December 4th, 2024

FBI tells telecom firms to boost security following Chinese hacking campaign

Federal authorities, including the FBI and CISA, urged telecom companies to improve security after the "Salt Typhoon" hacking campaign compromised private communications of many Americans, with China denying involvement.

Read original articleLink Icon
FBI tells telecom firms to boost security following Chinese hacking campaign

Federal authorities, including the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), have urged telecommunications companies to enhance their network security in response to a significant Chinese hacking campaign. This campaign, referred to as "Salt Typhoon," has reportedly allowed Chinese hackers to access private communications of numerous Americans, including metadata and, in some cases, actual audio files and text content. The full extent of the breach remains unclear, with officials still investigating the number of victims and whether hackers retain access to U.S. networks. The warning was issued in collaboration with security agencies from New Zealand, Australia, and Canada, highlighting the global implications of the threat. The FBI has contacted some victims, primarily those in government and political roles, while telecom companies are responsible for notifying their customers. The guidance provided to telecom firms includes technical recommendations such as encryption and consistent monitoring to prevent future intrusions. Officials acknowledge that while these measures may disrupt current operations, the threat from such actors is likely to persist. China has denied allegations of cyberespionage, labeling them as disinformation and asserting its opposition to cyberattacks.

- The FBI and CISA have issued security recommendations to telecom companies following a Chinese hacking campaign.

- The campaign, known as "Salt Typhoon," has compromised private communications of many Americans.

- The full scale of the breach and the number of victims remain unknown.

- Recommendations include encryption and monitoring to enhance network security.

- China has denied involvement in cyberespionage, calling U.S. claims disinformation.

Link Icon 4 comments
By @omgCPhuture - 2 months
"Encrypted". Emphasis on *transport cryptography! Signal etc mesages can be found in phone memory even after reboot. Someone should really hold a crash course on how to crypto on your devices from FS to messdate data over IP works: *It's not your crypto, but a bunch of others, (strangers, dangers) people's crypto who's __word__ you accept for Gospel (trust us, we know best!:) Not to mention if your packets have reached correct end point and not one the CA just says it the expected one__!*

* You blindly trust a daisy chain of stranger's word that their code and their CA and they themselves are uncrackable & secure. Would you trust strangers insisting on being all in your secure bits?

* Most industry CA based. hardware does not disclose vulnerablities or noice that patches are incoming t the end user, they secretley fix after their lients, your servivce provder typically, has beengiven advisories. Those rarely are givenn to the en dus,t he customer, because of NDA or even lazyness, security by obscurity incomeptence etc.

Smart device encryption is an illusion where your trust strangers with legal/financial or Intel motives to betray it, but call strangers fancy names like CA, ROot of Trust, etc.

The entire ecosystem of trust based device security crypto is to ensure their access to your daa, securely. Not to secure your data from them or the OEM, and TLS padlocks simply means the CA told your app whtever certificate pres4ented is the right one, green lighting you and that endpoint to negotiatie encryption, so for all you know you aor your app could be negotating encryption with the US FBI or $APT.

* CAs do get compromised by attacker, nation states & researchers,, encryption standards do get backdoored, with weak implementations or even kleptographic ones.

q: Why is the US FBI causing panic about suppposed chinese hacking isntead of contacting us service provides who can enable 4g / LTE IPSEC transport, supported by all certified handsets and USIM, yiuelding telecom network infratrcture acccess a moot point since ipsec tunnel is from you to your service provider and their end point.

A: You are victims of on-going psyop conditioninig you to trust blindly!

Do not fall for the temptation: Every part of the daisy chain of trust providers have insentives to screw you over at their whim...and then there is all the code they + you rely on to bootstrap that daisy chain of naive trust..

By @ozgrakkurt - 2 months
It is funny how they hate encryption because they want to spy on people and try to justify it by saying people share child porn and terrorists use it etc. But they start recommending it when it conflicts with their interests. Or it is not funny and it is just the way governments and companies work
By @webninja - 2 months
Respond to my comment with your recommendation(s) for apps that allow or assist you in contacting others with encryption strong enough to keep out state-level attackers.
By @hunglee2 - 2 months
it was FBI insistence of backdoors on telecomms infrastructure - in order to spy to US citizens - which created the vulnerability in the first place.