- Amazon CEO Jeff Bezos had his phone hacked in May 2018, and the primary suspect is Saudi Crown Prince Mohammed bin Salman.
- A UN report published Wednesday said a forensic analysis concluded that Bezos’ iPhone was likely hacked using a notorious tool named Pegasus created by the NSO Group, a secretive firm from Israel that bills itself as a leader in cyberwarfare. Saudi officials have been repeatedly connected to Pegasus hacks, according to the report.
- Pegasus enables hackers to remotely access everything in an infected smartphone, from text messages to location data – and it’s next to impossible to know without a professional analysis whether your phone was infected.
- In the case of Bezos, the analysis found that hackers had access to his phone for months, according to the UN report.
- Visit Business Insider’s homepage for more stories.
The primary suspect in the hacking: Saudi Crown Prince Mohammed bin Salman, who he was exchanging WhatsApp messages with.
The how of the hack, according to the report, is maybe the wildest detail: A 2019 forensic analysis of Bezos’ iPhone “assessed with ‘medium to high confidence’ that his phone was infiltrated on 1 May 2018 via an MP4 video file sent from a WhatsApp account utilised personally by Mohammed bin Salman, the Crown Prince of the Kingdom of Saudi Arabia.”
The analysis found that Bezos’ phone was likely hacked using a notorious tool named Pegasus created by the NSO Group, a secretive firm from Israel that bills itself as a leader in cyberwarfare.
So how does Pegasus work? And how did it get inside the phone of the richest man in the world?
What is Pegasus?
What Pegasus does is relatively simple: The tool provides full access to an infected smartphone, remotely and discreetly.
That includes text messages, as well as your smartphone’s camera and microphone. The spyware was created by an Israeli company, the NSO Group, and it’s nothing new.
Pegasus was discovered in 2016 when a man in the United Arab Emirates named Ahmed Mansoor was targeted with “suspicious text messages,” John Scott-Railton, a senior researcher at The Citizen Lab at the University of Toronto’s Munk School, told Business Insider in an interview last May.
The Citizen Lab is an academic research group credited with being the first to identify Pegasus.
“Those text messages actually came bearing some suspicious links,” he said. “We thought they looked pretty dicey, so my colleague Bill [Marczak] borrowed a colleague’s iPhone, clicked on the links, and was able to successfully get the phone infected with what was then a mystery piece of spyware.”
That “mystery” spyware was Pegasus, and Mansoor was being targeted – most likely because of his work as a human-rights advocate. Mansoor is serving a 10-year prison sentence in the UAE for publicly criticising the government.
Here’s a photo of the smartphone-hacking hardware that NSO Group sells.
Business Insider’s Becky Peterson snapped a photo of the hacking hardware sold by NSO Group at a security conference in Paris.Read more about the photo here.
How was Bezos’ phone hacked?
The UN report said the analysis of Bezos’ iPhone found that Bezos and Crown Prince Mohammed “exchanged phone/WhatsApp numbers the month before the alleged hack.”
It’s through this connection, the analysis found, that the hack was performed.
The analysis “assessed with ‘medium to high confidence’ that his phone was infiltrated on 1 May 2018 via an MP4 video file sent from a WhatsApp account utilised personally by Mohammed bin Salman,” the report said.
In short: The analysis contends that Crown Prince Mohammed sent Bezos a video file that, regardless of him clicking on the file, enabled Pegasus to infiltrate Bezos’ iPhone.
The report said the analysis found that “within hours of receipt of the MP4 video file from the Crown Prince’s account, massive and (for Bezos’ phone) unprecedented exfiltration of data from the phone began.”
The content of the video wasn’t made clear in the report, but The New York Times described it as having “an image of Saudi and Swedish flags overlaid with Arabic text.”
How do you know whether your phone is infected with spyware like Pegasus? If the hackers are doing their job right, it’s extremely difficult to find out.
If your phone is infected with spyware like Pegasus, it’s extremely difficult to know – even if you’re Jeff Bezos.
The phone probably won’t start suddenly overheating or ripping through battery life. If that were the case, “then the people who did it have not done their jobs right,” Scott-Railton said.
In fact, if you’re not a cybersecurity researcher, it’s nearly impossible to know.
“It’s quite tricky, because the software is, of course, designed to be hard to find,” Scott-Railton said. “What we did in the first instance was we actually captured the network traffic going into the phone after the [link] was clicked, and that gave us the infection.”
Unless you’re monitoring the network traffic going into your smartphone and are savvy enough to know what type of network traffic could demonstrate malicious behaviour, it’s unlikely that you’d catch spyware like Pegasus running on your device.
That’s exactly how investigators identified that Bezos phone was hacked.
The forensic analysis found that “massive and (for Bezos’ phone) unprecedented exfiltration of data from the phone began, increasing data egress suddenly by 29,156 per cent to 126 MB,” the UN report said. “Data spiking then continued undetected over some months and at rates as much as 106,032,045 per cent (4.6 GB) higher than the pre-video data egress baseline for Mr. Bezos’ phone of 430KB.”
Who makes Pegasus? And how is it used?
Pegasus is intended as a cyberweapon for use by international governments.
An Israeli company named NSO Group operates it, and the Israeli Ministry of Defence is said to regulate sales of the software outside Israel.
“We are selling Pegasus in order to prevent crime and terror,” NSO Group CEO Shalev Hulio told “60 Minutes” in an interview last year.
Hulio added: “Intelligence agencies came to us and say, ‘We do have a problem. With the new smartphones, we can’t get valuable intelligence.'”
An unnamed European security official confirmed to “60 Minutes” that NSO Group software had been used to thwart terrorist attacks in Europe.
“It wouldn’t surprise me to know that some of NSO’s claims about being used to go after criminals are correct,” Scott-Railton told Business Insider last May. “The issue is that the fact that it’s used lawfully doesn’t falsify all these abuse cases.”
What are some alleged Pegasus “abuse cases”?
Pegasus has been linked to the death of the Saudi journalist Jamal Khashoggi, and it was reportedly used to track a student in Canada who was critical of the Saudi government.
“His name is Omar Abdulaziz,” Scott-Railton said. “He’s a Saudi critic going to college in Montreal. We found that his infected phone was bouncing back and forth between his home network and his university gym over last summer.”
A similar story played out in Mexico in 2017, according to Scott-Railton:
“We had this crazy case that I found in Mexico back in 2017 where three people – a nutrition activist, a public-health researcher, and a consumer advocate – were all targeted with Pegasus in Mexico.
“The only thing that holds them in common is that they were all advocating to slightly increase the tax on soda beverages. So the most reasonable implication is that somebody from a private interest directed somebody from the government in order to target these people because they were pushing against the soda lobby in Mexico. State-grade malware – it’d be like targeting somebody with Stuxnet because they had suggested there be a $US0.10 bottling fee on Coca-Cola.”
In the case of Bezos, the UN report linked his ownership of The Washington Post to being targeted by the Saudi crown prince: “This was part of a massive, clandestine online campaign against Mr. Bezos and Amazon, apparently targeting him principally as the owner of The Washington Post.”
For its part, NSO Group has flatly denied that Pegasus software was used to hack Bezos. “We can say unequivocally that our technology was not used in this instance,” a statement on its website said.
Business Insider Emails & Alerts
Site highlights each day to your inbox.