pavel Durov also said > The encryption of Signal (=WhatsApp, FB) was funded by the US Government. I predict a backdoor will be found there within 5 years from now. He seems to enjoy throwing out loosly supported accusations. He might be right in some of them, but stopped clocks and so forth. He's also been accused himself of deliberately sabotaging the security of his own encrypted messenger app (Telegram). There's n…

Trevor Perrin and Moxie Marlinspike won the Levchin Prize at Real World Crypto for Signal's cryptography; the Levchin Prize referees are a who's who of academic cryptography, including Dan Boneh, Kenny Paterson, and Nigel Smart; other Levchin winners have included Hugo Krawczyk, Mihir Bellare, and Joan Daemon. Any suggestion that Telegram's cryptography is somehow comparable owing to "half of them Ph.D's in math", or…

Signal protocol might be airtight but nobody knows if any part of an app that is built on top of it doesn't leak keys somewhere in the pipeline. All crypto protocols work under certain assumptions and no protocol is 100% secure from all possible misuses when Mallory owns certain portions of infrastructure.