An iPhone belonging to Amazon CEO Jeff Bezos likely was
hacked by Saudi Arabian prince Mohammed bin Salman (MBS) or operatives working
on his behalf, a technical report
indicated.
Forensics on the phone showed it “was compromised via tools
procured by Saud al Qahtani,” a close confidant of the prince, Motherboard cited
a report by FTI Consulting as finding. Researchers also said the phone had not
been infected with malware but did contain a suspicious file, whose download
from a WhatsApp message preceded the months-long exfiltration of a large volume
of data.
Hours after the encrypted
downloader was received, “a massive and unauthorized exfiltration of data from
Bezos’ phone began, continuing and escalating for months thereafter,” the
report said, noting that the daily exfiltration of data on the phone ticked up
from 430KB to 126MB after the video, which appeared to be a promotional video in
Arabic about telecommunications.
“The reporting indicates that Mr. Bezos was in a WhatsApp chat with KSA’s Mohammed bin Salman when — unprompted — the Prince sent him a video file,” said Rosa Smothers, senior vice president of cyber operations at KnowBe4, contending that the motive was striking at Bezos, who owns the Washington Post, which had reported extensively about the October 2018 murder by the Kingdom of the Post’s journalist Jamal Khashogi.”
Her colleague, Roger Grimes, data-driven defense evangelist at KnowBe4, expressed doubt that MBS himself had hacked Bezos’s phone, noting that using his own account would be “too immediately traceable.”
Instead, “it seems more likely that someone else broke into the Prince’s phone” by exploiting an unknown WhatsApp flaw “and then used his existing network of contacts and trust to spread to other targets, of which Bezos was one,” Grimes said.
“That part quickly points to a nation state intelligence agency,” he said, noting “the Saudis aren’t known for their cutting-edge hacking. Of course, any nation state can buy that expertise, which is what appears to have happened here.”
