Hacker News Reader

Comment by bigtones | Hacker News Reader

Jeff Bezos, Amazon CEO, got his phone hacked and embarrassing text messages stolen off it from a vulnerability in the video parsing library in WhatsApp in a message sent to him by Saudi Crown Prince Mohammed bin Salman in 2018. So Amazon as a company is now very sensitive to what applications are installed on staff devices and how data on those devices can be extracted from vulnerabilities in other installed apps. This may be an outcome of that.

https://www.businessinsider.com/jeff-bezos-phone-hacked-saud...

View on HN

Looks like the DNC is also disallowing the app on their employees’s phones too.[1]

Don’t blame them, they don’t want the kind of leaks that happened last cycle.

[1] https://www.kdrv.com/content/news/571708792.html

How about making Whatsapp not permitted on Amazon employee’s phones?

How about making Jeff Bezos not permitted on phones with access to Amazon email?

Does anyone have any technical detail of that story. It is hard to imagine how a bug in the image parse library can be utilise to steal text message.

Sure, the blog post below covers it, and the vulnerability was probably CVE-2019-11931. You can do an awful lot with a buffer overflow if you're clever.

https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsa...

Does anyone have a "explain it like I'm 5 but took some CS classes back in college"?

I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function.

But how do you know what parts will get overwritten?

Does that mean the new function can do almost anything?

With a buffer overflow, you can write your own code into a chunk of memory that ends up being run by the application. In this case, since WhatsApp already had SMS read privileges as part of the signup auth flow, the attacker also had those privileges.

The article has some detail about the remote code execution part of this exploit.

“What this means is that there was a software flaw in the WhatsApp code for handling MP4 media files. If an attacker triggered the flaw, the function in question would crash in a way that could allow a potential attacker to gain “RCE” or Remote Code Execution.

In layman's terms, this means the attacker could inject his own code into the application and, by triggering the flaw, make the application to run with all the privileges and access of the WhatsApp application itself.”

> With a buffer overflow, you can write your own code into a chunk of memory that ends up being run by the application.

This is usually no longer the case in modern applications. So attackers instead string together short snippets of code from the application itself and jump around between them to basically do what they want.

So the payload would be some corrupted video file sent to Bezo's phone. Would the attack look something like:

1) Discover/buy/steal Bezo's Whatsapp number (how did they do that...)

2) Discover/buy/steal a 0-day bug in Whatsapp.

3) Write and compile a program that reads SMS from the OS and beacons it to some server you control.

4) Create a corrupted video file that would trigger the video parsing bug, and within that video file place the compiled program from the previous step in the correct place so that it gets executed.

5) Send to Bezos.

Yes, that seems like a reasonable summary. (3) is the kind of thing that exploit developers will have "off the shelf"; (1) is probably available in a dump of private information somewhere.

There are multiple techniques that might be used (and countermeasures that might have to be bypassed) but these links should get you started -

https://stackoverflow.com/questions/14760587/how-does-a-nop-...

https://stackoverflow.com/questions/49620893/return-into-lib...

And yes, arbitrary code execution is a common goal of these exploits, though it may not always be possible--sometimes you only get a DoS attack or such.

The classic buffer overflow has the buffer on the stack, near the return address, so you can just write a new return address and jump into the code you put in the buffer.

It's become more complex due to mitigation, but the general principle is the same.

It's even harder to imagine how someone could rewrite the code to Super Mario World on an unmodified SNES to play Flappy Bird just using regular controllers, yet it's possible: https://www.youtube.com/watch?v=hB6eY73sLV0

oh bugs in the parsing libraries are the things MOSTLY used for attacks like this.

Parsing is hard, and parsers are buggy and lead to all kind of unsafe C code

Exactly, parsers are complicated, generally involve a lot of manipulation of memory buffers, and for performance reasons are usually written in a language without memory safety (though this is starting to change with languages like https://github.com/p-org/P and rust).

Actually their pretty common. They are complex and generally fairly old interpreters that generally have system level access. Android have had a ton of them, but they are pretty universally common.

It starts with a buffer overflow. This then will allow you to execute your own code.

is the jury still out on whether MBS knowingly sent him that hack? that is, not to put too fine a point on it, a fast path to becoming even more of an international pariah than he already is

The jury is still out on whether there was even a hack to begin with. The analysis team claimed they couldn't decrypt WhatsApp messages, so they never actually analyzed any malware at all. HN called them out on that failure:

https://github.com/ddz/whatsapp-media-decrypt

They never responded with an actual malware analysis on the file they claimed might be responsible.

The only evidence left after that was a claim of higher data usage which has to be weighed against the alternate explanation for how this got out:

https://www.forbes.com/sites/martingiles/2020/01/24/report-b...

TIL, thank you.

if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.

You're welcome and I agree, the lack of follow-up after being called out publicly like that is not a good look.

Tricking a [EDIT: thanks 'spyspy!] WaPo journalist into visiting a consulate and then chopping him into pieces with a saw while he screamed and cursed you? Dropping bombs to kill hundreds of thousands of Yemeni children? Making the people of Saudi Arabia somehow less free? Those things were pretty bad sir! But now you've gone too far! How dare you peep on our first trillionaire while he's courting outside his marriage?!? At long last, have you no shame?!??

> In Comments

> Be kind. Don't be snarky...Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

https://news.ycombinator.com/newsguidelines.html

You're going to have to spell this one out for me. To my (admittedly poor) judgment, the above comment does not violate the guidelines. I provide relevant examples of behavior that reasonable people would consider far worse than hacking some rich dude's iPhone.

Sure. To the first point, I think it's pretty evident the comment is snarky (even if it has a good point in there). I'm guilty of that too, more often than I'd like and I do get called out on it occasionally. And I don't think that alone is an excuse to just flippantly toss the guidelines at someone, which admittedly is basically what I did.

To the second point, however, I do think you took the worst possible interpretation of swyx's comment, which was basically "nobody cares that the person in question is a murderous tyrant, but he hacked Bezos's phone and so is a bad person now." I don't think that's what he was saying at all, especially given the end about "more than he already is." Whether we like it or not, one of the primary reasons that Saudi Arabia is tolerated in the West is their economic importance, and their connections to the elite, almost entirely because of their wealth. That starts to crack if they go after the elites directly. So I took the comment as basically saying that it didn't seem to serve MBS at all to hack Bezos directly, as it would only (further) delegitimize him interntionally.

I'm glad that some light snarking is still somewhat tolerated. It's one of the things that makes life bearable for me.

To more seriously address the various possible interpretations of the comment in question... yours is a reasonable interpretation, but I don't think I was unresponsive to that interpretation. Of course ethical people object to MbS's previous evil deeds. Still, those are his deeds. If global opprobrium didn't sway him before, there's no reason to believe it did so more recently. If there is evidence that some electronic communication that appeared to come from MbS contained malware, that evidence should be analyzed in itself. It shouldn't be dismissed by vague unsupported perceptions of MbS's interests and motivations. It's not as though Bezos is universally adored, even among other satanically wealthy reptiles.

All whilst being propped up for decades by the USA for geopolitical objectives??!

It's not an accident that one of the stupidest, most theocratic countries in the middle east receives the most weapons and support from the USA.

We don't want a strong middle east. This is why countries like Iran, Lebanon, Syria are labelled as "terrorist".

That's exactly the same hypocrisy the OP is complaining about, just from the other direction. One faction of the West ignores Saudi's role in killing Yemenis; The other faction ignores Iran's role in killing Syrians. One faction ignores domestic repression in Saudi Arabia; the other ignores domestic repression in Iran. One ignores theocracy in Saudi, the other ignores theocracy in Iran.

Both countries and both rulers of said countries should be international pariahs.

Assuming I'm "OP" to whom you refer... I reject this false equivalence. That isn't to say that the government of Iran is perfect; no government is. However, it is entirely the fault of USA that Iran's government takes the form that it does currently. We should have left Mosaddegh alone. We shouldn't have helped the Shah kill religious and democracy protesters. We should not have sold Saddam weapons of mass destruction (and lots of other weapons too) with which to war with Iran. We should not shoot down their civilian airliners. We should abide by our treaties with Iran. We should not assassinate their diplomats while those diplomats are on diplomatic missions to nations we claim as allies. We especially shouldn't do that when the diplomat in question was the single human being most responsible for defeating ISIS, which was the actual threat to Syrian people.

Iranian women have never lost their rights to drive, to appear in public, to have lives of their own. Iranian women and men both vote in elections to select their leaders. Iran has only fought defensive wars with its neighbors. Kingdom of Saudi compares very poorly in all these categories.

Iranian women can't go out without mandatory hijab, and those that do often get arrested or acid in their face. There are 'elections', but only approved (i.e. regime-supporting) candidates are allowed to run and no position with actual authority is elected - all actual authority is with the Supreme Leader and the IRGC - and people who protest are killed ('only a couple hundred' claimed FM Zarif recently).

Iran is running a massive offensive ethnic cleansing in Syria and has been declaring its intent to do the same in Israel for years. This was headed by a general (not 'diplomat') who was on both the EU and US terrorist lists. Its foreign policy is support of nearly every tyrant and terrorist organization out there.

Of course, there's some flimsy excuses (the US once upon a time supported overthrowing someone the Islamists also helped overthrow, and there was a brutal 'security service' which the Islamists retained in full, adding a single letter to the name), but they're not very interesting. I could have run the same list of excuses for Saudi with different names and places, and it'd be the same apologia for a dictatorial theocracy which spreads fanaticism for ideological and domestic reasons.

Iran is running a massive offensive ethnic cleansing in Syria and has been declaring its intent to do the same in Israel for years.

Iran has helped the internationally-recognized government of Syria battle the internationally-recognized terrorist group ISIS, whom USA created and supported throughout its existence. This happened very recently: how is it that you've forgotten? Perhaps you were distracted by the by-now-obviously-false-flag "gas attacks"? The timing was just so convenient! [0] Tell that "ethnic cleansing" bullshit to the Yazidis and Kurds. Those few who weren't butchered by ISIS are glad to see the internationally-recognized government of Syria in control again.

This was headed by a general (not 'diplomat') who was on both the EU and US terrorist lists. Its foreign policy is support of nearly every tyrant and terrorist organization out there.

Potayto, potahto. What did we call Colin Powell back when he was circling the globe lying about WMDs? (He was good at it, because he had practice from lying about My Lai.) What do we call Pompeo now that he's circling the globe lying with his every breath? Pompeo was so sad his pet project ISIS went belly up, he forgot what business he's in. I wonder how many meetings he has on tarmacs in the Middle East?

...not very interesting...

This is projection. Regurgitating 4yo propaganda that even USA war media has by now retracted convinces no one. By any measure, the Sauds are worse than the elected Iranian government. The reason we still menace the Middle East is not because some person did so and so to some other person in some place no one can find on a map. The reason is, we don't have democracy in USA, so we citizens can't force our government to bring the troops home.

[0] https://scheerpost.com/2020/07/02/the-threat-of-peace-and-me...

The 'internationally-recognized government of Syria' has run an internationally recognized ethnic cleansing campaign against the country's Sunni population, the vast majority of it hasn't been a part of ISIS (Maybe you have a problem with the map, but the Yazidi genocide happened in Iraq). Speaking of ISIS, maybe if Assad didn't intentionally release jihadis from Sednaya, or didn't support their previous incarnation in Iraq, we wouldn't have these problems. That's why there are complete sanctions on Assad, which will not be removed until he falls.

As for the gas massacres, the conspiracy theories just get madder and madder. Obviously, the rebels are supposed to have attacked themselves for the XX time after seeing all the previous gas attacks led to no reaction? While never ever using them against Assad troops? The Assad regime being the only one in theater with the equipment and capability of staging a gas attack? Some people are just shilling for mass-murder.

The Iranian government isn't elected. Everything is controlled by the Supreme Leader and IRGC, and the 'elected' offices have no power. The 'elected' offices where the only people who are allowed to be elected are those that support the regime[0], and protesters are killed[1].

You're right about one thing - the Saudis are not much better. Then again, they didn't support a WMD attack and deny it later, like Iran apologists do. Nor do they officially have genocide aims against other countries. Maybe the apologists secret admire the Mullah's aims, and that's why they defend the regime.

[0] https://apnews.com/44ad5910fa3e1a297d6c0b5ad6c3c59f

[1] https://www.reuters.com/article/us-iran-protests-specialrepo...

Haha we have sanctions on Cuba for Pete's sake. Sanctions don't imply anything. They do kill thousands of people a month in Venezuela alone [0], with corresponding numbers in a dozen other nations so good job I guess.

There was no "gas attack". Some murderous slaving ISIS criminals took a sledgehammer up on the roof, knocked out some holes, and shoved some empty canisters into them. Then they mixed some bleach with some muriatic acid and left the scene. Later, there was of course some chlorine residue. But simple physics proved that full canisters of poison gas hadn't been "dropped out of helicopters": the roof wouldn't have stopped so many of them. [1] Actual gas bombs of the sort that USA sold to Saddam for use against Iran are carefully constructed devices that can actually be dropped from aircraft and expected to distribute poison gas. Dropping bare storage cylinders only works in the movies. The real conspiracy theory is that the internationally-recognized government of Syria had anything to do with those attacks. They had neither means nor motive. The "moderate rebels" (really ISIS) that USA had been supporting had both.

Of course you don't care about details. Even your pose of criticism of Saudi is cynical. You want to sell the Saudis bombs to kill Yemeni children right up until they don't want to buy them anymore, at which time you'll want to start bombing KSA. Mostly you just support status quo USA policy for the last 70 years. That is, we kill lots of brown and black people so that the public can be buffaloed into giving armaments manufacturers obscene amounts of money. The public would prefer to spend that money on literally anything else; you disagree. You'll probably make a show of declaring that you're actually more against war than I am, but your religious devotion to every lie that the war media has ever tossed off shows where your heart is. Pacifists oppose killing innocents, both through sanctions and through the wars for which sanctions are pretexts. The Middle East is broken for the same reason that Latin America is broken and Southeast Asia was broken for a long time: USA broke it. The best thing we can do for them is the best thing we could have done for them in the 1950s: stop interfering with their governments, stop providing armaments to various parties, and stop killing them.

[0] https://cepr.net/images/stories/reports/venezuela-sanctions-...

[1] https://thegrayzone.com/2019/05/25/opcw-syria-gas-attack-sta...

The US alone has sanctions on Cuba, nearly the entire world (except Putin and Iran and China) has sanctions on Assad. It's a bit different, you see?

Nobody believes the lies regarding the WMD massacres, we know Assad did these (and so much more). It required rebels with no advanced weapons, much less chemical weapons, to attack themselves over and over, while never ever attacking Assad. The Douma massacre in particular wasn't bleach, it was a different chemical agent[0]. The nature of Assad's attacks is well documented[1].

There's nothing 'pacifist' about shilling for mass murder. It's like those 'pacifists' Orwell attacked during WW2 because they were equating the Allies with the Nazis, that is, being 'objectively pro-fascist'.

That's a very cynical position, despite your alleged criticism of Saudi. I bet that as soon as Saudi ignores US and buys weapons from Russia we'll hear a different tune from your likes.

[0] https://www.bellingcat.com/news/mena/2020/01/15/the-opcw-dou...

[1] https://www.bellingcat.com/news/2020/04/21/the-open-source-h...

Haha "bellingcat" that's rich. No one conscious pays attention to that spook show. Grayzone has had their number for a long time. [0] They do have good SEO; it's not surprising that a naive google on these topics pulls their emissions out of the bog. And Eliot Higgins is an inspiration! From unemployed college dropout to widely-cited international aviation and weapons expert, through a personally-developed, diligent regimen of playing video games. [1] The joke is certainly on Theodore Postol: he wasted a fifty-year career studying physics, nuclear technology, and weapons systems at Pentagon, Argonne National Labs, and Stanford, only to be overruled by this pasty neckbeard. It's almost as if the way to get quoted in the war media is to say just what the war pigs want said...

[0] https://thegrayzone.com/?s=bellingcat&orderby=relevance&orde...

[1] https://www.nytimes.com/2019/12/01/business/media/open-sourc...

Postol ended up a loon, denying obvious camera footage (when it comes to Iron dome), and ignoring basic chemistry (regarding the Assad massacres) in favour of conspiracy thoeries. So much of a loon he was resigned from his journal membership once peer review found no basis for his assertions[0]. Ultimately, there's no moral difference between the 'anti-imperialist' US far Left and the caricature they chase. Except this: Even when the US acts badly, it's done by people who were elected to do this, and have to maneuver in the world - the 'anti-imperialist' Left does the supporting genocide biz without being elected, without any consequences, without any scruples and with the approval of their conscience (inasmuch they have one). The C.S. Lewis quote about Robber Barons applies in full here.

[0] https://www.truthorfiction.com/theodore-postol-mit-paper-syr...

Another no-name website quoting bellingcat does not convince anyone to believe bellingcat. It's easy to falsely malign an old man (who doesn't employ a PR firm) online (and especially in wikipedia). Postol's five decades of experience still stacks up pretty well against Higgins's several years playing video games on the basement couch. (British unemployment benefits might be more generous than ours?) It is interesting that he is the authority who will put his name to these zany conspiracy theories. OPCW have enough whistleblowers to form a band, as one can read at Grayzone linked above or from the original sources. [0]

One less charitable than I would wonder just why you're so committed to this exhaustive parroting of trivial military-industrial complex dogma, to the extent that you'd accuse a random pacifist (not "Leftist") of secretly (so secretly he doesn't himself know it!) supporting genocide. USA doesn't fight in wars in order to "stop genocides". (Again, we were ISIS allies in Syria and even sometimes in Iraq. That is not to mention the hell-world we created in Libya; a less powerful nation would certainly have been called before the Hague for that pile of atrocities.) We fight in wars in order to transfer public assets to armaments manufacturers and to their puppets in government and media, and those puppets will employ any pretext in pursuit of that goal. We gave the publicly-admitted portion of our military $750B this year. The citizens of USA (and everyone else) would be safer if we spent a third of that.

[0] https://wikileaks.org/opcw-douma/document/20190227-Engineeri...

This debate is stupid. No one understands what is going on in modern geopolitics of the middle east -- including policy czars, and especially your or I. Probably not even the US government. These are gigantic state sponsored operations with foreign governments (e.g Russia), militant organizations.

As an example -- consider that ISIS was shipping ~$160 million in crude oil via smuggling routes to China. Even with all our power, it is not trivial to track such things.

What I am saying is that there are interests here that are enormous and impossible to understand.. some not even based upon nation-state and totally a-political.

The fact that you believe you have a definitive assessment regarding the gas attacks reveals your naivete.

Take a look at the history of the Assad regime and how we destabilized the region by funding his opposition. Take a look at the history of Egypt or Libya over the past 40 years. One day Gadaffi was an American hero, the next day we are cheering for his downfall. Sensationalist stories of rape/murder/torture being spread through the media. The truth is probably somewhere in the middle.

Look at the sort of stuff we spread during the Gulf War: https://en.wikipedia.org/wiki/Nayirah_testimony

This is all to say -- neither of us really knows what we are talking about. But you seem to have a very "good vs. evil" approach to the world that is naive at best.

No one understands what is going on in modern geopolitics of the middle east...

We in USA don't actually have to understand conditions in other nations. We just have to pay attention to our government and media, and remember what they've done even after they've stopped talking about it. They lied us into war with Spain, which led to decades of murder and oppression of Puerto Ricans and (especially) Filipinos. They lied us into WWI, which led to the Nazis. They lied us into Vietnam, which caused millions of deaths in southeast Asia. They lied us into Kuwait, which caused 9/11. They lied us into Afghanistan, in which USA soldiers are now dying who weren't yet born when the lies were told. They lied us into Iraq, which has seen horrific loss of life oh and also the creation of ISIS. They lied us into Libya, which peaceful prosperous nation was replaced in six months by a smoldering hellscape, complete with slave markets. They lied us somewhat into Syria, where we and our ISIS allies were (thank God) defeated. They tried to lie us into Iran...

(This is not even to mention the dozens of nations whose elected governments we've deposed in favor of authoritarians in spooky ways, at least as long ago as 1953 in Iran, as murderously as 1965-7 in Indonesia, and as recently as last year in Bolivia.)

Gosh, what can we conclude from this fairly consistent history? I submit that when we're fed some pretext for war, we should assume it's a lie and oppose the war for which it is told. If we're ever able to do so consistently (and perhaps the last two entries in the list above are cause for hope?), it will result in a greater global flowering of peace and prosperity than we've ever seen before.

Nitpick: Khashoggi was a writer for WaPo, not NYT.

I fail to see any situation where MBS would be an international pariah while still controlling Saudi Arabia

>in the image parsing library in WhatsApp in a picture message sent to him by

Your link says

>Bezos' phone appeared to be infiltrated after he opened a video file sent from the crown prince's number on WhatsApp.

A video is a series of pictures, so not "technically" inaccurate...

A sort of "motion picture" if you will.

Reply on news.ycombinator.com