18 ms·
More telcos confirm Salt Typhoon breaches as White House weighs in
- monero-xmr 2y agoWasn’t it a couple years ago the intelligence community was arguing for backdoor mandates, and now the FBI recommends Signal for safe chats? Such a farce. Hopefully the new admin goes through their emails and text messages over the last 4 years. Privacy for me, not for thee, I suppose…
- snypher 2y agoIt doesn't take much to read between the lines on those two statements. Feds have access to Signal if they want it, but are using it as filter paper against most attacks against the public etc.
- tptacek 2y agoThe "feds" do not have access to Signal, except by CNE attacks against individual phones. Signal's security does not rely on you trusting the Signal organization.
- snypher 2y agoIt's ok for someone to believe that, but I don't believe that. Unfortunately there is no practical way to verify it either.
- cosmojg 2y agoWhat are you talking about? Signal is open source, and its cryptographic security is trivially verifiable. If you don't trust the nonprofit behind it for whatever reason, you can simply compile it yourself.
- warkdarrior 2y agoIf you compile it yourself, can you still connect to the Signal servers?
- greyface- 2y agoAnd, even if you can connect with your own client, can you trust the server is running the code they claim it is? They were caught running proprietary server code for a time in 2020-2021. https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-798900367 https://github.com/signalapp/Signal-Android/issues/11101#iss... / https://news.ycombinator.com/item?id=26715223 https://news.ycombinator.com/item?id=26715223
- tapoxi 2y agoBut the client is designed to not trust the server, that's why encryption is end-to-end. So does it matter?
- greyface- 2y agoIn some sense, no - the protocol protects the contents of your messages. In another sense, yes - a compromised server is much easier to collect metadata from.
- tptacek 2y agoMetadata, yes. Of course, the protocols, and thus all the inconveniences of the Signal app people constantly complain about, are designed to minimize that metadata. But: yes. Contents of messages, though? No.
- greyface- 2y agoIf Signal, the service, was designed to minimize metadata collection, then why is it so insistent on verifying each user's connection to an E.164 telephone number at registration? Even now, when we have usernames, they require us to prove a phone number which they pinky-swear they won't tell anyone. Necessary privacy tradeoff for spam prevention, they say. This isn't metadata minimization, and telephone number is a uniquely compromising piece of metadata for all but the most paranoid of users who use unique burner numbers for everything.
- bryant 2y agoWell, if you're in a position where you can only put faith in someone else's word as to whether it's good for your needs (this is the vast majority of people), there's this: https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
- fragmede 2y ago> Unfortunately there is no practical way to verify it either. discuss an exceedingly clear assassination plot against the President exclusively over signal with yourself between a phone that's traceable back to you, and a burner that isn't. if the secret service pays you a visit, and that's the only way they could have come by it, then you have you answer.
- buckle8017 2y agoSignal's servers have access to your profile, settings, contacts, and block list if the PIN you select has low security.
- tptacek 2y agoWhich is to say: in the worst-case plausible failure model for Signal, they get the same metadata access as all the other messengers do. OK!
- fragmede 2y agoThreema leaks no such metadata
- tptacek 2y agohttps://breakingthe3ma.app/ https://breakingthe3ma.app/ You want to use this, by all means.
- rkagerer 2y agoWere any/all of those vulnerabilities mitigated?
- antgiant 2y agoPer the link. Yes. Here the specific statement. Lessons Learned We believe that all of the vulnerabilities we discovered have been mitigated by Threema's recent patches. This means that, at this time, the security issues we found no longer pose any threat to Threema customers, including OnPrem instances that have been kept up-to-date. On the other hand, some of the vulnerabilities we discovered may have been present in Threema for a long time.
- tptacek 2y agoFor what it's worth, and obviously I could have been clearer about this: what's interesting about that link is the description of Threema's design, not the specific vulnerabilities the team found.
- devops99 2y ago[flagged]
- int0x29 2y agoWhile the statments are contradictory I wouldn't take it as sign of some vast conspiracy. I would just take it as a sign they are stuck needing to give out some kind of guidance to prevent foreign access. While they are a domestic police service they are also a counterintelligence service and thus need to provide some guidance there.
- 2OEH8eoCRo0 2y agoTelcos need a way to comply with court orders. That's it.
- rsingel 2y agoNo, the feds require CALEA-backdoors. Absent CALEA, a telecom could say we don't have the data or the capability
- s5300 2y agoUS Military has atleast privately switched away from any Signal usage within the past few months – it’s undoubtedly compromised in some way. If the FBI is recommending it it’s for exploitative purposes & a false premise of safety.
- blackeyeblitzar 2y agoSo what’s the alternative
- edm0nd 2y agoSession, Matrix, Tox perhaps
- glaucon 2y agoI know nothing about this field so I went looking for those product names. I believe the Session referred to is here ... https://getsession.org/ https://getsession.org/ Tox is here ? https://tox.chat/ https://tox.chat/ The Matrix i found seems to have been closed down earlier this month ... https://en.m.wikipedia.org/wiki/Matrix_(app) https://en.m.wikipedia.org/wiki/Matrix_(app) ... that's assuming I found the correct "matrix". If it matters to you don't take my word for those being the correct points of contact, that's just me searching for two minutes. As a side rant, I wish people would choose less generic names for their projects, calling something "session" ? You might as well call it "thing".
- 2y ago
- llamaimperative 2y agoNothing contradictory (in philosophy), really: they said American law enforcement should be able to break encryption when they have warrants and they now say Chinese spies should not be able to. This is obviously technically impossible, but the desire for that end state makes a ton of sense from the IC’s perspective.
- hunter2_ 2y agoThat something can simultaneously be impossible and sensible is peculiar. It almost suggests that the technique has merely not yet been figured out. Secrets fail unsafe. Maybe an alternative doesn't.
- btilly 2y agoIt is sensible that people would want the impossible. It isn't sensible to try to mandate it. Government keeps trying to mandate it in various ways. With predictably bad results.
- tzs 2y agoHow is it obviously technically impossible?
- btilly 2y agoWhatever method is available to American law enforcement is eventually going to become available to Chinese spies. The record of keeping this kind of secret is abysmal. If by no other means, then by social engineering the same access that local police departments were supposed to have. Salt Typhoon - which this discussion is about - is an example. Tools for tracking people that were supposed to be for our side, turn out to also be used by the Chinese. Plus the act of creating partial security often creates new security holes that can be exploited in unexpected ways. Either you build things to be secure, or you have to assume that it will someday be broken. There is no in between.
- llamaimperative 2y agoSomething either has X degree of security (for everyone) or it does not.
- Animats 2y ago"...implies that the attack wasn't against the broadband providers directly, but against one of the intermediary companies that sit between the government CALEA requests and the broadband providers" Yup. The attack hit the CALEA backdoor via a wiretapping outsourcing company. Which one? * NEX-TECH: https://www.nex-tech.com/carrier/calea/ https://www.nex-tech.com/carrier/calea/ * Substentio: https://www.subsentio.com/solutions/platforms-technologies/ https://www.subsentio.com/solutions/platforms-technologies/ * Sy-Tech: https://www.sytechcorp.com/calea-lawful-intercept https://www.sytechcorp.com/calea-lawful-intercept Who else is in that business? There aren't that many wiretapping outsourcing companies. Verisign used to be in this business but apparently no longer is.
- supriyo-biswas 2y agoThank you for posting this. The search term "calea solutions"[1] also brings up some relevant material, such as networking companies advising how to set up interception, and an old note from the DoJ[2] grumbling about low adoption in 2004 and interesting tidbits about how the government sponsored the costs for its implementation. [1] https://www.google.com/search?client=firefox-b-d&q=calea+solutions https://www.google.com/search?client=firefox-b-d&q=calea+sol... [2] https://oig.justice.gov/reports/FBI/a0419/findings.htm https://oig.justice.gov/reports/FBI/a0419/findings.htm
- tguvot 2y agowhere from ""...implies that the attack wasn't against the broadband providers directly, but against one of the intermediary companies that sit between the government CALEA requests and the broadband providers" comes from ? from schneier ? because if you go to the actual reporting in wsj for example, it doesn't imply that attack was against TTP providers. also TTP providers are optional
- Maxious 2y agoWSJ: U.S. Wiretap Systems Targeted in China-Linked Hack https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-t... That seems pretty clear.
- petesergeant 2y agoThe FBI has a weird mandate in that it's both counter-espionage and counter-crime, and those are two quite different missions. Unsurprising to know that counter-espionage want great encryption, and counter-crime want backdoorable encryption.
- JTbane 2y agoIt seems like every few years law enforcement puts out statements about how good encryption is for criminals, and then they have to walk it back as data breaches happen.
- kube-system 2y agoSometimes you're on offense, sometimes you're on defense. The government does both.
- rat87 2y agoYou want the new anti democratic/authoritarian administration to look through the FBIs emails to find something to frame them for? You sure that's wise? Even if they don't respect privacy like they should?
- devops99 2y ago[flagged]
- rsingel 2y agoWhat a load of horseshit. Yeah, if a nation-state thinks you are a bad enough actor, they might use a high power way to get at you. See Pegasus, for instance But those exploits are rare, expensive and can be blown. No one has ever said Signal is perfect security. But it is damn good. Your SMSes aren't sitting in plaintext on your mobile ISPs network. You aren't going to have them intercepted by a fake mobile tower. And if you and your recipients use disappearing messages, good luck to any prosecutor trying to get them off a device. And as for Apple sending a fake update? Might could happen but 1) Apple fought this once and 2) it'd be hard to do in any widespread way without being detected Saying Signal protects you from fuck all is not just wrong, it's irresponsible AF. It's like saying that locks, firewalls, alarm systems, curtains and network monitoring don't work because some people know how to defeat them. Signal is a great security upgrade for almost anyone. I love seeing more people use it. Normalizing encryption is great.
- devops99 2y ago[flagged]
- jesseendahl 2y agoThe amount of one-off work this would take is quite high, so the amount of motivation for a company like Apple to say “No, you can’t legally compel us to to allocate engineering resources to this” is also quite high. My point is that they (and other tech companies) would be highly incentivized against implementing something like a malicious update targeting a single device/user based purely on capitalistic motivations, rather than philosophical/ethical ones.
- devops99 2y agoI wish I could agree with you but the real world doesn't work this way. Companies that don't play ball get broken up with anti-trust. Or what happened to the CEO (former CEO) of Qwest happens. The "infrastructure" for the targeted updates is implemented by compartmentalized teams, who will be comprised of the clearance community, and the "external" people who work with them are a part of the clearance community.
- jmclnx 2y ago>This public-private effort aims to put in place minimum cybersecurity Nice, we do not what the CEOs of these telcos have to give up their bonuses. So we force them to do the just bare minimum. Isn't capitalism great.
- votepaunchy 2y agoMinimum is not “bare minimum”. The alternative to minimum requirements is no requirements.
- gertop 2y agoNot allowing foreign entities to spy on their customers feels like the bare minimum to me.
- JumpCrisscross 2y ago> So we force them to do the just bare minimum. Isn't capitalism great This has nothing to do with capitalism. The Soviet Union wasn’t a paragon of information security.
- lenerdenator 2y agoIt does, at least with respect to how the US does capitalism. The goal is to make the number at the bottom of the piece of paper bigger by a large enough margin in the next ninety days. If you can prove that there's the imminent risk of a specific cyberattack in the next 90 days and that it will have an adverse impact on getting that number bigger, fine, company leadership will pay attention, but that's rarely the case. Most cyberattacks are obviously clandestine in nature, and by the time they're found, the move isn't to harden infrastructure against known unknowns, but to reduce legal exposure and financial liability for leaving infrastructure unsecured. It's cheaper, and makes the number at the bottom of the piece of paper bigger.
- gruez 2y ago>The goal is to make the number at the bottom of the piece of paper bigger by a large enough margin in the next ninety days. If you can prove that there's the imminent risk of a specific cyberattack in the next 90 days and that it will have an adverse impact on getting that number bigger, fine, company leadership will pay attention, but that's rarely the case. 1. Capitalists seem pretty content with money losing ventures for far more than "the next ninety days", as long as they think it'll bring them future profits. Amazon and Uber are famous examples. 2. You think the government (or whatever the capitalism alternative is) aren't under the same pressure? Unless we live in a post scarcity economy, there's always going to be a beancounter looking at the balance sheet and scrutinizing expenses.
- nixosbestos 2y agoMeanwhile US banks, Venmo, PayPal, etc all insist on using "real" phone numbers as verification. Funny that Venmo won't let me use a voip number, but I signed up for Tello, activated an eSIM while abroad and was immediately able to receive an SMS and sign-up. For the high barrier cost of $5. Wow, such security. Bravo folks.
- blackeyeblitzar 2y agoThe problem is that VOIP numbers, from companies like Bandwidth, are frequently used to perform various frauds. So many financial services ban them because the KYC for real numbers is much better.
- mellow-lake-day 2y agoKYC = know your customer?
- tempodox 2y agoYes.
- dr_dshiv 2y agoIt has nothing to do with Kentucky’s Yummiest Chicken, if that’s what you were thinking.
- FergusArgyll 2y agoYes, and AML = Anti Money Laundering
- silisili 2y agoI have more bank and credit accounts than the average person, probably. 5 bank accounts, and 8 credits accounts I can remember as active off the top of my head. Every single one works with GVoice, except Venmo. Chase, Cap1, Fidelity, etc. Not small players. So while I think you make a fair enough argument for sure, it doesn't seem to be the case when nobody else does it, and makes Venmo seem like a pain in the arse.
- devops99 2y agoWe can never trust them again. We must implement as LAW that a SIM card can provide and only provide a Zero Knowledge Proof of "this SIM is valid for this cellular/data plan up to a specific date". If they want to track us all the time, whatever, if they can't keep that data safe from the Chinese Communist Party, then they aren't competent enough to have it.
- hooverd 2y agoI can't believe the CPC would do this- add a backdoor to American technology for American agencies.
- devops99 2y agobut that would be illegal and therefore impossibru /s
- rsync 2y ago"We must implement as LAW that a SIM card can provide and only provide a Zero Knowledge Proof ..." Now is a good time to remind everyone that a SIM card is a full blown computer with CPU, RAM and NV storage. Further, your carrier can upload and execute code on your SIM card without your knowledge or the knowledge of the higher level application processor functions of your telephone.
- deadso 2y agoIs there any sandboxing to prevent access from the SIM card computer to information on your phone? And if so, absent of some (admittedly not very unlikely) 0day allowing sandbox escape, what would a malicious SIM program be able to do?
- immibis 2y agoYes, the card is a peripheral device to the phone - a hardware security key. It can't steal all your data for the same reason your Yubikey can't. Answer delayed by hours due to HN rate limiting.
- yehbit 2y agoBetter security is smaller nodes or value and more of them. But it’s more profitable to say screw others security and monopolize everything
- freeqaz 2y agoI work in security and this surprised me to see. Not that these companies got hacked, but the scope of the attack being simultaneous. Coordinated. Popping multiple companies at the same time says something about the goals the PRD has. It risks a lot of "noise" to do it this way. Why not just bribe employees to listen in on high profile targets? Why try to hit them all and create a top level response at the Presidential level? This feels optics-driven and political. I'm not sure what it means, but it's interesting to ponder on. Attacking infrastructure is definitely the modern "cold war" of our era.
- buildbot 2y agoI think this is the perfect time to do something like this, in the midst of a presidential transition. Regardless of the outgoing and incoming politics, things will be more chaotic. While it won't be unnoticed, it's going to be down the lists of things to deal with probably, and possibly forgotten.
- mike_d 2y agoThis is a total yawn, and the norm. It looks coordinated because the team who focuses specifically on telecoms had their tools burned. Pick pretty much any sector of interest and the intelligence services of the top 50 countries all have a team dedicated to hacking it. The majority of them are successful. Sadly even most people in security are woefully unaware of the scope and scale of these operations, even within the networks they are responsible for. The "noise" here was not from the attacker. They don't want to get caught. But sometimes mistakes happen.
- 0xbadcafebee 2y agoInterestingly, some of those teams dedicated to hacking are either private sector or a branch that nobody has heard of. I once interviewed for a company whose pitch to me was basically "we get indemnity to hack foreign telcos" and "we develop ways to spy that nobody has thought of". That was 20 years ago
- hooo 2y ago
- ChrisArchitect 2y agoSome related prior discussion: PRC Targeting of Commercial Telecommunications Infrastructure https://news.ycombinator.com/item?id=42132014 https://news.ycombinator.com/item?id=42132014 AT&T, Verizon reportedly hacked to target US govt wiretapping platform https://news.ycombinator.com/item?id=41766610 https://news.ycombinator.com/item?id=41766610
- jmward01 2y agoThis is why we need device to device encryption on top of all the security that a telco has. There is no excuse for any connection I make being unencrypted at any point except the receiver.
- mike_d 2y agoWhile you aren't wrong about needing end to end encryption, that would not have helped here. What China was after was meta data (who is communicating with who), which is a completely different problem to solve.
- whimsicalism 2y agothe articles i saw said they could record phone calls at will
- trollied 2y agoYes, but not by man-in-the-middle attacks between the device and the network. There are systems internal to the provider that let you listen to any call.
- immibis 2y agoBecause the US government forces them to have these systems and to not encrypt the calls. There should be more attention on the fact that, essentially, the US government hacked US telecoms for China's benefit.
- 0xbadcafebee 2y agoSince the 80s you can spy on anyone's calls using the telco's standard maintenance features. You dial up a number, you then dial another number, and you're basically patched in to the second number, can listen in on any current call. There was a different system required by the government for taps, but linemen have their own method so they can diagnose issues. At least that used to be the case through the 2010s. Stupidity and banality is a far greater threat than conspiracy.
- BlueTemplar 2y agoAFAIK this would not be news for EU telecoms : they are being operated by Chinese companies, so those have permanent access to nearly everything anyway. https://berthub.eu/articles/posts/5g-elephant-in-the-room/ https://berthub.eu/articles/posts/5g-elephant-in-the-room/ So is that not the case for USA telecoms ?
- jart 2y agoWell at least American telecoms are fighting them. The European MO is to not only let themselves be conquered, but they actually pay China to do it. Thankfully American online services are on Europe's side, and work harder than anyone to protect their communications. These services don't even charge Europe anything, and Europe rewards them with billions of dollars of fines for doing it. Europe also defaced our websites in an effort to tax the attention economy, and removed legal protections for open source developers.
- __m 2y ago> American online services are on Europe's side, and work harder than anyone to protect their communications Yeah sure, except giving the NSA access and complying with the CLOUD Act.
- topspin 2y ago> fighting them That's amusing. I'll grant that US companies haven't outright surrendered, and are still at least permitted to engage in lip service on the issue. But actual "fighting"? That would mean a tech world that looks very different than what we have today, and would fatally conflict with no end of "interests" in the US.
- ggm 2y agoThis feels like the perfect time for two outcomes: Ripley's solution, and deploy clean slate IPv6.
- gorgoiler 2y agoCan you elaborate? The first I assume is “take off and nuke the site from orbit”, per Aliens (1986). What are you advocating for with IPv6? Increasing the enumeration space for IP addresses from 32 bits to /64 prefixes?
- ggm 2y agoI'm really just advocating for a drop in replacement. You wouldn't redeploy the addressing architecture you have, instead disrupt the surface the salt gets into. If you did a drop in why not go the whole hog and make it a 6 fabric?
- daneel_w 2y agoBut, a drop-in replacement of what? SS7? Diameter? Chinese cellular base stations from Huawei etc.? The collective telco IT infra and the shoddy security practices (or lack thereof)?
- ggm 2y ago"Yes"
- immibis 2y agoThe addressing architecture isn't the problem though? But if you think it is, I encourage you to run Yggdrasil.
- ggm 2y agoNo, it's true the addressing architecture isn't the problem. The uncertainty fear and doubt over all the deployed equipment is the problem. Hence "take off and nuke it from orbit" -do a complete replacement. IFF you buy that, why would you replace like (v4) with like? Why not replace with auto addressed self deploying v6 (for instance) which some people have been advocating for at scale, rather than a bundle of assumptions in dhcpv6 static assignment? Sure a lot of things would be static, but you could simplify the NMS burdens massively and reduce your routing complexity in the IGP. It's not a totally silly suggestion and it's not totally sensible either. Light hearted. I doubt any exec in any telco outside of Jio or maybe Comcast would go there. Amongst other things, they'd destroy a lot of capital value doing the Ripley. Well.. the liberated v4 sell replaces some of that until the price crashes..
- est 2y ago> capability to geolocate millions of individuals I guess Starlink could easily geolocate every 4G/5G phone IMIE with huge direct-to-celll attennas
- mike_hearn 2y agoModern mobile phone protocols do not expose your IMEI encrypted, they have a multi-step process in which temporary identifiers are used to identify the device to most of the network. So this is not necessarily the case.
- yapyap 2y agoeven with SS7 ?
- betaby 2y agoLast time I saw SS7 in production about a decade ago. Which operator uses SS7 today?
- immibis 2y agoAll? But it's something internal to networks and between networks, not between a network and a user device, so I don't see the relevance to IMEI catchers which intercept the radio link. Answer delayed by hours due to HN rate limiting.
- betaby 2y ago> All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.
- amiga386 2y agoYou may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.
- Giorgi 2y ago[flagged]
- andy_ppp 2y agoWar with China is starting to seem increasingly likely, we need to seriously prepare our industry now to manufacture things again and stop giving them our technology. The NSA/CIA need to start making systems more secure by default and stop thinking spying on their own populations is a top priority.
- Krasnol 2y agoWhat war? The digital has been running for quite a while, and there won't be a real one. China has nothing to gain from starting one. I mean seriously...why would you shoot your customer?
- rickydroll 2y ago> I mean seriously...why would you shoot your customer? It depends on your goal. If it is strictly a commercial relationship, “shooting your customer” could be advantageous for preserving a revenue stream. Customer lock-in Could be seen as a form of “shooting your customer" If your goal is political, "shooting your customer" may enable a regime change that is friendlier to you. We have done this multiple times in the Middle East, Central America, and South America.
- lenerdenator 2y agoThe difference is, China has more have-nots than the US has people. The US is the main source of value creation for China. If Xi wants to not have a coup and be beh... I mean, if Xi wants to guarantee the future prosperity of the PRC, he needs to raise those have-nots out of poverty and the way to do that is by selling stuff to Americans and stealing their IP, not creating a shooting war with a country that has enough nuclear weapons to make this planet uninhabitable to intelligent life for centuries. The US has done what it has done in the regions you list because they're already unstable (particularly the Middle East) and have no way of striking decisive blows against US territory.
- kiba 2y ago
- bru3s 2y ago[flagged]
- AndyMcConachie 2y agoThe people involved in this have all the reason to blame China or Chinese backed groups for this, but has there been any actual evidence released that confirms this? Attribution is notoriously difficult and the only thing the public has to go on is the word of people involved. Yet when one reads these articles it's just, "China, China, China!!!" Anyone have a link to actual evidence?
- nextworddev 2y agoUsually if North Korea or Russia did it, they say North Korea or Russia did it.
- GordonS 2y agoHonestly, it feels like they just pick a nation based on the current narrative. They already have plenty to bash Russia with regarding the Ukraine war, and they need to keep sinophobia alive and kicking, hence China. Plainly I have no real evidence for this, other than the constant lack of evidence for their claims, and the doubts that are cast within the infosec community when data is available.
- nextworddev 2y agoSince OP asked for evidence, maybe we should ask for the evidence that backs your hypothesis that bad reporting about China = unsubstantiated sinophobia
- INGSOCIALITE 2y agowe've always been at war with eurasia
- GordonS 2y agoUnfortunately much of the West seems to have mistaken 1984 for a manual, rather than a cautionary work of fiction.
- 2y ago
- cedws 2y agoIf companies practiced data minimisation, and end-to-end encrypted their customers' data that they don't need to see, fewer of these breaches would happen because there would be no incentive to break in. But intelligence agencies insist on having access to innocent citizens' conversations.
- beezlebroxxxxxx 2y ago> But intelligence agencies insist on having access to innocent citizens' conversations. That's part of the problem. But companies also are unwilling to pay to do any of the things that you've described. There is no punishment or fine that is actually punitive. Protecting (short term) profit is more important than protecting users' data --- it's even more important than protecting the (long term) profit potential of a company with a good reputation. Until the data breaches lead to serious $$$ impact for the company, the impact of these breaches will simply be waved off and pushed down to users. ("Sorry, we didn't protect your stuff at all. But, here's some credit monitoring!") Even in the profession of software development and engineering, very few people actually take data security seriously. There's lots of talk in the industry, but also lots of pisspoor practices when it comes to actually implementing the tech in a business.
- ganoushoreilly 2y agoHell in this instance, just replacing non EOL equipment that had known vulnerabilities would have gone a long way. We're talking routing infrastructure with implants designed years ago, still vulnerable and shuffling data internally.
- Dalewyn 2y agoThe "problem" is noone cares and certainly doesn't want to pay for the costs, especially the end users. That EOL equipment still works, there are next to no practical problems for the vast vast vast vast vast vast vast majority of people. You cannot convince them that this is a problem (for them) worth spending (their) money on. Even during the best of times people simply do not give a fuck about privacy. Honestly, if there is a problem at all I would say it's the uselessness of the Intelligence Community when actually posed with an espionage attack on our national security. FBI and CISA's response has been "Can't do; don't use." and I haven't heard a peep from the CIA or NSA.
- webdoodle 2y agoThey need to release all the metadata for Jefferey Epstein et al. Clearly the U.S. government isn't going to after 20 years of lies and deceit.
- 1vuio0pswjnm7 2y agohttps://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf https://www.cisa.gov/sites/default/files/2024-12/guidance-mo...
- GenerocUsername 2y agoSo this is obviously the intelligence agencies cleaning data before Trump takes control right
- Hilift 2y agoThe US Treasury just announced they had an incursion by Chinese threat actors. Their "cyber security vendor" had a remote access key compromised, enabling the attackers access to endpoints within Treasury.
- codedokode 2y agoImagine if the calls were E2E encrypted, phone accounts were anonymous, there were no identifiers like IMEI, and phone companies didn't detect and record geolocation... this attack would be much harder.
- Zigurd 2y agoI can't confirm it because the descriptions of the hack are unclear but if more network operators say they've been hacked it is more and more likely the Chinese got in by attacking lawful intercept. This could happen in various ways: bribe or blackmail someone in law enforcement with access to a lawful intercept management system (LIMS), a supply chain attack on an LIMS vendor, hacking the authentication between networks and LIMS, etc. If it is an LI attack the answer to which networks are compromised is: All of them that support automated LI. That's a nasty attack because LI is designed to not be easily detectable because of worries about network operators knowing who is being tapped.
- trod1234 2y agoThat reasoning is dubious. They aren't saying that more have been hacked, they are saying that more have been discovered related to that hack. Any adversary at this level would be monitoring the news, and would take appropriate actions (for gain) or roll up the network rather than allow reverse engineering of IOCs. More than likely this was not an LI based attack, but rather they don't know for sure how they got in. Nearly all of the guidance is standard cybersecurity best practices for monitoring and visibility, and lowering attack surface with few exceptions (in the CISA guidance). The major changes appear to be the requirements to no longer use TFTP, and the referral to the manufacturer for source of truth hashes (which have not necessarily been provided in the past). A firmware based attack for egress/ingress seems very likely. For reference, TFTP servers are what send out the ISP configuration for endpoints in their network, the modems (customers), and that includes firmware images (which have no AAA). Additionally as far as I know the hardware involved lacks an ability to properly audit changes to these devices (by design), and TR-47 is rarely used appropriately, the related encryption is also required by law to be backward compatible with known broken encryption. There was a good conference talk on this a few years ago, at Cyphercon 6. https://www.youtube.com/watch?v=_hk2DsCWGXs https://www.youtube.com/watch?v=_hk2DsCWGXs The particular emphasis on TLS1.3 (while now standard practice) suggests that connections may be being downgraded, and the hardware/firmware at CPE bridge may be performing MITM to public sites in earlier versions transparently, if this is the case (its a common capability needed). The emphasis on using specific DH groups, may point to breaks in the key exchange of groups not known to be broken (but are broken), which may or may not be a factor as well. If the adversary can control, and insert malicious code into traffic on-the-fly targeting sensitive individuals who have access already, they can easily use information that passes through to break into highly sensitive systems. The alternative theory while fringe, is maybe they've come up with a way to break feistel networks (in terms of cryptographic breaks). Awhile back the NSA said they had a breakthrough in cryptography. If that breakthrough was related to attacks on feistel network structures (which almost all modern cryptography is built on), that might explain another way (although this is arguably wild speculation at this point). Nearly every computer has a backdoor co-processor built-in in the form of Trustzone, Management Engine, or AMD's PSP. Its largely only secured by crypto without proper audit trails. It presents a low hanging concentrated fruit into almost every computation platform on earth, and by design, its largely not auditable or visible. Food for thought. Quantum computer breaks a single signing key for said systems, acting like a golden key back door to everything. All the eggs in one basket. Not out of the realm of possibility at the nation state level. No visibility means no perception or ability to react, or isolate the issues except indirectly.
- mavsman 2y ago> "We detect no activity by nation-state actors in our networks at this time," an AT&T spokesperson said. Sounds like the root of the issue.
- outside1234 2y agoHow is this not an act of war?
- outside1234 2y agoHow is this not an act of war? If they sent people physically over to do this it would be, so how is this different?
- lowbloodsugar 2y agoIf I’ve learned anything about security it’s that once someone has admin access there’s no way your system is clean. It might look that way, but the system is lying to you, and even if you clean that part up there’s backdoors and Trojans just waiting in firmware, boot loaders, network stacks, backups, everything. Like does your system have any “workarounds” or can you wipe everything and redeploy? Guarantee it’s the former. Ok well then how do you know this bespoke thing is what was originally written by that guy five years ago.
- ram_rattle 2y agoI was working in telecom research company where the director looked my in disbelief that hacks can actually in telecom, his eyes became wide just when I showed few small hacks, wonder what he is thinking now, lol
- Arudtommy 2y ago[dead]
- c217w 2y ago[dead]