The big lesson from the Bezos hack: Anyone can be a target

The big lesson from the Bezos hack: Anyone can be a target

PROVIDENCE, R.I. — You may not think you’re in the same league as Jeff Bezos when it comes to being a hacking target. Probably not, but you — and just about anyone else, potentially including senior U.S. government figures — could still be vulnerable to an attack similar to one the Amazon founder and Washington Post owner apparently experienced.

Two U.N. experts this week called for the U.S. to investigate a likely hack of Bezos’ phone that could have involved Saudi Arabian Crown Prince Mohammed bin Salman. A commissioned forensic report found with “medium to high confidence” that Bezos’ iPhone X was compromised by a video MP4 file he received from the prince in May 2018.

Bezos later went public about the hack after the National Enquirer tabloid threatened to publish Bezos’ private photos if he didn’t call off a private investigation into the hacking of his phone. It’s not clear if those two events are related. The Saudis have denied any involvement in the purported hack.

The events could potentially affect U.S.-Saudi relations. On Friday, Sen. Ron Wyden, an Oregon Democrat, said he is asking the National Security Agency to look into the security of White House officials who may have messaged the crown prince, particularly on personal devices. Jared Kushner, a White House aide and President Donald Trump’s son-in-law, is known to have done so using WhatsApp.

Wyden called reports of the Bezos hack “extraordinarily ominous” and said they may have “startling repercussions for national security.”

But they could resonate at the personal level as well. As the cost of hacking falls while opportunities to dig into peoples’ online lives multiply, more and more people are likely to end up as targets, even if they’re not the richest individuals in the world.

Ultimately, that boils down to a simple lesson: Be careful who you talk to — and what you’re using to chat with them.

“People need to get out of the mindset that nobody would hack them,” said Katie Moussouris, founder and CEO of Luta Security. “You don’t have to be a specific target or a big fish to find yourself at the mercy of an opportunistic attacker.”

WhatsApp, owned by Facebook, is generally considered a secure way of trading private online messages due to the fact that it scrambles messages and calls with encryption so that only senders and recipients can understand them. What many people may not have realized is that it, like almost any messaging service, can act as a conduit for malware.

That encryption, however, is no help if a trusted contact finds a way to use that connection to break into the phone’s operating system. In fact, an infected attachment can’t be detected by security software while it’s encrypted, and apps like WhatsApp don’t scan for malware even once files are decrypted.

WhatsApp users can disable the automatic downloading of photos, videos and other media, which happens by default unless the user takes action.

Other messaging apps are likely also vulnerable. “It just so happens that this one was a vulnerability in WhatsApp,” said JT Keating, of Texas-based security firm Zimperium. “It could have been in any one of any number of apps.”

UC Berkeley cybersecurity researcher Bill Marczak cautions that there’s still no concrete evidence that’s been demonstrated to show the Saudi video was malicious, and that it might be premature to jump to broader conclusions about it. Many other security experts have also questioned the forensics report upon which U.N. officials are basing their conclusions.

But Marczak said it is generally good advice to “always be on the lookout for suspicious links or messages that sound too good to be true.”

Even caution about avoiding suspicious links might not be good enough to ward off spyware — especially for high-profile targets like dissidents, journalists and wealthy executives. Hackers-for-hire last year took advantage of a WhatsApp bug to remotely hijack dozens of phones and take control of their cameras and microphones without the user having to click anything to let them in.

In such cases, said Marczak, “there doesn’t need to be any interaction on the part of the person being targeted.”

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

A Red Deer man, who has been declared a dangerous offender, lost his appeal of an aggravated assault conviction from 2017.
Advocate file photo
Red Deer man who chomped on remand centre inmate’s ear loses aggravated assault appeal

Inmate lost part of his ear in attack at Red Deer Remand Centre in August 2017

Red Deer's Tammy Cunnington picked up a gold medal in the S4 women's 50 metre backstroke at the Pan Pacific Para-Swimming Championships in Cairns, Austraila. (Photo Courtesy of Brian Cassey Cairns 2018 Pan Pacific Para-Swimming Championships/ Swimming Canada)
Red Deer’s Tammy Cunnington eyes trip to 2021 Paralympic Games

“It would be just that last icing on the cake of my journey.”

A 36-year-old Eckville man was sentenced in Red Deer provincial court to 18 years in prison and declared a long-term offender for abusing children as young as two.
Advocate file photo
Updated: Central Alberta pedophile sentenced to 18 years in prison and declared a long-term offender

Eckville man abused nearly a dozen children as young as two over nearly a decade

Sundre RCMP charged two people with drug trafficking. (File photo by Advocate staff)
$50,000 solar light tower stolen in 2019, recovered in Central Alberta

A solar light tower valued at over $50,000 was recovered by Wetaskiwin… Continue reading

Justin Kripps of Summerland and his team have competed in Olympic action and World Cup competitions in bobsleigh. (Jason Ransom-Canadian Olympic Comittee).
QUIZ: Are you ready for some winter sports?

It’s cold outside, but there are plenty of recreation opportunities in the winter months

A medical team of the new Nurse Isabel Zendal Hospital apply a fiberoptic bronchoscopy to a patient inside a COVID-19 ICU in Madrid, Spain, Monday, Jan. 18, 2021. As the coronavirus curve of contagion turned increasingly vertical after Christmas and New Year's, the Zendal has been busy. On Monday, 392 virus patients were being treated, more than in any other hospital in the Madrid region. (AP Photo/Bernat Armangue)
Panel: China, WHO should have acted quicker to stop pandemic

GENEVA — A panel of experts commissioned by the World Health Organization… Continue reading

File photo
Wetaskiwin Crime Reduction Unit recovers valuable stolen property

Property valued at over $50,000 recovered by Wetaskiwin Crime Reduction Unit.

Karina Gould, Minister of International Development, holds a news conference on Parliament Hill in Ottawa on Thursday, Dec. 10, 2020. THE CANADIAN PRESS/Sean Kilpatrick
COVID-19 vaccines: Canadians torn between helping the world and helping themselves

MONTREAL — The COVID-19 vaccine rollout is highlighting the disconnect between the… Continue reading

A worker installs flags on Pennsylvania Avenue in front of the White House ahead of President-elect Joe Biden’s inauguration ceremony, Tuesday, Jan. 19, 2021, in Washington. THE CANADIAN PRESS/AP/David Phillip
‘Very mesmerizing’: Canadians eye Biden inauguration with relief, anxiety

Katie Thompson noticed a pattern emerging with appointments made at her chiropractic… Continue reading

Parliamentary interpreter Nicole Gagnon poses for a photo on Parliament Hill, Tuesday January 19, 2021 in Ottawa. THE CANADIAN PRESS/Adrian Wyld
Parliamentary hearings over Zoom an ongoing headache for translators

OTTAWA — Each day, translator Nicole Gagnon wakes up and heads to… Continue reading

People lineup at a hotel for the homeless before the 8 p.m. COVID-19 curfew on Jan. 11, 2021, in Montreal. THE CANADIAN PRESS/Ryan Remiorz
Montreal mayor wants homeless exempted from curfew in wake of Innu man’s death

Montreal’s mayor is calling on the provincial government to exempt homeless people… Continue reading

Conservative MP Derek Sloan arrives at West Block Thursday December 3, 2020 in Ottawa. THE CANADIAN PRESS/Adrian Wyld
Tories unsettled over whether ends justifies the means in ouster of Derek Sloan

OTTAWA — Efforts to oust controversial Conservative MP Derek Sloan from the… Continue reading

Prime Minister Justin Trudeau listens to a question as he participates in a news conference at Rideau Cottage in Ottawa, Tuesday, Jan. 19, 2021. THE CANADIAN PRESS/Adrian Wyld
No Pfizer-BioNTech vaccine doses to be shipped to Canada next week: Fortin

OTTAWA — Canada is not going to get any vaccine does from… Continue reading

Most Read