Jeff Bezos Allegations Put Phone Hacking Tech in the Spotlight

Here is how smartphones can be hijacked and a look at the potential consequences.

By Reuters | Updated: 25 January 2020 11:13 IST

Jeff Bezos Allegations Put Phone Hacking Tech in the Spotlight

Smartphones are effectively pocket-sized computers that have enabled various potential security problems

Highlights

Smartphone apps often carry potential flaws
It is virtually impossible to guarantee total security
NSO and other spyware vendors are found to help hackers

Allegations that Amazon.com boss and Washington Post owner Jeff Bezos had his phone hacked by Saudi Crown Prince Mohammed bin Salman have put a spotlight on the security of smartphones and the secretive tools used to hack them.

Smartphones are effectively pocket-sized computers that run apps on operating systems such as Apple's iOS or Google's Android. Those devices have enabled a new world of connectivity - unlimited free calls over WhatsApp, for example, or an atlas worth of up-to-the-second maps from Google - but also a parade of potential security problems.

Here is how smartphones can be hijacked and a look at the potential consequences and the thriving market in surveillance vendors helping the world's spies get access to people's secrets.

Samsung Wins Patent for a Tri-Fold Smartphone With Specialised Barrier Layer for Improved Durability

How it works
Smartphones operate through a collection of apps, sometimes scores of them, running over an operating system, which in turn runs on a complex piece of hardware embedded with receptors, lenses, and sensors.

Each one carries potential flaws - sometimes called bugs - that can cause a system to crash or behave unexpectedly when sent a rogue command or a malicious file. Even small openings like that can allow hackers to take control of a device. It is akin to illicitly lowering a coat hanger through a tiny seam in the car door to unlock a vehicle.

Many developers work hard to ensure those seams stay sealed, but with millions of lines of code to choose from, it is virtually impossible to guarantee total safety.

Saudi Arabia Involved in Hacking of Bezos' Phone, UN Report Tipped to Say

"There is no software that is bugless," said Oded Vanunu, a researcher with Israeli cybersecurity firm Checkpoint who often finds flaws in popular messaging programs.

Once hackers are in, the possibilities are vast - and frightening. Anyone with full control of a smartphone can turn it into a powerful surveillance device, silently tracking users' locations while quietly copying their emails, instant messages, photos and more.

A 2015 technical document from NSO Group - one of the better known spyware vendors - outlines the capability of its Pegasus spyware programme to monitor the smallest details of a target's life, throwing up alerts if a target enters a certain area, for example, or if two targets meet, or if a certain phone number is called.

UN Experts Demand Probe Into Alleged Saudi Hack of Amazon Boss Bezos

The document, made public as part of a lawsuit against NSO by communications firm WhatsApp, shows how keystrokes can be logged, phone calls can be intercepted and a feature dubbed "room tap" uses a phone's microphone to soak up ambient sound wherever the device happens to be.

The document says the spyware can be installed by enticing targets to click malicious links or rogue text messages, but spies particularly prize the quieter "push message" installations that remotely and invisibly install themselves on users' phones.

Who it targets
NSO and other spyware vendors have long argued that their products are used responsibly - only sold to governments for legitimate purposes. NSO has denied any link to the alleged Bezos hack. Saudi officials dismiss allegations of their involvement as absurd.

Jeff Bezos Phone Hack: What We Know, and Don't

Years of investigative work from Internet watchdog group Citizen Lab - which has a well-documented record of exposing international cyber espionage campaigns - and a drumbeat of court cases and leaked documents have called such assertions as these of responsible use into question.

In October of last year messaging company WhatsApp sued NSO in California, alleging that the spyware firm had taken advantage of a bug in the app's video calling protocol to hack 1,400 users around the world in the period between April 29 and May 10, 2019, alone.

Disclosures from other companies such as Italy's now-defunct Hacking Team and the spyware company now known as FinSpy have also raised questions about the business. Hacking Team's spyware was implicated in spying campaigns against dissidents in Ethiopia and the Middle East, for example, while researchers have recently found evidence that FinSpy's software was used in Turkey.

WhatsApp Says Israeli Spyware Used to Target Indian Journalists, Activists

Both companies' tools work similarly to NSO's — using flaws in smartphones to subvert the devices entirely.

What Is Pegasus Spyware That Allegedly Targeted Indians on WhatsApp?

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.