How Jeff Bezos’ iPhone X Was Hacked by Saudi Arabia

Jeff Bezos owns not just Amazon, but also the Washington Post, a newspaper highly critical of both President Donald Trump and Crown Prince of Saudi Arabia, Mohammad Bin Salman Al Saud. Bezos has been on both their radars for quite some time, with Mohammad Bin Salman potentially going so far as to order a hit on a Jamal Khashoggi, a Saudi dissident and journalist for The Washington Post before his untimely death in the Saudi consulate in Istanbul, Turkey on October 2, 2018.

This in-depth New York Times articles details a likely scenario how Jeff Bezos had his iPhone X hacked purportedly by Saudi Arabia:

On the afternoon of May 1, 2018, Jeff Bezos received a message on WhatsApp from an account belonging to Saudi Arabia’s crown prince, Mohammed bin Salman.

The two men had previously communicated using the messaging platform, but Mr. Bezos, Amazon’s chief executive, had not expected a message that day — let alone one with a video of Saudi and Swedish flags with Arabic text.

The video, a file of more than 4.4 megabytes, was more than it appeared, according to a forensic analysis that Mr. Bezos commissioned and paid for to discover who had hacked his iPhone X. Hidden in that file was a separate bit of code that most likely implanted malware that gave attackers access to Mr. Bezos’ entire phone, including his photos and private communications.

People all over the world use WhatsApp on a daily basis without nary a clue about the myriad of security vulnerabilities that exist within this Facebook owned product. It is currently unknown what specific vulnerability was exploited to obtain access to Bezos's iPhone X. The likely possibility is the government of Saudi Arabia either already had a weapon available for a high value target, or they purchased one off the dark web specifically for this operation. It quite possibly could even have been a commercial entity specializing in selling vulnerability information to government entities.

“This case really highlights the threats that are posed by a lawless and unaccountable private surveillance industry,” said David Kaye, the United Nations special rapporteur who was a co-author of Wednesday’s statement. “The companies who are creating these tools are extremely crafty and aggressive, and it’s a cat-and-mouse game at this point.”

The malware-for-sale industry is extremely aggressive, with purveyors charging extremely high prices for their unknown wares. Windows vulnerabilities, for example, have been sold for as high as one-million dollars.

Malware that was created for the explicit purpose of prying into private online communications, also known as spyware, has become a $1 billion industry. While companies like the NSO Group and Hacking Team have been accused of deploying their spyware with governments to monitor dissidents and others, smaller companies also sell simpler versions of the software for as little as $10, allowing people to snoop on their spouses or children.

While Apple has done a fantastic job with the security of the iOS and iPadOS operating systems, they are not infallible. There are likely a number of existing vulnerabilities within the OS that sophisticated government agencies like the NSA, GCHQ, ASD, MSS, GRU, and others are aware of and stockpiling for use at the right time. This is not just an iOS or iPadOS issue, but something common across all operating systems from Windows to MacOS to Linux.

There is no definitive answer to-date on the specifics of how the attack occurred, what vulnerability was exploited, or even if it was in fact something specific to WhatsApp. Hopefully details will be published once the forensics and malware analysis has been completed. This is something not only Apple needs to be made aware of and fix, but the world should be informed about so everyday users can take caution moving forward.