US government tells officials, politicians to ditch regular calls and texts
CISA advises end-to-end encryption for senior officials
Salt Typhoon hackers linked to Chinese government
Largest telecom hack in U.S. history, says Senator Lujan
Adds comment from CISA official in paragraph 11 and expert in paragraph 17.
By Raphael Satter and AJ Vicens
WASHINGTON, Dec 18 (Reuters) -The U.S. government is urging senior government officials and politicians to ditch phone calls and text messages following intrusions at major American telecommunications companies blamed on Chinese hackers.
Right now.
In written guidance released on Wednesday, the Cybersecurity and Infrastructure Security Agency said "individuals who are in senior government or senior political positions" should "immediately review and apply" a series of best practices around the use of mobile devices.
The first recommendation: "Use only end-to-end encrypted communications."
End-to-end encryption - a data protection technique which aims to make data unreadable by anyone except its sender and its recipient - is baked into various chat apps, including Meta Platforms' META.O WhatsApp, Apple's AAPL.O iMessage, and the privacy-focused app Signal. Corporate offerings which allow end-to-end encryption also include Microsoft's MSFT.O Teams and Zoom Communications' ZM.O onlinemeetings.
Neither regular phone calls nor text messages are end-to-end encrypted, which means they can be monitored, either by the telephone companies, law enforcement, or - potentially - hackers who've broken into the phone companies' infrastructure.
That's what happened in the case of the cyber spies dubbed "Salt Typhoon," a group that U.S. officials have said is being run by the Chinese government.
Beijing routinely denies allegations of cyberespionage.
Speaking earlier this month, a senior U.S. official said that "at least" eight telecommunications and telecom infrastructure firms in the United States were compromised by the Salt Typhoon hackers and that "a large number of Americans' metadata" had been stolen in the surveillance sweep.
Last week, Democratic Senator Ben Ray Lujan said the wave of intrusions "likely represents the largest telecommunications hack in our nation's history" and it's not clear that American officials have figured out how to defeat the hackers' spy campaign.
Jeff Greene, CISA's executive assistant director for cybersecurity, told reporters Wednesday that the investigation remains ongoing and various targeted agencies and people are at different stages of their response.
The Salt Typhoon compromise "is part of a broader pattern of PRC activity directed at critical infrastructure," Greene said, referring to Chinese-linked cyber operations focused on utilities and other sensitive networks and tracked under the nickname "Volt Typhoon."
"This is ongoing PRC activity that we need to both prepare for and defend against for the long term," Greene said.
Communicating only via end-to-end encryption has long been a recommendation pushed by digital safety experts like those at the Electronic Frontier Foundation, whose senior staff technologist Cooper Quintin welcomed the guidance. Still, he said the idea that the government was steering its own officials away from the regular phone network was worrying.
"It is a huge indictment of the telecoms that run the nation's infrastructure," he said.
Other recommendations include avoiding text messages based on one-time passwords - like the kind often sent by U.S. banks to verify logins - and using hardware keys, which help protect against a password-stealing technique known as phishing.
Tom Hegel, a threat researcher at cybersecurity company SentinelOne S.N, echoed Cooper's endorsement of the CISA guidelines, saying that "Chinese actors aren't the only ones continuing to collect unsecured communications."
A wide variety of spies and hackers "all stand to lose valuable access if their targets adopt these security measures," he said.
Reporting by Raphael Satter and AJ Vicens; editing by Jonathan Oatis and Diane Craft
Related Assets
Latest News
Disclaimer: The XM Group entities provide execution-only service and access to our Online Trading Facility, permitting a person to view and/or use the content available on or via the website, is not intended to change or expand on this, nor does it change or expand on this. Such access and use are always subject to: (i) Terms and Conditions; (ii) Risk Warnings; and (iii) Full Disclaimer. Such content is therefore provided as no more than general information. Particularly, please be aware that the contents of our Online Trading Facility are neither a solicitation, nor an offer to enter any transactions on the financial markets. Trading on any financial market involves a significant level of risk to your capital.
All material published on our Online Trading Facility is intended for educational/informational purposes only, and does not contain – nor should it be considered as containing – financial, investment tax or trading advice and recommendations; or a record of our trading prices; or an offer of, or solicitation for, a transaction in any financial instruments; or unsolicited financial promotions to you.
Any third-party content, as well as content prepared by XM, such as: opinions, news, research, analyses, prices and other information or links to third-party sites contained on this website are provided on an “as-is” basis, as general market commentary, and do not constitute investment advice. To the extent that any content is construed as investment research, you must note and accept that the content was not intended to and has not been prepared in accordance with legal requirements designed to promote the independence of investment research and as such, it would be considered as marketing communication under the relevant laws and regulations. Please ensure that you have read and understood our Notification on Non-Independent Investment. Research and Risk Warning concerning the foregoing information, which can be accessed here.
