Hacker News Reader

Comment by danso | Hacker News Reader

> This analysis found it “highly probable” that the intrusion into the phone was triggered by an infected video file sent from the account of the Saudi heir to Bezos, the owner of the Washington Post.

Any more information on how this type of attack works? Is it a vulnerability in Whatsapp, or was whatsapp just the delivery platform?

View on HN

first paragraph: The Amazon billionaire Jeff Bezos had his mobile phone “hacked” in 2018 after receiving a WhatsApp message that had apparently been sent from the personal account of the crown prince of Saudi Arabia, sources have told the Guardian.

So, not snapchat, but whatsapp. And it's quite surprising for me. So, Saudis have 0 days which work on whatsapp on iphone (I suppose Bezos uses iphone)? I mean, FB and AAPL, which both can afford tens of billions in security research, were pwned by saudi 0day? hmmm...

My guess is this gave them the ability to access anything WhatsApp could access with a code bug in the application and so maybe a Facebook issue more than an Apple issue.

If WhatsApp was given photo library access (which isn't unlikely considering you need it to send previously taken photos) then the exploit could access all his photos without a vulnerability on Apple's part.

> which isn't unlikely considering you need it to send previously taken photos

To be clear for anyone else reading, photo library access is required to browse the photo library from within WhatsApp, it's not required to share arbitrary photos to WhatsApp from the photo app via the OS's built-in share feature.

Wouldn't be that surprising. Zero days are available to the highest bidder and Saudi princes have deep pockets.

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

I would like to see bounties offered no questioned asked too.

That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.

Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?

> what makes people work for nefarius inc?

No idea about nefarius, but when I talked with someone in a similar role the answer was work conditions. It was apparently easier to get a remote role with a flexible schedule at a more "sketchy" company.

> what makes people work for nefarius inc?

Very good pay; the ability to work remotely; pride/prestige; community; political reasons.

Being a good digital thief is still very lucrative, especially for people living in low income areas with relatively lax law enforcement. These people can run encrypted computer extortions, steal bitcoin wallets, run/sell botnets, fence digital goods, run underground ad networks, and consult.

Brokers ("grey market") usually pay out over time, for this reason. If a seller double-dipped by also selling the vuln to the vendor via a bounty program, it could get fixed before they actually got most of their grey-market money.

It's not worth anything like $100m to facebook.

They pay barely enough to say they're willing to pay, but they don't really care.

Exactly. Facebook lost no customers and their stock took no hit as a result of this news. 99.999999% of their users will never know.

I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. I think the problem is these 0 days are worth more to bad actors than the bad press costs companies.

>I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch.

Depends on your personal risk profile, I guess. If I was a highly professional security researcher (one can dream!), the one can find 0 day RCE in whatsapp, well, I would happily accept 10-20M bounty from FB and retire for life, instead of bargaining with wealthy monarch and accepting non-trivial risk of being dismembered with some blunt tools in embassy of Turkey or somewhere else.

Indeed, any money after the "never work again and have a decent middle class lifestyle" point is worth significantly less to me than money before that point.

The actual prices are in the $100k-$200k range. $1m if you are extremely generous.

I wonder what size the supply is. How many could you buy immediately or over time?

Same reason that putting a bounty on dead rats isn't a good way to get rid of your city's rat infestation.

I think the problem is that FB or Apple don't really get directly hurt from these exploits being used. Some politician gets hacked and important personal data gets leaked - oh well, there was a bug, we've patched it, one less user out of a few billion. And the vast majority of people probably don't rank this kind of thing very high on their threat model, they're either not going to know or aren't going to care.

Thanks, I did make an error and I quickly edited Snapchat to Whatsapp, but didn't note it initially since no one had replied at that point.

Anyone can get pwned by a 0day. Most nation states probably have funds to buy a probably exclusive 0day and use it against a target.

https://www.facebook.com/security/advisories/cve-2019-11931

Reply on news.ycombinator.com