Live data from Hacker News

Jeff Bezos's phone 'hacked by Saudi crown prince'

theguardian.com

301–310 of 327 posts

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#301

Earlier quoted context omitted.

Not orchestrated, but happily tolerated. All Google needs is to be able to plausibly deny complicity, but the other practices of Google (such as not offering warrant canaries on all Google accounts) indicate that Google is eager to cooperate and please governments, so it would have been easy to leave a few doors unlocked, hire a plant (with solid itsec skills), etc.

I was at Google at the time of the Snowden disclosures. People there were furious , and encrypting internal traffic became a top priority immediately afterwards.

Of course. That is the correct response once the attack is known. To most people, unencrypted traffic vs encrypted traffic seems like an obvious security oversight, but many others exist that are not so stark and obvious sounding.

My point is that all indications point to Google being unbelievably cooperative with the US Government, essentially allowing whatever legal or extralegal (per Snowden) back doors were requested.

It is not much of a leap to conclude that Google was both aware and cooperative with the harvesting of unencrypted traffic. This does not mean that all employees were aware of it.

The analysis should be to discover how few employees would have had to be complicit for the attack to be carried out successfully.

There is no way that such an attack would succeed if too many were aware, since it is obviously in the extralegal (Snowden revelation) category, and since most Google employees are ethical humans, it would have provoked outrage if widely known.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#302
post #296

Earlier quoted context omitted.

Of course they do. Reading bytecode is not much harder than reading source. Even reading decompiled binaries isn’t so hard. There is zero compelling reason to believe that signal is uniquely flawed.

Outside Signal app, if e.g. I incorporate the protocol to my own app via the provided source code, am I prevented from leaking keys?

Exactly what is your point? Durov is talking about Signal, not some hypothetical application you came up with to leak keys.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#303

Earlier quoted context omitted.

If you know some basic things about Russian government, this can easily be explained by the fact that policy makers are very inefficient, incompetent in technical matters and more often than not decisions are very poorly researched. Just look at the fact that Telegram still works everywhere or the way that even the supposedly most secret russian organization (the secret military police GRU) have handled the poisoning…

On the other hand it could also be done on purpose in both cases you mention. Deliberately showing incompetence of your digital capabilities is a very efficient way of counter intelligence. The Skripal case was and is a very effective way for the Kremlin to spread fear. Vladimir Putin was most important person of the year for 5 years at Fortune while controlling a GDP of Italy. Vladimir Putin is maximizing the resour…

Well that is certainly a valid theory. Although I have a hard time believing that you have lived any long time in Russia recently or followed closely on the developments, because most people that do would not entertain that theory for more than a minute because it's quite clear that the level of incompetency and corruption in the government is insane. Putin sure has a lot of power, but it does not come from technical prowess or IT/infosec departments, it comes from sheer corruption and what is basically a military dictatorship structure of the country, where he is the one that has and is appointing most "friends" in/to the right places.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#304

Earlier quoted context omitted.

Pavel Durov also said > The encryption of Signal (=WhatsApp, FB) was funded by the US Government. I predict a backdoor will be found there within 5 years from now. He seems to enjoy throwing out loosly supported accusations. He might be right in some of them, but stopped clocks and so forth. He's also been accused himself of deliberately sabotaging the security of his own encrypted messenger app (Telegram). There's n…

It is spelled "Tor". https://support.torproject.org/about/why-is-it-called-tor/ Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.

I think a lot of people think "TOR" (myself included) because they think "The Onion Router" and acronyms are capitalized. I'm willing to forgive people for making the mistake of following conventional patterns in English.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#305
post #300

Don't deal with the Saudis. History will look back on you the same way it looks back on people shaking hands with Hitler. I'm not kidding.

The US is the world's largest weapons exporter and Saudi Arabia is the world's largest weapon importer. I'm not sure even a Hitler level calamity would make the US stop dealing with them. They're holding their hands and complementing their "leadership skills" ffs...

I think the oil will run out (or we'll transition to other energy sources), then Saudi will just wither and the special relationship will disappear.

But yeah, it won't end because of morality.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#306
post #66

OK, so I'm just a random anonymous coward. And arguably obsessed with my hobby. But I'm puzzled that Bezos would be corresponding with MBS on the same device that he uses for potentially embarrassing personal stuff. Isn't that just a totally obvious OPSEC fail? Edit: But that's what he did, isn't it? And how could that be considered safe?

I think this a good question. The problem is that even the head of a ginormous company with a strong connection to computer security generally (through AWS) is going to take actions based on convenience rather than OPSEC discipline. I think it's natural for any given human to chat with all one's friend on the same level, with the same device and so-forth. A given individual can train themselves to have hard walls in…

Most given humans haven't hired high-price security consultants to audit their lives and establish protocols to lower vulnerabilities.

Billionaires on the other hand...

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#307

Earlier quoted context omitted.

What encryption? Last I checked, there was no E2E group encryption (Telegram has a bizarre web page claiming that TLS to their servers addresses the privacy threat), and 1:1 E2E is disabled by default.

For a very long time there was no TLS to Telegram servers, only their own MTProto. I think they introduced TLS wrapping at some point as an anti-censorship measure, not sure if that’s even deployed in all markets. E: Well, I took a look at the desktop client with wireshark. It appears to just do MTProto on port 443, not TLS. When I use iptables to drop traffic on port 443, it falls back to MTProto over HTTP(!). They…

> it falls back to MTProto over HTTP

Could you expand on their usage of TLS and HTTP? Surely they don't send anything in plain-text over HTTP?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#308
post #96
post #15

I wonder how often less high profile folks get hit with stuff like this? On one hand, zero days are rare and expensive. OTOH someone who isn't the CEO of a major company might not notice the malware, or if they do, not know they should forward it to an organization like Citizen Lab.

> zero days are rare really?

A better saying is that zero days are... fragile?

You use zero, someone notice, it gets fixed.

And yes, they are rare compared to the vast # of known vulns.

Ideally if given the choice, you'd utilize a known vuln against outdated software rather than risk burning your zero day.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#309

Earlier quoted context omitted.

For a very long time there was no TLS to Telegram servers, only their own MTProto. I think they introduced TLS wrapping at some point as an anti-censorship measure, not sure if that’s even deployed in all markets. E: Well, I took a look at the desktop client with wireshark. It appears to just do MTProto on port 443, not TLS. When I use iptables to drop traffic on port 443, it falls back to MTProto over HTTP(!). They…

> it falls back to MTProto over HTTP Could you expand on their usage of TLS and HTTP? Surely they don't send anything in plain-text over HTTP?

Looks like they don’t use TLS at all by default, just MTProto on port 443 or MTProto over HTTP. Comms to the telegram servers are always encrypted with MTProto, but tunneling MTProto over TLS would make any attacks on MTProto much harder (perhaps impossible) to execute.

I thought they used TLS wrapping in some markets for censorship resistance, but apparently that is not the case unless you set up your own proxy.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#310
post #285

Apparently I’m the only person on earth who wants to know what kind of phone Bezos was using, which OS version, etc. It seems like this detail is conveniently being left out of every story. Anyone have any additional details? I understand that it was a WhatsApp vulnerability (Pegasus?) but I’d still like to know more about the device.

iPhone X

https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacke...

Post reply on HN