Hacker News Reader

Comment by lawnchair_larry | Hacker News Reader

There is pretty much no actual evidence here and at least a few indications that they are not iOS forensics experts. Bezos did not choose the right company to handle this work.

Some of their assumptions are really stretching, especially the bit about the picture of the woman looking vaguely like his girlfriend, as if that’s an indicator that they know about her. They seem to be working backwards from their conclusion and trying to stretch the evidence to the explain what they want to be true.

I actually was more convinced that MBS was involved before reading the report. Now seeing this, plus the story that AMI paid her brother 200k for leaked texts that WSJ saw and verified, really has me doubting.

View on HN

The report claimed they couldn't decrypt the whatsapp video, so Dino A. Dai Zovi (head of security for CashApp) published code [1] to do it.

The report also concludes that they need to jailbreak the phone to do more analysis, but hadn't yet for undisclosed reasons. Bezos was using an iPhone X, which is trivial to jailbreak with checkra1n [2].

So yeah, FTI didn't know what they were doing.

[1]: https://twitter.com/dinodaizovi/status/1221324029841244161

[2]: https://checkra.in/

> so Dino A. Dai Zovi (head of security for CashApp) published code to do it.

Great! May be useful to decrypt also the whatsapp videos, mentioned in Lev Parnas' excerpts.

FTR, Just found that there are many other tools available for decrypt whatsapp in last two years.[0]

[0] https://github.com/search?o=desc&q=whatsapp+decrypt&s=update...

It looks like the experts that AP are paying attention to came to the same conclusion too: https://apnews.com/e3cf702ac669dc9b3d1497a1157bd0b0

Also, I think on some level surely Bezos must know this report is fishy? One of the pieces of evidence is that he got a message from MbS out of the blue claiming that what he'd heard about the Saudis wasn't true, which supposedly showed evidence of non-public knowledge. Except that Bezos had been dropping hints publicly that he thought the Saudis were behind this leak of his text messages in the days before.

Is this the same AP that reported "thousands" of Iraqis demonstrated the other day? (There were actually a million people, according to Iraq's own government.)

AP reported "tens of thousand" and the government may have its own reasons for inflating a number, so I wouldn't take that as necessarily the last word in accurate counting.

No AP reporting, including the pictures used, were the distortion of facts. There are pictures of this event and you can find it on the net. It was massive.

Treatment in the US press reminded me of our own massive demonstrations before the Iraq war (which also never made it to the front pages of our “journals of record”.)

If you would post a link to one of these pictures that unequivocally shows a crowd of around a million, that would be helpful.

https://www.presstv.com/Detail/2020/01/28/617308/Ron-Paul:-M....

How about moving pictures? Would that do?

https://www.presstv.com/Detail/2020/01/24/616953/Baghdad-ant...

This report is a joke and makes no sense.

The technical details are extremely poor and give 0 evidence of a hack. Worst, they sometime don’t make any sense at all, like the bit talking about a “Downloader” included in the video file.

I’m baffled that Bezos would give it any credibility whatsoever.

>Bezos did not choose the right company to handle this work.

I think that sums up the whole problem.

It also assumes that he hired them to find out the truth, rather than to create plausible deniability for Sanchez or whichever one of her relatives that had shared Bezos's dick pics.

If he really wanted them to get to the bottom of this, he would have hired a specialist firm. He's not an idiot for sure.

He didn’t hire them for plausible deniability.

He’s not an idiot, but he isn’t a security expert. It’s actually really difficult to evaluate the competency of security experts. He got some government guy with a flashy resume who then contracted it out to some generic business consulting firm. Which is a reasonable thing for a layperson like Bezos to do, but a bad way to get actual technical experts. He would have been far better off emailing some of the security teams at Amazon for recommendations.

One of the main skills a good executive needs is evaluating the competence of people they hire without knowing those people's jobs. Bezos is one of the best people in the world, and I'm sure he can smell bullshit better, and from farther away than any of us here. An inebriated baboon can see that these people don't know what they're talking about. Bezos likely has hundreds, if not thousands of industry-leading security experts working for him at Amazon. A five minute due diligence check by them would result in advice to hire someone else, and likely in a recommendation on who to hire.

> Bezos likely has hundreds, if not thousands of industry-leading security experts working for him at Amazon.

Not even close. A few dozen or so, most of which aren’t iOS or forensics experts. Also, nobody had this report until after it was written.

If you think executives can evaluate the competency of experts in niche fields, you are absolutely kidding yourself. This is also why nearly every CISO in the industry has absolutely no idea what they are doing.

Really? In a company with 300K+ employees you estimate that there are only a few dozen people who can vet a security consultancy by checking if it previously did any successful iOS forensic work?

I have worked there, in security, so yes.

The theory about the similarly-looking women was laughable, I kept reading forgiving that one...

It's impossible to provide "actual evidence" isn't it? Sure, maybe detailed log files are more convincing than a single (hypothetical) page saying "X did it". But as far as I can tell from online discussions I've followed over the years, more details just adds possibilities to find real or imagined faults with what you're releasing. Example: Barack Obama's birth certificate.

There just isn't a way to proof anything without resorting to either a trusted third party, or maybe (in the future) some application of cryptography. And the number of people or institutions enjoying widespread acceptance as trustworthy third parties is rapidly approaching zero, partly because this "don't trust anybody" shtick has become so common.

Gavin de Becker is a good example here. He is, or used to be, among those who enjoy some trust, at least among his profession. Extending trust based on such a track record is somewhat valid, considering the mechanism: a lot of his value as a witness in court, or the court of public opinion, rests with the idea that his reputation is always more to him than any single case. That logic isn't bulletproof, of course. But it's valuable to also consider the cost of the fundamentalist position that nothing short of 100% scientific proof should ever be considered: the absence of trust won't motivated people to better make their case, because that's near impossible with our current means. All it will lead to is more of the current free-for-all license to define their own "facts".

No, it’s possible to prove way more than what is in the report. They failed to investigate many obvious things, and they misunderstood what they did look at (the data exfiltration traffic in particular, which is the only thing even approaching circumstantial evidence). Nobody is saying we need 100% solid proof, they’re saying that what is in this report is not only not 100%, but it’s not even 25%. It’s a total nothingburger. There is nothing in this report to suggest that there is even anything wrong with this phone, or that it was ever hacked by anyone, let alone MBS.

> Gavin de Becker is a good example here. He is, or used to be, among those who enjoy some trust, at least among his profession.

Gavin de Becker is a literal nobody when it comes to iOS security or digital forensics. This is like saying that since Warren Buffet is a trustworthy source of investment advice, it makes sense to hire him to write your firewall rules.

Reply on news.ycombinator.com