YYou know the drill. You log into your bank or another service (Gmail, but not limited to) that you use regularly. You enter your username and password and then the service says it will send you an SMS with a code you can use to confirm that it’s you who’s actually logged in. This is called two-factor authentication (2FA) and is considered best practice in our networked world, since passwords and login details can be easily hacked.
It’s unfortunate that our world is so evil and interconnected, that this SMS could be forwarded to someone else’s phone – the phone of the criminal who logged in using your fraudulent personal data – and who is now busy emptying your existing account.
This type of deception has been possible for years. I just came across an account of that It happens to bank customers In Germany in 2017, but security experts were warning about it long before that. The root cause of the problem lies in chronic security SS7 vulnerabilitiesan obscure, decades-old technical protocol for routing phone calls and messages, is built into all telephone systems.
These weaknesses can be Exploited by hackers To do a variety of damage: track any mobile phone anywhere in the world; Listen to calls. Read and forward SMS. Intercepting Internet traffic. Interfere with, but are not limited to, user connectivity or network availability. But SS7 is also what enables your phone to stay connected during a call while you’re on a train that passes through several local cells. So it is an integral part of the mobile phone system – the glue that holds the whole system together.
It is arguably too big to fail, which may explain why major telecom companies are reluctant to confront their obvious downsides. This laxity exists now Intervention effects By the US regulatory body, the Federal Communications Commission (FCC), perhaps because Oregon Senator Ron Wyden described the SS7 vulnerabilities as a “national security” issue.
As it happens, the Senator is pushing the open door, because there is consternation in Washington about the extent and depth of foreign (aka Chinese) penetration of American communications and critical infrastructure, some of which is undoubtedly facilitated by vulnerabilities in the SS7 system. At an international security summit held in Bahrain on December 7, Anne Neuberger of the White House National Security Council admitted that Chinese cyber spies scored “very large” Calls from American political figures, although they omitted to name the victims. It also confirmed that eight US telecom providers had been hacked by Chinese hackers.
Although North Korea and Russia are also seen as rivals in cybersecurity, Americans seem obsessed with the Chinese threat. Three hacking groups in particular seem to be keeping people in Washington awake at night. It is, as one person commented, “typhoon season” in the city — a reflection of the names assigned to the trio — Salt Typhoon, Volt Typhoon, and Linen Typhoon. Flax ran a botnet of 260,000 machines until this was done It was broken up by the FBI. SALT’s spies infiltrated the US telecommunications companies Verizon, AT&T, and Lumen Technologies – and, in a neat touch, also penetrated their wiretapping systems (the ones they have to deploy when FBI agents arrive with a warrant).
Volt, in a way, is the nastiest of the trio. It specializes in critical infrastructure in the United States – water systems, electrical grids, and the like. Runs botnets based on out-of-date Cisco and Netgear routers (models for which security updates are no longer released). It has been active since mid-2021 with the aim of, According to MicrosoftAnd build the ability to disrupt critical communications infrastructure between the United States and the Asian region during future crises. (Maybe a Chinese invasion of Taiwan?) The organizations affected “include the communications, manufacturing, utilities, transportation, construction, maritime, government, IT, and education sectors.” The inference is that Volt “intends to conduct espionage and maintain access undetected for as long as possible.”
So, like technology Companies are lining up To Donate Millions to Trump’s Inaugural Fund Two of the three Chinese hacking groups named after the storms will still be wreaking havoc in America’s digital backyard. The idea of Salt Typhoon infiltrating the FBI’s eavesdropping systems is particularly delicious. Meanwhile, cell phones everywhere will remain tied to an archaic protocol that’s as safe as a two-person tent in a hurricane. When Trump goes to Beijing to seal the deal with his fellow emperor, Xi Jinping will be able to present his visitor with a leather-bound book containing all of his private phone conversations since 2016.
a happy new year!
After promoting the newsletter
What I was reading
Blinded by light
Optical illusions is a fascinating blast on Tina Brown’s blog about the strange appeal of the Trump façade to many Americans.
University challenge
How the Ivy League Broke America – Title of a long and thoughtful article by David Brooks on Atlantic On the evils of “meritocracy.”
To sir with love
Recovering the article: two memories. A beautiful article by Richard Farr about what it means to have a great teacher.