Jeff Bezos allegedly hacked by Saudi Arabia, Microsoft's customer support record GAF, and the T-vose Chris Roberts on the perils of connected ovens. These stories and more, in this week's ISEMG security report. Hello, I'm Nick Hond. If you're the richest man in the world, you might be assumed that you'd have your most sensitive data protected to the nth degree.
Apparently not the case. As we've learned this week, the absence of Jeff Bezos may have had his iPhone hacked using the official WhatsApp account of Saudi Grand Prince Mohammed bin Salman. The election means of access, they exchange phone numbers. Which begs the question, just which other world dignitaries and top-tier executive sensitive data might Saudi Arabia have access to.
With the story, is ISEMG's executive editor, Data Bridge to David Europe, Raffy Schwartz? Did billionaire Jeff Bezos' smartphone get pwned by hackers working at the behest of a Saudi Crown Prince? Those with allegations leveled Wednesday by two United Nations experts who have called for an urgent investigation into the hacking of Bezos' phone, which was an Apple iPhone X. Agnes Calamard and David Kay, who are UN Special Rapporteur, Calamard on summary executions in ex-traditional killings and Kay on freedom of expression, say the Saudis appear to be trying to intimidate Bezos, the founder of Amazon, as well as the owner of the Washington Post.
The UN experts say messages sent to Bezos appeared to have been designed to intimidate him and to try and drive the post away from covering Saudi Arabia in anything but a positive light. The Wall Street Journal reports that the FBI is investigating the hack, but Bezos didn't want to turn his phone over to the bureau. So instead, he's worked with FTI consulting in Washington, which is staffed by several former FBI officials who have been running the probe while liaising with government investigators. A copy of their digital forensic investigation results leaked on Wednesday.
The UN report also cites the report's findings at length. FTI consulting's report provides a timeline for the events leading up to the apparent hacking of Bezos' phone. On April 4th, 2018, Bezos met Muhammad bin Salman, or MBS, at a dinner party and they exchanged phone numbers. One month later, Bezos received a text from MBS' WhatsApp account, which had a large video file attached, including an encrypted downloader, which FTI consulting suspects was used to install malware that compromised Bezos' phone.
To date, the malware hasn't been recovered, although hacking capabilities such as these are available from the likes of surveillance software makers Hacking Team, based in Milan, Italy, which is part owned by Saudi government officials, as well as from Israel-based NSO Group, among others. However, Bezos' phone got hacked. FTI consulting says that within hours of the phone receiving the video file, Bezos' iPhone data egress jumped from a normal-looking 430 kilobytes per day, up to 126 megabytes per day, and hovered for months afterwards at about the 101 megabyte mark. Bezos also received two texts from MBS, or his WhatsApp account, at least, that suggested that the Saudis knew five of the information about Bezos before it became public.
On November 8th, 2018, one month after Washington Post columnist Jamal Khashoggi was assassinated, its Saudi Arabia's Istanbul consulate by a Saudi hit team, Bezos received a text that included a photograph of a woman who resembled Lauren Sanchez, with whom the married Bezos was having a then-secret affair. The photo was sent to the guys of a meme, which read, arguing with a woman is like reading a software license agreement. In the end, you just have to ignore everything and click, I agree. FTI consulting notes that MBS and Bezos were not in the habit of swapping internet memes.
Three months later, on February 14th, 2019, Bezos was briefed via two phone calls on an investigation into Saudi campaigns against him. Two days later, a message from MBS' WhatsApp account to Bezos read, Jeff, all what you hear or get told is not true, and also that there is nothing against you or Amazon from me or Saudi Arabia. Based on these findings, the UN Rapporteur calls for an immediate investigation by the US and other relevant authorities into the possible involvement of the crown prince and surveillance of Bezos. In reference to influence, if not silence, the Washington Post is reporting on Saudi Arabia.
They added that investigators should also probe the continuous multi-year direct and personal involvement of the crown prince in efforts to target perceived opponents. In short, powerful Saudi government figures appear to have attempted to blackmail the owner of the Washington Post after hacking his smartphone, but their seemingly clumsy efforts appear to have blown up in their face. What happens next, however, remains to be seen. For Information Security Media Group, I'm Matthew Schwartz.
You're listening to the ISMG Security Report on ISMG Radio, your number one source for information and security news. It must be a rather embarrassing blow to Microsoft's reputation as a leader in secure cloud data, and security researchers discovered that the tech giant exposed a quarter of a billion customer search records in December. With more, his ISMGs mentioned head to security technology, Jeremy Kirk. The Elasticsearch database thorn has pricked another company, and this time, it's Microsoft.
The company quickly shut off access late last month to five open Elasticsearch databases. The databases contained nearly identical copies of 250 million customer support records. It's an embarrassing gaff for one of the largest technology companies. Security researcher Bob DiCenco found the databases on December 29th using the binary-edge search engine, which scours the internet for metadata on connected devices.
Within a day, Microsoft secured the databases. Elasticsearch is a popular open-source search engine and analytics platform used for large stores of data. It runs in the cloud, and a failure to properly configure it means that data could be open to anyone on the internet. Microsoft publicly disclosed the issue on Wednesday and apologized, blaming a misconfiguration of security rules.
However, it said the investigation had not uncovered signs of malicious use. The databases contained internal customer support records spanning from 2005 through last year. It included email addresses, IP addresses, locations, customer support interactions, and confidential internal notes. Microsoft says as commercial cloud services such as Azure were unaffected.
It says the vast majority of the records, however, were redacted. It uses tools to automatically remove personal information. Some records may have been exposed under certain conditions. The company didn't answer a query from ISMG asking what percentage of the records may have had unredacted information exposed.
The company traced the exposure to a change engineers made on December 5th. The network security group for the databases contained misconfigured security rules. On New Year's Eve, Microsoft fixed the configuration. As a result of the incident, Microsoft says it's taking steps to prevent future ones.
That includes auditing and security rules. It plans to expand the scope of tools it uses to detect security rule misconfigurations. It will also expand its alerting systems to try and catch when security rule misconfigurations occur. Microsoft's mistake is a reminder once again to triple check database rules as wrong ones for MongoDB, S3 buckets, and Elasticsearch over the years as resulted in problems for many organizations.
For Information Security Media Group, I'm Jeremy Kirk. Finally, I'm the opportunity this week to interview the network's chief security strategist Chris Roberts. Chris' true vocation, however, is provided in the first word was LinkedIn profile. Hacker.
In his own words, he's got wings, wheels, tracks, tires, fins, or has a brain, then probably elbow deep in its code, trying to make it do more things. Chris and I covered a lot of ground in our interview. In this excerpt, we discussed basic cyber hygiene, archaic perceptions of the perimeter, and the perils of connected doorbells and ovens. Kicking off, here's some stage advice from Chris about where companies should prioritize spending today.
There's some simple stuff that you don't have to spend a fortune on. I mean, just easy stuff. I mean, awareness training. It's not going to stop everything from happening, but it's sure as hell going to take you off the top tier list.
If you can train and you can work with your user population on a regular and ongoing basis, not just once a year, and actually help them understand what looks real, what is real, what's not real, and really just continuing to reinforce that message on a regular cyclical basis, that's at least going to take you off the bottom of the ladder. We talked about it a little bit as well, but patching, I mean, for goodness sakes, simple stuff like that, not just patching a couple of machines, but actually really taking a much more effective look at it. And probably even before that, understanding your environment more effectively. I mean, I can't tell you how many companies I've gone into either from the Ativa standpoint, or prior engagements and prior work that I've done, where you plug into the network and you can see absolutely everything.
Separation and segmentation are just one of these other buzz words. I'm like, good grief guys. This has been 20, 30 years, we've found this. I mean, that's further compounded by cloud, and then obviously the use of third party cloud vendors and APIs and everything pertaining to that.
Oh, God. Well, I mean, so again, you take the human mentality. How many companies do you know that sit either behind their firewall or behind their doors and go, this is my perimeter? Yeah, it doesn't exist.
But people still people will still believe it, because again, we have not been good enough to help them understand, you know, when you wake up in the morning, the first thing you reach for is your mobile telephone that's connected to the car and the dam fridge and a few other things. That's where your data is. How do you effectively manage that? Right.
I've read some of the other thing, I think there's something like 20 million connected doorbells in the US already. So it's, you know, that she's scary that she is out of the talk will get and growing. So oh, man, that's, uh, I remember at the unnamed security conference that's coming up soon that shall not be, you know, I feel like it's a hallowed name that we shall not say. I, I did a, I did a talk when we actually broke into somebody's oven from their phone.
We, we cloned the phone. We broke into the oven from the oven. We got to their home computer. We pay loads of the hell out of that and wait until their work computer turned up.
It infected the work computer and then we just got into their company through that way, all through the, all through the app from the oven. That's it for this week's Ice and Security Report. The music is by EitherCaudio. I'm Nick Collins.
Catch you next time.