Bezos Investigation Says the Saudis Obtained His Private Data
thedailybeast.com
thedailybeast.com
Does anyone have a sense (even broadly) of the specific methods that were used to intercept Bezos' texts? Did he use an iOS or Android device? Were the cell towers attacked? Was he the victim of a good 'ol zero day piece of malware? (I presume Bezos isn't the kind of guy to click on random email attachments on his phone).
Just curious what universe they were playing in.
(Speculation welcome!)
I’m wondering if there are new exploits, or if Bezos or his girlfriend ran really old ios versions. The latter seems unlikely.
https://motherboard.vice.com/en_us/article/qvakb3/inside-nso...
>The entrepreneur, who spoke to Motherboard on condition of anonymity because he was not authorized to talk about the meeting, agreed, but said that NSO would have to target his other iPhone, which he brought with him and had a foreign phone number. He gave NSO that phone number and put the phone on the desk.
>After “five or seven minutes,” the contents of his phone’s screen appeared on a large display that was set up in the meeting room, all without him even clicking on a malicious link, he said.
>“I see clicking on all kinds of icons: email icon, SMS icon, and other icons,” he told Motherboard. “And suddenly I saw all my messages in there and I saw all the email in there and they were capable to open any information that was on my [iPhone].”
A good story to tell next time when politician want to enact some new law to weaken the security of phone, for Apple/Android to build security holes for the "law enforcement / governments".
A lot of things mentioned in this article is similar to what happened with Alabama governer Robert Bentley. Early 2016, a leaked recordering of his conversation with his mistress was leaked to media (unknown source) Then a year later his wife screenshot his iMessage conversations with his mistress Rebekah! And everyone thinks it’s the wife. Between 2016-2017 and before the wife screenshot these photos there was an organized campaign against Alabama governer. Who by the way: - Supoorted Kasich to run for president - took down a confederate flag - was planning a settlement for Syrian refugee..
Just think of this, what if Trump was able to hack every congressman phone?
What gave national acquirer the confidence to black Bezos? Unless of course they’ve done it too many times to too many people. The question who are these victims?
We need to know who is/was used as a tool to implement Trump and kushner agenda.
Something like that already happened: https://www.democracynow.org/2014/8/1/john_brennan_faces_cal...
So what will we do if it happens and we find out. I guess he'll just apologize and we'll pretend it never happened? It worked like that last time:
http://www.msnbc.com/msnbc/cia-spied-senate-committee
> According to CIA spokesperson Dean Boyd, agency director John Brennan apologized
Are you trying to change the topic?
> The cia didn’t hack phones and blackmailed businessmen and politicians.
We know they hacked the devices of senators and even apologized for it later. Did the blackmail them? Could be. How do you know they didn't? Bezos was probably the rare case where he exposed their blackmail, in most cases, because of what it is, blackmail is something that is kept secret.
Of course, they could have already learned that the hard way, and that could be why they turn a blind eye to Saudi wrongdoing.
Most of the time you don't even need a 0-day exploit, simple trojan horses/targeted phishing attacks work fine. Fake celltowers can also be used. The possibilities are nearly endless. Endpoint security is virtually nonexistent.
CLEC: https://en.wikipedia.org/wiki/Competitive_local_exchange_car...
SS7: https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...
But yes, most governments that do any intelligence work at all do develop and/or buy Android and IOS 0day and rootkit tools from shady private companies.
I agree that something that I didn’t say would have been disingenuous, but I’m not sure why you would bring it up.
I’m sure you would agree that it being an op-ed tells us primarily that this article was not written by a neutral third party. We would not be surprised if it makes little to no effort to present opposing views. As an op-ed it is free to make unsupported conjectures and should probably be approached with a higher bar of skepticism and should be expected to provide facts or evidence to back up any of its novel claims.
In short, op-eds are not news, and should not be treated as such. Not that “news” is particularly deserving of the distinction these days.
I said simply that we should not take op-ed claims at face value. You said you don’t agree at all. I mean, you are perfectly free to take the claims at face value if you like, but appeal to authority is hardly compelling and perhaps even a bit disingenuous itself.
I'm so tired with these pseuso-SOC style reports detailing <some group> from the US, north Korea (lol?), Saudis, <whatever> just because someone changed a path of a binary to /home/valdimir and made a post on a Russian underground forum.
Ockham's razor here, she reused passwords, got pwned, he sent her dick pics, as 80% of the people of this world do these days, and they got recovered.
https://www.nbcnews.com/politics/donald-trump/national-enqui...
The NSA internally described PRISM as "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details. Quoting Snowden in regards to this, "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
Note this includes live communications! So this opens a pretty big question. How? One extremely conspicuous point is that when companies initially tried to deny being involved in PRISM, they all claimed something more or less the same. 'We do not allow any government agency to have DIRECT access to our servers.':
- Apple - "We do not provide any government agency with direct access to our servers"
- Facebook - "We do not provide any government organization with direct access to Facebook servers"
- Google - "We have not joined any program that would give the U.S. government —or any other government— direct access to our servers"
And so on. This is conspicuous enough to have it effectively said that access to the NSA is facilitated through some "indirect" means. The exact technical implementation of this totally-not-a-backdoor is not as relevant as the fact that this totally-not-a-backdoor can be exploited by other actors if the means are discovered. And of course there's plain old social engineering and spy games in play. Or even plain old greed. NSA worker #235,123 gets evidence that the world's wealthiest man, arguably the single most relevant economic player in the world, is cheating on his wife with some rather extreme and embarrassing evidence of such? That's going to be worth a whole lot to many people who would like to use that information against him, and an NSA worker would be just the sort of person to know who'd be interested in it.
The US got very very lucky that Snowden seems to have been patriotic and ethical, but nonetheless his actions emphasize that all the scrutiny and profiling in the world can't really predict what people will do. And as we continue to expand our surveillance state, it means the damage a single disgruntled worker can do continues to grow in proportion.
[1] - https://en.wikipedia.org/wiki/PRISM_(surveillance_program)
Note the words "Had access to Bezos' phone". E2E encryption means bugger all when someone has access to one end. There's other comments in the article that give the impression Bezos' phone was compromised.
Democracy depends on freedom of expression, freedom of association, and privacy - all of which are threatened by espionage and blackmail.
Furthermore, at least the way I see it, the more important party at fault here is AMI. I mean we can't really be surprised that a dictatorship is using their powers against powerful and influential people (especially those that have publicly opposed and blamed them of crimes). But we should be outraged when an American corporation cooperates with them, and we should do what we can to stop and punish them, both the Saudis (in whatever way we can), and more easily, the entire AMI group, it's executives and everyone involved.
But big as they are, they're a tool. Saudi ordered the hit. As far as I, a lowly democratic individual contributor, can see.
Just like if someone spies for a foreign country, then while that country might be acting in an unfriendly way, and we should be wary of them in the future. Their agent is a traitor, and should be handled as such.
Now, clear evidence has come out showing that the Saudis are willing to attack even the world’s wealthiest man, Jeff Bezos. If the founder of Amazon is in their crosshairs, it is clear that no American is safe.
The traitor Trump is a big supporter of Saudi Arabia and is currently planning on selling them advanced nuclear technology. Saudi Arabia is as dangerous as Iran or North Korea or Russia – their financial backing is what made the World Trade Centers attack possible on 9/11.
Saudi Arabia is an evil dictatorship and it must go. No American is safe.
Family based succession, more or less provides a clear lineage and plan. Otherwise, military gets involved.
As an American, I don't want to see my fellow countrymen dying in another pointless war, so my view is that we should generally mind our own business.
I've spoken with someone who claimed to be a monarchy proponent and they suggested I read: "Democracy – The God That Failed: The Economics and Politics of Monarchy, Democracy and Natural Order (Perspectives on Democratic Practice)", by Hans-Hermann Hoppe. I don't know anything about the author, nor have I read the book, but perhaps that might help provide some insight into why some support a monarchy.
"In a covenant concluded among proprietor and community tenants for the purpose of protecting their private property, no such thing as a right to free (unlimited) speech exists, not even to unlimited speech on one's own tenant-property. One may say innumerable things and promote almost any idea under the sun, but naturally no one is permitted to advocate ideas contrary to the very purpose of the covenant of preserving and protecting private property, such as democracy and communism. There can be no tolerance toward democrats and communists in a libertarian social order. They will have to be physically separated and expelled from society. Likewise, in a covenant founded for the purpose of protecting family and kin, there can be no tolerance toward those habitually promoting lifestyles incompatible with this goal. They – the advocates of alternative, non-family and kin-centered lifestyles such as, for instance, individual hedonism, parasitism, nature-environment worship, homosexuality, or communism – will have to be physically removed from society, too, if one is to maintain a libertarian order."
(Yes, the man seriously calls himself a libertarian.)
TLDR: it’s cheaper to pay off a small group (family) rather than a big group (populace).
I honestly don't know how to feel reading something that ranks politics above actual state sponsored murder.
And having to accept that as the uncontested norm.
>Further, to respect officials pursuing this case, I won’t disclose details from our investigation. I am, however, comfortable confirming one key fact:
>Our investigators and several experts concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information. As of today, it is unclear to what degree, if any, AMI was aware of the details.
He claims there is direct evidence that they accessed Bezos' phone. It may not be true, but opting to not disclose evidence doesn't mean none exists. I also doubt Bezos and his lawyer would make such a major accusation like that without confidence that it's true.
This is really no better than citing anonymous sources. There is a story if and when, and not a moment before, actual evidence (with some respectably chain of custody) is actually provided.
EDIT: The word "evidence" only appears once in the editorial, talking about an AP article reporting that the Saudi's were sent an advanced digital copy of the pro-MBS magazine.
Read it carefully, Gavin never equivocally states he has any evidence that the Saudi's had access to Jeff's texts. They interviewed people. They were told by other people that the Saudi's had this capability. SA apparently "unleashed their cyber-army on Bezos". And AMI has done [presumably highly lucrative] work for MBS. And AMI is bad because they caught-and-killed a story for Trump, and have done things for Trump in the past. That is all we get here, aside from the ominous ending of Saudi Arabia controlling our media.
I'm just so tired of the conspiracy theories.
Not knowing why AMI started talking to Michael Sanchez is not the same as knowing that the Saudi's told them to talk to Sanchez.
I'm not on the hook to prove anything. TFA provides literally zero evidence of their claim other than to assert it strongly.
In my opinion, the most strongly asserted claims accompanied by "we can't tell you the evidence, but we turned it over to someone else who also can't tell you"... well, haven't we seen how that turns out enough already over the last 2 years?
My point is simply that TFA asserts a lot and backs it up with nothing but hyperbole.
My point was simply that this is a mealy-mouthed statement which does not assert anything about what, if any, evidence may have been obtained or analyzed;
> "Our investigators and several experts concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information."
What incentives do de Becker and Bezos have that would cause them to falsely accuse the government of Saudi Arabia? It seems that such an action would be risky to say the least.
Of course, the potential risk doesn't mean that they don't have such reasons (or even that their inference based on whatever data they have is correct), but I am curious as to what you think are the likely explanations.
It seemed the implied incentive for Bezos to accuse the Saudis was to portray himself as the victim and not the victimizer. He also had beef with the Saudis before this happened. Finally, his medium posts and frantic behavior suggested he may have been letting panic and paranoia get the better of him.
BTW, not saying that I think any of this is true (and this article suggests it isn't). Just summarizing what others have suggested.
But the incentives are massive. The world’s richest man had a huge PR problem with stories coming out about how his wife actually was instrumental in helping build Amazon in the early days.
Half his fortune on the line. Perhaps his controlling stake in Amazon, too? How many Amazon shares will his ex-wife walk away with at the end of this? Aside from the divorce which will be the most damaging event in Jeff’s life, the PR hit is not insignificant.
If Jeff can tie AMI to illegal spying he can possibly take down the entire company. Is revenge not a good enough motive? He is certainly not a disinterested third party.
This is a great albatross to distract from an otherwise big story.
I never said outlandish. I said people claiming Gavin said he had evidence were incorrect, because TFA literally never claims to have evidence. Let alone direct evidence. Let alone incontrovertible evidence.
I think it’s absolutely incumbent on the accuser to provide at least some general description of the form and substance of evidence that was obtained to support a claim such as this. This is not asking too much from a private citizen who apparently had unlimited funds from his boss (the richest man in the world) to exact revenge on someone who attacked him in one of the most financially damaging ways imaginable.
Since when does HN accept conspiracy theories with absolutely nothing to back them up? I’ve seen the post “extraordinary claims require extraordinary evidence” upvoted to the top of many discussions. Why does that not apply here? Doubly so in a case where the accuser is so personally vested in the outcome.
You propose that because we know conspiracy A (through tremendous amounts of actual evidence) so therefore we must entertain a tenuously related conspiracy theory B without any evidence?
Please don’t accuse me of being insulting and dishonest on the basis of frankly basic skepticism of a conspiracy theory, particularly if that is the extent of your rebuttal.
The political skirmishes of the worlds richest men don’t really concern me. What does concern me is the posited existence of a remotely installable no-touch root access zero day for a presumably up-to-date iPhone, and secondarily, that it’s being weaponized by foreign government against private US citizens — meaning it apparently doesn’t require the carrier’s cooperation to deploy, which is what would shock me the most, because baseband exploit would be the most obvious vector.
> "absolutely nothing to back [..] up [the theory]"
More intellectual dishonesty. The Saudis had the means, the motive, the opportunity and the disposition, as demonstrated by their murderous tendencies. The House of Saud are a family of thugs who are known to conspire to murder journalists. It's entirely rational to consider the strong probability that they've also conspired to blackmail people.
- A remote access no-hands zero day iPhone rootkit.
- An international plot to expose an affair
- A plot potentially involving the President of the United States in cahoots with the National Enquirer to expose the richest man in the world
- A blackmail attempt to cover it all up
- Perfectly executed parallel construction to account for the source of the photos
Last week the President was accused of clandestinely exploiting the intelligence apparatus of the United States to steal Bezos' photos. Now that we know (the only actual evidence that we've seen -- in this case statements from the brother himself and AMI) that the photos were provided by the brother, a new theory emerges that this was merely parallel construction after the affair was exposed through spying by the Saudis.
To reach that conclusion, you would have to (1) have evidence that the Saudi's contacted AMI to give them the lead, (2) have evidence of the zero-day on the iPhone, and (3) be able to link some sort of network activity back to Saudi Arabia carrying the exfiltrated data. ('AMI was tipped off', 'by the Saudi's, 'after they spied on Bezos by exploiting his phone' are three separate facts which each need supporting evidence).
Instead... You use the words "means", "motive", "opportunity" in a colloquial which is at odds with their meaning in a court of law. "I think this guy doesn't like that guy" is true of an untold number of people in Bezos' orbit, including his ex-wife.
"I think this guy can remote root international iPhones at the click of a mouse" is not means" - it's utter speculation. Anyone* who knew Bezos was having an affair with Sanchez would be in the exact same position to approach the brother and ask for kompromat.
I don't know what you are claiming is the evidence of "opportunity" in this case?
I certainly don't support Saudi Arabia, and I'm looking forward to the day where there's no one left to buy their oil and they sink back into the desert. It is absolute fact that Saudi Arabia has murdered and blackmailed in pursuit of their political goals.
But you have literally nothing but a cute story and a blog post of a guy who said trust me because I have high confidence that they hacked Bezos' phone to give AMI the lead on his affair other than "Saudi Arabia bad".
You have not come even remotely close to substantiating any sort of claim, other than to basically say that it's not impossible that it was them. I actually agree that it's not impossible that agents of Saudi Arabia remotely accessed Bezos' iPhone using a no-hands zero day to root his iPhone, discover the affair, and then call someone at AMI to tell them to track down the girl's brother to get a copy of the texts. It's not impossible but there's also no evidence that any of us has seen it actually happened. I think that's pretty much the definition of a conspiracy theory right there! The correct response, IMO, is absolute skepticism, and to wait for evidence to be presented.
Or at the very least, a general description of the sort of evidence which allegedly has been found?
And I really think you should cut it out with the ad hominem. There's nothing dishonest about my skepticism, and I am not insulting you, just your utter lack of an cohesive argument.
https://www.cnbc.com/2019/04/02/bezos-saudi-hacking-allegati...
So many downvotes to my comments on this story, I am curious to see where it all ends up.
> As has been reported elsewhere, my results have been turned over to federal officials. ... Further, to respect officials pursuing this case, I won’t disclose details from our investigation.
"Results". "Details". Never "evidence".
Gavin said he was confident in his conclusion. He then went on to describe numerous activities; interviewing current and former AMI executives, Middle East experts, cybersecurity experts, current and former advisers to Trump (?), whistleblowers, associates, and others targeted by the Saudis.
That sounds to me, like an awful lot of smoke, and zero definitive evidence. What he didn't say he had? Forensic evidence from the phone. DKIM signed email trail, confession from a co-conspirator, etc.
I have no doubt there is a compelling story here. I have no doubt that this could theoretically fit the Saudi MO. I certainly have absolutely zero doubt that the crown prince is an epicly murderous duplicitous asshole. I might even believe the Saudis have some ways to remotely infiltrate certain iPhones (but I would bet it requires compromising the carrier).
None of that would lead me to conclude the Saudis tipped AMI without just a little bit of non-circumstantial evidence.
I already kind of treat my phone as though it's public domain. The amount of software which runs on most devices today is unfathomable. Keeping your devices completely secure seems almost impossible.
There are very few reasons to take and store naked photos of yourself on your phone. So I submit that it's usually a bad idea to do so.
"I like things that make me feel good" is generally considered a very, very satisfactory reason by 99.999% of the population.
This is getting close to saying "Sexual intercourse is very dangerous. Outside of reproduction, there are very few reasons to have sexual intercourse, so I submit that it's usually a bad idea to do so."
I think there are probably better, safer ways to do that then taking and sending photos. Unless the thing that gets you worked up is the very likely danger that these photos are being collected and stored somewhere for others to see and or use against you.
You can't trust anyone or anything. I already feel like this now as a regular person. If I was a billionaire, I would probably never leave my mansion and I'd fire all the house staff. You just can't buy real trust; people will only pretend to be trustworthy.
When you're a public figure, you become surrounded by the best actors in the world. These people are in a different league than what you see in Hollywood and they all want a piece of you.
Treat everything as compromised.
I am always looking for new suggestions on where to hide 'Keys'.
Its not about being wealthy and famous its about knowing how information can be easily shared and never get deleted on the internet.
Bezos being the founder of Amazon, a company which exists just because of the internet should not have made that mistake.
Sometimes when a thread or story is killed, though, the comments survive and multiply because the broader community can't moderate them.
Also, to be clear, disagreement and skepticism about what's written in the article is a healthy and good thing. But the disagreement should take into account the full content of the article, since many counter-arguments here were specifically discussed in it.
https://www.jpost.com/Opinion/MBS-youve-been-cleared-for-lan...
Are you seriously suggesting that in lieu of cutting the problem off at the source by NOT giving a dangerous man like MBS nuclear weapons, we should rely on other nations in the region to clean up the mess?
That has nothing to do with whether or not it’s a good idea, just that I believe very little can go wrong I’m the context of Mossad oversight. I’m certainly not endorsing the deal.
Why not? If nothing can go wrong, then on what grounds could you possibly object?
This is the most eye-opening naive piece of rhetoric I've ever read on HN.
Mossad couldn't stop Iran from developing nuclear technology, only delay it. And that was with every country in the world agreeing to sanctions.
There is no chance they can stop the Saudis, especially since the Saudi's probably already have a technology transfer agreement with Pakistan.
[1] https://en.wikipedia.org/wiki/Nuclear_program_of_Saudi_Arabi...: Since 1998, Western diplomats and intelligence agencies have long believed that an agreement exists in which Pakistan would sell Saudi Arabia nuclear warheads and its own nuclear technology should security in the Persian Gulf deteriorate.
[2] https://www.globalsecurity.org/org/news/2003/031022-pakistan...
[3] https://www.nytimes.com/2018/11/22/world/middleeast/saudi-ar...
[4] https://carnegie-mec.org/diwan/75723 Saudi Arabia probably already has a nuclear weapons capability, courtesy of Pakistan.
Eyeroll. Why is Gavin writing this? In the Daily Beast? The narrative voice sets off immediate alarm bells, reading like a Tom Clancy novel;
> What was unusual, very unusual, was how hard AMI people worked to publicly reveal their source’s identity.
It really isn't all that unusual, when you feed a salacious story to a conspiracy-theory-mad media which is frothing at the mouth to bring down Trump by any means possible, and then claim the President cooked it up as political revenge. When the FBI has a non-prosecution agreement with you that any misdeed could throw you under a microscope... It would have surprised me more if AMI insisted on absolute secrecy of their source. This is classic "makes you look guilty either way" rubbish.
The world's richest man got caught doing something that could literally cost him half his fortune in the ensuing divorce. I certainly wouldn't want to be on the wrong side of that particular counter-strike.
1) Bezos had made claims in his original post that AMI and the Saudis were in league on the Bezos attack. That got walked back a little in this post when he admitted that (paraphrasing): it is unclear how much AMI knew, but it was still totally the Saudis. Maybe there won't be any evidence coming to back that up other than the AMI lawyers' strange request.
2) Bezos had given some of the credit for these claims to de Becker before, but now the weight of any truth or not is squarely on GdB.
3) Setting the record straight(?) that Michael Sanchez was not vile but rather a semi-victim of a larger plot might be helpful to Jeff the human in love.
Why The Beast? Well as you can now see every news wire picked it up within hours, so maybe they're just conveniently easy to use as the first publishing spot.
From my reading this is exactly what happened. Reported by AP News, CNN, Fox News, and The Verge.
This is just privatized parallel construction weaponized against a critic of the Saudi government.
However, the original post asked how the digital material was obtained. The post, and many others, imply some technical wizardry was used to obtain said info. Who is to say the Saudis did not employ traditional human intelligence to learn that the brother had access to the ‘dirt’?
My point is simply: just because the Saudis knew which stone to turn over does not mean they used some technical prowess to turn over said stone.
[edit] clarify my stone turning over analogy.
Without knowing more, it's hard to say exactly what happened, but there is plenty of evidence of the Saudis, along with other repressive regimes, spending huge sums of money buying and weaponizing zero-days to target critics. So they had the means, the motive, and the opportunity to target him..
>AMI has repeatedly insisted they had only one source on their Bezos story, but the Journal reports that when the Enquirer began conversations with Michael Sanchez, they had “already been investigating whether Mr. Bezos and Ms. Sanchez were having an affair.” Michael Sanchez has since confirmed to Page Six that when the Enquirer contacted him back in July, they had already “seen text exchanges” between the couple. If accurate, the WSJ and Page Six stories would mean, clearly and obviously, that the initial information came from other channels—another source or method.
And if he did pay this person what is the point of this coming out here, and on the daily beast.
Just doesn’t quite add up for me.
PErhaps its a teaser piece of what's to come.
There are about 33 million Saudis. I doubt most of them had anything to do with this, and I think it's important to maintain a mental distinction between the government of a country and its people.
I agree that people generally understand that in this case the headline refers to the Saudi government - but OTOH, this kind of "generalisational" language can perhaps be a form of propaganda, or at least subconsciously change some readers' perception with constant exposure.
The 32m+ citizens are called 'Saudi Arabians'... calling them 'Saudis' is, erm, informal at best, lazy at worst?
Technically, they're overwhelmingly correct, and your definition is in fact the uncommon one. For example, see the primary definition for both adjective and noun usages in the Oxford Dictionary of British & World English (not even US English).
e.g. "Did the Americans know about Pearl Harbour?" "Why did the Soviets develop the atom bomb"? "Why do the British maintain a nuclear deterrent?" "How will the Australians react to the detention of one of their nationals by the Chinese?"
That being said, it's still pretty normal to speak like this. Americans, Russians, Chinese.
The Saudis = the Saudi Family
Saudi Arabians = all Saudi citizens