6 ms·
AT&T, Verizon blocking release of Salt Typhoon security assessment reports
- deleted 8mo ago[deleted]
- ungreased0675 8mo agoThese companies were required by the government to have lawful intercept capability. A bad actor took advantage of that government-required backdoor, and now the government has the shamelessness to grandstand about privacy and security? We need to elect better people.
- dmix 8mo agoIs this speculation or has that information come out already?
- medina 8mo agohttps://www.commerce.senate.gov/2025/12/experts-agree-u-s-communications-networks-remain-vulnerable-following-salt-typhoon-hack https://www.commerce.senate.gov/2025/12/experts-agree-u-s-co... > “The Chinese government's espionage operation deeply penetrated networks of at least nine U.S. telecom companies, including AT&T and Verizon,” said Sen. Cantwell. “They exploited the wiretapping system that our law enforcement agencies rely on under the Communications Assistance for Law Enforcement Act -- known as CALEA. These systems became an open door for Chinese intelligence. Salt Typhoon allowed the Chinese operation to track millions of Americans’ locations in real time, record phone calls at will and read our text messages.”
- gruez 8mo ago>and now the government has the shamelessness to grandstand about privacy and security? We need to elect better people. Where's "the government [... grandstanding] about privacy and security"? It's getting blocked by the companies, not the government. >She said Mandiant refused to provide the requested network security assessments, apparently at the direction of AT&T and Verizon.
- observationist 8mo ago"US Senator says AT&T, Verizon blocking release of Salt Typhoon security assessment reports" A US senator is using it for political grandstanding. She is an ineffective twit with no power and no principles, no right under law to receive what she demanded, and she made sure to run to the press with it "see! look, I'm a principled, powerful senator holding those evil corporations feet to the fire!" The problem is that the vulnerability exploited by salt typhoon is a systemic flaw implemented at the demand of Cantwell and other of our legislative morons. You cannot have an "only the good guys" backdoor. That doesn't work. People are bad, and stupid, and fallible. You can't make policy or exceptions that depend on people being good, and smart, and infallible. She's using the inevitable consequence of a system she helped create for her own political benefit. She voted for the backdoor back in 94 against the strenuous and principled objections by people who actually know what they're talking about. Bobblehead talking points should not serve as the basis for technical policy and governance, but here we are.
- Spivak 8mo agoYou can tell this whole thing will be a nothingburger on the government side because the only thing she can actually do is pull in some CEOs to (not) answer questions and receive a congressional tsk tsk.
- plagiarist 8mo agoThe country is such a dumpster fire. Fucking congressional hearings. The best case scenario is a little video clip that legislators can use to campaign with. Each election period they have to take a break from eroding citizens' rights catering to lobbyists. The video clips help them pretend they were doing something other than insider trading while in the seat.
- SunshineTheCat 8mo agoI agree with you on electing better people, but this is largely a systematic problem with how government works: 1. Propose bill to solve a problem which is either minor or completely misunderstood by the person proposing the bill 2. Pass bill, don't solve original "problem," creates 15 new, actual problems 3. Run on fixing all the new problems they created (and some others that don't exist) 4. Repeat
- sidewndr46 8mo agoYou forgot about the part to appropriate money, spend it, & declare the problem solved
- maltalex 8mo agoThe problem isn't the back door. Every telecom company in every country provides access for "lawful intercept". Phone taps have been a thing for decades and as far as I know, require a warrant. The problem is that telecoms are very large, very complex environments, often with poor security controls. Investing in better controls is hard, time-consuming and expensive, and many telecoms are reluctant to do it. That's not great great since telcos are prime targets for nation state hackers as Salt Typhoon shows. Hacking the lawful intercept systems is very brazen, but even if the hackers didn't don't go as far, and "only" gained control of normal telco stuff like call routing, numbering, billing, etc. it still would have been incredibly dangerous.
- ddtaylor 8mo agoThe problem is the back door. Decentralized systems don't have the same faults. Just because you want to force a structure or paradigm doesn't absolve it of responsibility for the problem. Hand waving the problem away because a company is bad at management or scale doesn't change anything.
- maltalex 8mo agoEven if the back door wasn't there, you wouldn't want nation state hackers anywhere near telecoms since they're critical infrastructure. Telecoms should be highly secure. Period.
- illithid0 8mo agoI've worked as a security consultant with one or two companies (who shall remain nameless) whose sole product was a hardware device with a black-box software stack meant to be a plug-and-play lawful intercept compliance solution. Telecoms should be able to buy it, install it, and access a web panel to do their government-mandated business. In the three or four year I worked with them, they would only let me do penetration testing of their user network, and never the segments where the developers were, and never the product itself. In speaking with their security team (one guy - shocker) during compliance initiatives, it was very clear to me that the product itself was not to be touched per the explicit direction of senior leadership. All I can say is that if the parts of their environment they did let us touch are any indication of the state of the rest of their assets, that device was compromised a long time ago.
- red-iron-pine 8mo agowhen I lived in NoVA I had a roommate that installed and serviced boxes that sound suspiciously similar. SSL crackers to MITM all ISP user traffic
- Ms-J 8mo agoCertainly these devices exist and are installed daily to further steal our info, but are you sure these devices weren't DPI boxes? If you could give a little more detail I might know since I've worked with this type of equipment.
- unethical_ban 8mo agoYuck.
- downrightmike 8mo agoNot even that, they have CVE 10 from 2019 on their routers, which the hackers got root on then patched, so they wouldn't be kicked off by other hackers. All because IT upkeep wasn't done and hardening on Cisco devices is a distinct admin guide and not at all on by default. The days are long gone of qualified and careful network admins, now we just get the low-ball outsourced Cisco TAC and the like which DGAF
- hulitu 8mo ago>We need to elect better people The better people do not put themselves to be elected.
- ratelimitsteve 8mo agogoomba fallacy. the government isn't one person with one position. i agree with you that the backdoor should never have been installed in the first place but accusing them of hypocrisy because a group of lawmakers passed a law a while ago and a different group of lawmakers want a report on what went wrong and why is silliness. It seems as though the person spearheading this effort, Senator Cantwell, is in fact one of the better people that you propose we should elect but here you are shitting on her for trying to shed light on the pitfalls of the very policy you seem to be against in the first place.
- ok123456 8mo agoIf they simply implicated an "APT" in wrongdoing, they would have released it, as it would have been unremarkable and fit neatly within the Overton window of hissing-chinese spys justifying an even more expansive national security apparatus and general anti-sino sentiments among the ruling class in Washington. This leads me to two possible, non-exclusive outcomes: the links to China are tenuous, and the attribution is flimsy (e.g., they accessed a machine at 9 am Beijing time!); or the report implicates the system itself as unauditable by design, which was bound to happen given the design of the intercept tools.
- walletdrainer 8mo agoThese reports would be useful for any other attacker interested in their infra, it’s obvious why the companies wouldn’t want to release them in this manner.
- thinkthatover 8mo agoIf they can't provide it to us for national security purposes, certainly they could to the appropriate congressional subcommittee
- ok123456 8mo agoYes, most organizations are shy to release reports that make them look incompetent or highlight systemic problems. That's why we have laws that now require disclosure of incidents that may have exposed customer data.
- JasonADrury 8mo ago>That's why we have laws that now require disclosure of incidents that may have exposed customer data. I don't think there's any jurisdiction that requires public disclosure at this level of detail. It's really an extraordinary ask. How many of these reports have you seen?
- deleted 8mo ago[deleted]
- natas 8mo agowhy does the government, any government, has a backdoor on anyone's phones to begin with?
- pluralmonad 8mo agoTerrorists, drugs, the children, future excuse for the panopticon.
- mikkupikku 8mo agoWiretapping predates all of these sort of arguments. Wiretapping was invented at basically the same time that telephones themselves were and was underway for decades before the law even began to take note; the first major legal development in this regard was the Supreme Court saying cops could do it without a warrant in 1928 (they already had been the entire time.)
- pluralmonad 8mo agoWhile that is interesting from a historical perspective, does it inform on the myriad of excuses trotted out for these abuses today?
- jbug187 8mo agosrsly doubt that these reports would ever be released publicly, but i'm curious if they might suggest that their recent high-profile extended outages are related to weaknesses that were easily exploited by bad actors.
- engelo_b 8mo ago[dead]
- farco12 8mo agoThis interview discusses potential vectors: https://www.cybersecuritydive.com/news/tmobile-salt-typhoon-telecom-attack-campaign/734729/ https://www.cybersecuritydive.com/news/tmobile-salt-typhoon-...
- Zigurd 8mo agoMany years ago I wrote a functional spec for lawful intercept in a 3G data node. It was based on a spec for a different product, so it contained a lot of institutional knowledge of how lawful intercept works. A key element of the design of lawful intercept is not to trust the company running the network. Otherwise employees of that company would become targets for organized crime influence, among what are probably a few other considerations. The network operator isn't told about intercepts, and the relatively low rate of traffic intercept, the node has to support up to 3% of traffic intercepted, at least that was the spec at the time, makes it relatively easy for that traffic to be hidden from network management tools. It's not supposed to show up in your logs or network management reporting. Intercepts originate on LI consoles operated by law enforcement agencies. This sounds pretty good so far. Until a hacker breaks into an LI console. Now that hacker can acquire traffic with pinpoint accuracy, undetected by design. I have always been skeptical of claims that network operators have eliminated salt typhoon from their networks. I do not believe they know when the exploit began. Nor can they tell if their networks are truly free of salt typhoon activity. There are multiple vendors of LI console software. It's a standardized interoperable protocol to set up intercepts. So there's no one neck to wring.
- jtbayly 8mo agoWhat is an LI console? Where is it installed that it has access to accomplish this?
- ycombiredd 8mo ago"Lawful Intercept". Some may find this interesting https://www.fcc.gov/calea https://www.fcc.gov/calea
- SSLy 8mo ago> LI console? it's a (possibly virtual) appliance. It has connection to the intercept engine sitting somewhere in-band.
- SWv2 8mo agoI worked in/with network ops at a big US telco. Some of the engineers have ideas on which nodes have these intercepts (and what they are) based on the call flows they monitor and the level of access they have to troubleshoot problems further. I can’t guess the details further since that wasn’t my domain, but that part of opsec wasn’t fully hidden.
- bastard_op 8mo agoThey don't want their backdoors they allowed and buffoonery in securing/managing them exposed. This is only the wireless providers, now what about all the residential ISP's like Comcast, Cox, Charter, etc? They're even more incompetent usually, I've worked for enough to know.
- learingsci 8mo ago[flagged]
- ourmandave 8mo agoI have plenty of harsh words for China, but we know they and other countries are an ongoing threat so the criticism is why aren't we defending ourselves better?
- bigyabai 8mo agoI'll actually steelman against this; there's nothing to criticize them for. The US does the exact same thing and supports regimes around the world that perpetuate cyber-terror as a weapon of asymmetrical conflict. The US has to come to the table for negotiation or secure itself accordingly.
- Zigurd 8mo agoThe sheer elegance of hacking a law enforcement intercept architecture that's designed to make intercept traffic hard to track would be so irresistibly satisfying to any hacker that I don't see how they could say "Nahhh, too far."
- y-c-o-m-b 8mo agoA decent example of why implementing authoritarian policies is a bad strategy for the US; particularly coming from the current administration. We're only strengthening Chinese supremacy at this point and tearing the US apart in the process of trying to claw some back. We don't have what it takes to pull this shit off as well as China does. This is a failure at many levels: the uncoordinated surveillance, the gross lack of security, lack of skills, lack of knowledge, etc. and it extends to many aspects of American governance. Between the US putting significant traumatic pressure on its own citizens and companies doing mass layoffs in an increasingly unaffordable economy, this will push even more brain drain overseas, which only accelerates China's strengthening stance more.
- MisterTea 8mo agoThis very much feels like the old cold war dynamic between Russia and the USA with the roles reversed.
- briandw 8mo agoThis was enabled by the Communications Assistance for Law Enforcement Act (CALEA), enacted in 1994. Congress made their bed, now they need to lie in. Time to remove the govt mandated backdoors.
- farceSpherule 8mo ago[dead]
- farceSpherule 8mo ago[dead]
- DeepYogurt 8mo agoInfosec is such a scam
- Zenul_Abidin 8mo agoThe hackers already have it. There is no reason to hide it from the general public.
- bastardoperator 8mo agoI worked at Verizon almost 10 years ago, they hired a group come to come in and assess. Within 3-4 hours they pwned the entire place (including offices outside of the office we were in) through an unsecured windows jenkins machine/script console.
- red-iron-pine 8mo agotranslation: we got pwn3d, and badly
- DANmode 8mo ago> why Americans should have confidence in the security of their networks Perhaps they should not.
- 1vuio0pswjnm7 8mo agoNo Datadome Javascript: https://www.msn.com/en-us/technology/cybersecurity/senator-says-at-t-verizon-blocking-release-of-salt-typhoon-security-assessment-reports/ar-AA1VB52W/ https://www.msn.com/en-us/technology/cybersecurity/senator-s... Text-only: http://assets.msn.com/content/view/v2/Detail/en-in/AA1VB52W/ http://assets.msn.com/content/view/v2/Detail/en-in/AA1VB52W/ (Yes, Microsoft is now using HTTP not HTTPS)
- Zenul_Abidin 8mo agoHow did they regress to HTTP from HTTPS?
- Ms-J 8mo agoIt's hilarious that the Chinese, plus a whole boat load of other countries, plus a bunch of individuals and groups, all have access to the communications spying system. At this point the only person without access to it is you! It blows my mind that some individuals have allowed politicians to put these systems in place to spy on everyone. The only purpose for these spy devices is to collect blackmail and wait until the person either becomes either important or the government wants to do parallel construction on a court case. There is absolutely no need for anyone to spy on another persons conversation. We have had encrypted messaging for many years and the world keeps turning.
- hulitu 8mo ago> At this point the only person without access to it is you! This is how Microsoft, Google and Apple works.