Experts say FTI's report on the hack of Bezos' phone does not explain why FTI wasn't able to decrypt the malicious file or perform actions like jailbreaking
@billmarczak @ErrataRob @matthew_d_green + more in @CyberScoopNews https://www.cyberscoop.com/... Alex Gantman / @againsthimself : Ok, this report is pretty bad and only serves to lower (if not wholly erode) my confidence in claimed conclusions. https://twitter.com/... Alex Stamos / @alexstamos : If the video is the initial point of exploitation, then there MUST be some evidence of that in the video file itself. It's true that this will just be a first stage exploit that pulls down the rest of the malware, but the actual exploit and a bit of ARM shell must be there. Alex Stamos / @alexstamos : So how did FTI see enough of the video to characterize it and perform a “cursory analysis” but not an in-depth analysis? If they have the locally cached messages, then they should also have the ephemeral encryption key to decrypt the entire video. Alex Stamos / @alexstamos : If FTI doesn't have the capability to do this analysis themselves, then they should ask for WhatsApp's help in decrypting the file and then should allow FB and Apple to investigate (there is at least one WA and one iOS vuln involved here). Alex Stamos / @alexstamos : This is the behavior you would expect from WhatsApp. WA is targeted for slow/lossy networks, so the main control channel between the app and WA's servers is extremely optimized (Noise instead of TLS, 25519 instead of RSA). This is all documented here: https://www.whatsapp.com/... Alex Stamos / @alexstamos : This is the normal behavior of WhatsApp. It allows the app to keep working while the client tries to download the huge 8min 4k video your Mom sent of your nephew playing with a dog to the entire family group (um, to pick a totally random example). Nothing mysterious. Alex Stamos / @alexstamos : The initial reporting about an “encrypted downloader” for the WhatsApp video were rather confusing. Now that we can see the report, it looks like this is just a normal attachment as delivered by WhatsApp. Here are the relevant parts of the report. https://twitter.com/...
Context & Ripple Effects
FTI's report on the intrusion into Jeff Bezos' phone is drawing unusually public pushback from the mobile-security community: Alex Gantman calls it 'pretty bad,' and Alex Stamos argues that if the video file was the initial exploitation vector, the first-stage exploit and ARM shellcode must be recoverable from the file itself. The core complaint, per the relationships here, is that FTI never explains why it could not decrypt the malicious file or perform standard steps like jailbreaking.
The dispute lands in a field with a documented track record of contested claims: researchers previously disputed WhatsApp's end-to-end encryption assurances, and Jonathan Zdziarski showed years ago that deleted WhatsApp messages leave reconstructable forensic artifacts. The Bezos case is now testing whether high-profile intrusion reports get held to a reproduce-it-or-doubt-it standard.
First-order effects
- FTI's credibility with security researchers takes a direct hit, with Marczak, Rob Graham, Green, Gantman, and Stamos all publicly flagging unexplained analytical gaps rather than disputing the conclusion itself.
- Whoever relies on FTI's findings — the client and any parties acting on the attribution — now has an evidentiary basis that independent experts say they cannot verify from the published report.
Second-order effects
- Rival forensic firms face implicit pressure to publish reproducible artifacts — decrypted payloads, jailbroken device images — because the Bezos review shows clients that a report without them invites public erosion of confidence.
- The episode feeds the recurring argument over what messaging platforms can actually guarantee: after earlier disputes over WhatsApp's encryption claims, buyers of forensic work will weight demonstrated capability over asserted conclusions.
Third-order effects
- If the pattern holds, commercial incident-reporting moves toward a verification regime where third-party researchers expect raw evidence access, and reports that cannot be independently reproduced carry discounted weight in legal and reputational disputes.
- The broader arc — contested encryption claims, forensic artifacts, and later confirmed zero-click iOS exploits against targeted users — points toward mobile intrusion attribution becoming a standing adversarial audit process rather than a single firm's deliverable.
The trend: High-profile phone-hack attributions are shifting from take-the-investigator's-word conclusions to publicly contested analyses judged by whether outside experts can reproduce the underlying evidence.