NEW DELHI: Amazon founder Jeff Bezos, also the world’s richest man, allegedly had his phone hacked through a mobile spyware similar to the Israel-based “NSO Group’s Pegasus, according to the forensic report made available to the UN Special Rapporteurs. Pegasus is the same tool that was used to hack phones of several Indian journalists and activists in May last year.
So, who hacked Bezos’ phone? Reports point to a WhatsApp account linked to the crown prince of Saudi Arabia. In April 2018, Bezos, in a dinner meeting with Mohammed bin Salman, the crown prince of Saudi Arabia, had exchanged phone numbers.
Meanwhile, the Pegasus-3 spyware was acquired from NSO Group by the Saudi regime, specifically the Saudi Royal Guard in November 2017.
“Experts advised that the most likely explanation for the anomalous data egress was use of mobile spyware such as NSO Group’s Pegasus or, less likely, Hacking Team’s Galileo, that can hook into legitimate applications to bypass detection and obfuscate activity. For example, following the initial spike of exfiltration after receipt of the suspect video file, more than 6GB of egress data was observed using exfiltration vectors,” said the report.
The scary part -- in both the cases -- is that neither the journalists nor Bezos could actually do anything to prevent the hack. As all that this kind of hacking attack requires is access to the victim’s phone number and presence of WhatsApp on his/her phone.
So, while the phones of the Indian journalists and victims were hacked through a simple ‘missed call’ on WhatsApp, for hacking Bezos’ phone, a malicious MP4 video file was sent on WhatsApp. The problem here is that you can’t stop people from calling you or sending something on WhatsApp as long as they have your number.
The report said that Facebook has acknowledged that “sending a specifically crafted MP4 [video] file to a WhatsApp user,” is a method for installing malicious spyware; exactly as was sent to Bezos. Also, several news outlets reported on a WhatsApp vulnerability, and warned those who “have received a random, unexpected MP4 video file,” exactly as Bezos did, to beware.
“Records showed that within hours of receipt of the video from the Crown Prince’s WhatsApp account, there was an anomalous and extreme change in phone behavior, with cellular data originating from the phone (data egress) increasing by 29,156 per cent. Data spiking then continued over the following months at rates as much as 106,031,045 per cent higher than the pre-video data egress base line,” it added.
How the hack allegedly took place as per the UN report:
Pegasus-3 spyware was acquired from NSO Group by the Saudi regime, specifically the Saudi Royal Guard in November 2017.
On April 4, 2018, Bezos had attended dinner with the Crown Prince, in the course of which they exchange phone numbers that correspond to their WhatsApp accounts.
On May 1, 2018, a message from the Crown Prince account was sent to Bezos through
WhatsApp. The message is an encrypted video file. It is later established, with reasonable certainty, that the video infects Bezos’ phone with malicious code.
Start a Conversation
Post comment