U.S. government officials said that the China-backed hacking group dubbed Salt Typhoon are still inside some of the networks of America’s largest phone and internet providers, weeks after the long-running hacking campaign first came to light.
Cybersecurity agency CISA said in a call with reporters the affected telecom giants are still trying to evict the hackers, in part because it’s unclear what the hackers are aiming to accomplish.
News first broke in October that Salt Typhoon was reportedly deep inside the networks of AT&T, Verizon, and Lumen (formerly CenturyLink), among others. T-Mobile said it was targeted but largely rebuffed the attackers. The access allowed the Chinese hackers to access real-time unencrypted calls and text messages, as well as metadata about who the communications were sent to and from, as they traveled over the phone carriers’ networks.
U.S. officials believe the industry-wide hacks may be China trying to carry out a wide-ranging spying operation, as the hackers were found accessing the communications of U.S. officials and senior Americans, including presidential candidates. Salt Typhoon is also believed to be targeting systems that house much of the U.S. government’s requests, which may help to identify Chinese individuals under U.S. government surveillance.
…
“Encryption is your friend; whether it’s on text messaging or if you have the capacity to use encrypted voice communication,” said the CISA official.
This is actually quite good news!
Hear me out though.
Encryption has been under attack by government instances for a while now.
They always aim to weaken / backdoor it,
so that they can spy on all their citizens.
China abused the backdoor implemented by the US government,
which sends a message across the world,
being: “Do not backdoor encryption to spy on your citizens, or other countries might abuse it”
Hopefully this will put a stop to governments attacking encryption, at least for a while,
since now they’re reminded of the risks which it brings! :)
Yes, I would also have a nitpick for the authorities (and journalists who report on the issue) in that China didn’t hack the providers, it hacked the U.S. Wiretap system. This is an important detail. There is no such thing as a ‘backdoor only for the good guys’.
Don’t worry. The apps they want you to use definitely don’t have backdoors for them to use to circumvent all encryption, and those nonexistent backdoors will definitely not be found by other bad actors.
Signal Private Messenger is free open source, works on everything. Your grandma could use this.
I have slowly migrated all of my friends and family to this over the last few years.
All of the big ‘encrypted’ messengers like WhatsApp or Facebook Messenger use the Signal Protocol under the hood but insert their own shady business and tracking defeating a lot of the purpose.
There are other perhaps more anonymous options like SimpleX or XMRchat but they are not practical nor needed for most threat models.
Matrix is not quite mature enough but is a better option than discord for gaming communities.
Signal everyday.
I would not recommend Telegram.
DYOR.
Yep, Signal has been the obvious best combination of actual security and ease of use for quite a while now…
But most people that I interact with are still on the level of ‘everyone knows Apple is more secure than Android, so anything on an iPhone is fine’ or ‘wtf undont have a SnapChat? Everyone has a snapchat’.
XMPP is terrible for the average user, its encryption (OMEMO) in most clients is not the latest version of it (making it weak) and can be turned off, a bad thing for an encrypted messenger. Plus verification requires comparing a string of numbers in most cases, something most users do not want to do or would find it difficult to accurately.
SimpleX Chat has not proven itself to be legal request resistant yet (they seem not to have any information on requests recieved) and does not have many audits. Plus it is very barebones and has bad UX. Until they fix these things it will not be attractive to most typical folks.
Yes, I know of the OMEMO issues. Most users would probably find that too difficult (although it isn’t imo). It’s very hard to convince people of more secure, non-mainstream tools, unfortunately.
I believe that had improved recently, especially due to funding from the original creator of Twitter and Bluesky.
Though in general yes, apps that are about ‘extreme’ privacy tend to be as they like to avoid the big corporate tech servers for notifications etc whenever possible and probably other things too meaning they have to use more power in order to get the same results as the ones that do use them.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
This is actually quite good news!
Hear me out though.
Encryption has been under attack by government instances for a while now.
They always aim to weaken / backdoor it,
so that they can spy on all their citizens.
China abused the backdoor implemented by the US government,
which sends a message across the world,
being: “Do not backdoor encryption to spy on your citizens, or other countries might abuse it”
Hopefully this will put a stop to governments attacking encryption, at least for a while,
since now they’re reminded of the risks which it brings! :)
Yes, I would also have a nitpick for the authorities (and journalists who report on the issue) in that China didn’t hack the providers, it hacked the U.S. Wiretap system. This is an important detail. There is no such thing as a ‘backdoor only for the good guys’.
Encryption when it protects you from China: “Encryption is your friend”
Encryption when it protects your constitutional rights: “What are you hiding?”
Don’t worry. The apps they want you to use definitely don’t have backdoors for them to use to circumvent all encryption, and those nonexistent backdoors will definitely not be found by other bad actors.
Hope the EU get the message
Right. China is the problem. “Look over there!”
Anyone have a recommended app for messaging that is actually encrypted? I certainly don’t trust WhatsApp.
Signal Private Messenger is free open source, works on everything. Your grandma could use this.
I have slowly migrated all of my friends and family to this over the last few years.
All of the big ‘encrypted’ messengers like WhatsApp or Facebook Messenger use the Signal Protocol under the hood but insert their own shady business and tracking defeating a lot of the purpose.
There are other perhaps more anonymous options like SimpleX or XMRchat but they are not practical nor needed for most threat models.
Matrix is not quite mature enough but is a better option than discord for gaming communities.
Signal everyday. I would not recommend Telegram. DYOR.
Yep, Signal has been the obvious best combination of actual security and ease of use for quite a while now…
But most people that I interact with are still on the level of ‘everyone knows Apple is more secure than Android, so anything on an iPhone is fine’ or ‘wtf undont have a SnapChat? Everyone has a snapchat’.
Quick, everybody pick a different app! Chaos ensues.
XMPP maybe?
I also tink SimpleX Chat is a good alternative.
I wouldn’t recommend Signal (only the client is open source, the server is from Amazon, and you have to provide your phone number).
XMPP is terrible for the average user, its encryption (OMEMO) in most clients is not the latest version of it (making it weak) and can be turned off, a bad thing for an encrypted messenger. Plus verification requires comparing a string of numbers in most cases, something most users do not want to do or would find it difficult to accurately.
SimpleX Chat has not proven itself to be legal request resistant yet (they seem not to have any information on requests recieved) and does not have many audits. Plus it is very barebones and has bad UX. Until they fix these things it will not be attractive to most typical folks.
Yes, I know of the OMEMO issues. Most users would probably find that too difficult (although it isn’t imo). It’s very hard to convince people of more secure, non-mainstream tools, unfortunately.
And simplex is battery hell
I believe that had improved recently, especially due to funding from the original creator of Twitter and Bluesky.
Though in general yes, apps that are about ‘extreme’ privacy tend to be as they like to avoid the big corporate tech servers for notifications etc whenever possible and probably other things too meaning they have to use more power in order to get the same results as the ones that do use them.
Matrix
Matrix had a security vulnerability it knew about for years and did not fix until recently leaving many clients with broken encryption. Plus its flagship client (at the very least) clearly cares more about business interests than the common user.