Steve Gibson (51:09)
You know, I don't know. So, as all of our listeners will appreciate, sissa, as we've often said on this podcast, has been doing a surprisingly tremendous job since it really got rolling a few years ago. I've often commented that I've been surprised by how proactive and effective it has been, especially considering that it's a government agency. So I hope, I sincerely hope these cutbacks will not compromise that. It's probably impossible to accurately gauge since we cannot know how things would have been with a significantly smaller cisa. We'll just need to watch and see the reporting continues. Writing a Comcast spokesperson told nextgov, quote, we've worked with law enforcement and government agencies and have closely monitored our network. So this is Comcast speaking. We have found no evidence that Salt Typhoon has impacted our enterprise network, unquote. An intrusion into either provider could carry significant national security risks. Comcast, they write, facilitates Internet access for millions of users and businesses, while Digital Realty hosts troves of physical infrastructure used by telecom operators, cloud providers and governments to route global Web traffic. A CISA spokesperson said, quote, as a policy, we do not comment on individual entities. The nsa, for their part, declined to comment, and the FBI did not respond to a request for comment. Digital Realty did not return multiple requests for comment. Nextgov reported in December that hundreds of organizations were notified. Hundreds of organizations were notified of potential Salt Typhoon compromise. Last month, cyberscoop reported that CISA and the FBI devised a coordinated notification campaign to alert affected companies and help them deter the hacks, sometimes providing new data to them on an hourly basis. The FBI concurred with other agency assessments that the SALT typhoon attacks, broadly speaking, are the most egregious national security breach in US history by a nation state hacking group. Mark Rogers, a seasoned telecommunications cybersecurity expert said, quote, a breach of Comcast and Digital Realty would confirm what many of us in the cybersecurity industry already suspected, that the SALT campaign was broader than just telcos and we have low confidence the attackers have been evicted. Nextgov obtained an internal CISA list of communications sector hardware and software products found to have been exploited by the China linked hacking groups of several listed. One of those vulnerabilities first discovered in 2018 was found in Micro Tickets routers and some of the software flaws exploited by SALT Typhoon were first disclosed in 2018, same year as the Mikrotik router flaws. Mark Rogers said something that isn't being talked about enough is that the initial way in which these attackers used were simple flaws like 8 year old vulnerabilities and credential theft. Instead of talking about ripping and replacing, we should be looking at why we aren't simply patching and maintaining our existing critical infrastructure. Eric Hanselman, the chief technology, media and telecommunications research analyst at S and P Global Market Intelligence, explained that Chinese access into data center and colocation firms would provide the hackers with a different target set compared to messaging services operated by traditional carriers. This is him speaking. The additional risk created would be they're gaining the ability to monitor intra service and intra application communications traffic that does not normally traverse the Internet backbone. That could include storage traffic moving from colocation environments into cloud or traffic moving from hosted environments into on premises infrastructure. That traffic might have less robust protections as it's not traversing the open Internet. In other words, it might all be behind firewalls. So where we trust everybody inside behind the firewall? Digital Realty writes NextGov has over 300 data centers. This is, this was surprised me. Digital Realty has over 300 data centers across 25 countries and 50 metropolitan areas including to a company marketing webpage. They list Amazon Web Services, Google Cloud, IBM, Microsoft and Nvidia among their clients. The company is considered one of the largest data center colocation providers in the world, housing the physical systems where cloud and telecom networks exchange data and they're believed to have been compromised. Eric Hanselman said we can reasonably assume that these attackers are already have sufficient access into Internet infrastructure and are looking to expand the depth with which they can monitor other activities that are taking place within Data center environments. Comcast's broadband and data and cable customer base is around 51 million, while its total wireless customer count totals around 8.1 million, according to recent earnings data. It's widely believed that Salt Typhoon has still not been excised from telecom systems, despite public statements from companies saying otherwise. On the other hand, they've been told not to look too closely. On Thursday they write well known Republican Senator Josh Hawley said in a Senate Homeland Security Committee hearing that the hackers are still inside. He said, quote, if a foreign actor chose to concentrate on any member of the audience here, we were told behind closed doors, of course, but what we were told is that foreign actors basically have unlimited access to our voice messages and our telephone calls. President Donald Trump, Vice President J.D. vance and a range of U.S. officials had their calls and texts directly targeted by Salt Typhoon hacks. The cyber spies accessed providers lawful intercept systems used to comply with government orders requiring access to communications metadata for law enforcement investigations. Wow. And remember that as we previously saw, Salt Typhoon's apparent way into these major telecom backbone providers was not rocket science nor advanced PWN to own style elite hacking. It was simply that someone somewhere within telecom's sprawling and largely out of control infrastructure, somewhere, somewhere there were older, unpatched systems still online with known vulnerabilities, the reporting says. A spokesperson for the House China Select Committee said in an email, if these reports are accurate, they point to yet another serious and deeply concerning example of the Chinese Communist Party targeting America's digital infrastructure, and noted that, quote, the panel has repeatedly warned about the CCP's efforts to exploit access points into our communications networks and this apparent breach reinforces the urgent need to harden our defenses. In March, the House's Homeland Security Committee Chair Chair Republican Representative Mark Green of Tennessee sent a request to DHS asking the agency to transmit internal documents about Salt Typhoon and another Chinese hacking unit, Volt Typhoon, Greene said in a statement to nextgov, quote, every new detail that emerges surrounding the Salt Typhoon intrusions to teaches us the lengths Chinese backed hackers will go to undermine the integrity of our critical infrastructure, our US Sovereignty and the privacy of Americans, Green said. This is in reference to recent testimony from DHS Secretary Kristi Noem saying CISA is lacking detailed information about the telecom hacks. Okay. It's difficult not to wonder whether some additional manpower at CISA might help, green added. My colleagues and I on the committee share this concern, which is why we sent a letter in March to examine the previous administration's response to the Volt and Salt typhoon intrusions. Now, I was about to comment on that, that is that they were sending a letter about the previous administration's responses when I saw that nextgov's reporting had already done so, they wrote The Cyber Safety Review Board, a DHS body that was dismissed at the start of the Trump administration, was in the middle of investigating the Chinese telecom hacks. Lawmakers have called for it to be reinstated. CISA has also been mired in budget plans to slash significant parts of its workforce and operations. So I hope that CISA will be able to recover and rebuild whatever effectiveness it may have lost. It seems pretty clear that unfortunately, private industry is unwilling to to expend the cost and effort required to fully secure its own business operations. You know, they'd rather have their attorneys say, oh don't you know, don't tell anybody, but we'd like you not to look too closely because you, you could be put under oath and cross examined and we would rather have you say we were told not to look than we looked and found evidence of Chinese intrusion into our enterprise. When the public depends upon the security of those operations, there is clearly a legitimate need for oversight, for regulation, which can only come from the government, and for accountability that apparently needs to be imposed by the government. So hope we get that. Matthew Green, our illustrious cryptographer, says. Well, he concurs. I mentioned briefly in passing last week that someone named Matthew Garrett had looked at the encryption mechanisms underlying X's supposedly new all new, remember, rewritten in rust, end to end, encrypted X chat dm, you know, direct message facility and had decided that it was no better than the old one. He shared Elon's declaration about how it was written in Rust and unfortunately it turns out it's still written in C and C. Since then, Matthew Garrett's posting came to the attention of another Matthew. This Matthew was none other than the renowned Johns Hopkins University cryptographer Matthew Green. This Matthew is well known to this podcast. So this Matthew's posting last week titled A Bit More on Twitter X's new encrypted messaging is of interest. Matthews post is longer than we need and I've included a link to the entire thing in the show notes. So I'm just going to share his relatively short, bullet pointed introduction and summary. It'll really tell us as much as we need. So he wrote. Matthew Green posted. Matthew Garrett has a nice post about Twitter X's new end to end encryption messaging protocol, which is now called X Chat. The TLDR of Matthew's post is that from a cryptographic perspective, X Chat is not great. The details are all contained within Matthew's post, Matthew Green writes. But here's a quick TLDR from Matthew Green. First, there's no forward secrecy. Unlike Signal protocol, which uses a double ratchet to continuously update the user's secret keys, the Xchat cryptography just encrypts each message under a recipient's long term public key. The actual encryption mechanism is based on an encryption scheme from Libsodium. Second user Again, here it is. User private keys are stored at x.xchat stores user private keys at its own servers. To obtain your private keys, you first log into X's key storage system using a passwords such as a pin. This is needed to support stateless clients like web browsers. And in fairness, he writes, it's not dissimilar to what Meta has done with its encryption for Facebook messenger and Instagram. Of course those services use hardware security modules. And third, he says X's key storage is based on Juice Box. To implement their Secret storage system, XChat uses a protocol called Juicebox. Juicebox shards your key material across three servers so that in principle the loss or compromise of any one server won't hurt you. Okay so and we've talked about key sharing schemes in the past where a key is broken up into pieces so that no one person has the entire key and you see you need some some number of individuals to all come together in order to reassemble the original key. This sounds like what Juice Box is doing. So our Matthew Green writes. Matthew's post correctly identifies that the major vulnerability in X's system is this key storage approach. If decryption keys live in 3 non HSM servers that that are all under X's control, then X could probably obtain anyone's key and decrypt their messages. X could do this for their own internal purposes, for example, because there he writes, their famously chill owner got angry at some user. Or they could do it because a warrant or subpoena compels them to. If we judge X Chat as an end to end encryption scheme, this seems like a pretty game over type of vulnerability. And he says so in a sense everything comes down to the security of Juicebox and the specific deployment choices that X made. Since Matthew wrote his post, writes Matthew Green, I've learned a bit more about both of these in this post. I'd like to go on a slightly deeper dive into the juice box portion of X's system. This will hopefully shed some light on what X is up to and why you should not use X chat. So the bottom line is that Matthew Green concurs with Matthew Garrett, which is to say that no one should consider any encrypted messaging system to be securely end to end encrypted when such a system externally stores on its user's behalf their private keys. Now a perfect example is Apple's currently controversial Advanced Data Protection. What it explicitly does is give its users discretionary control over whether or not a copy of their private key is also retained by Apple. Allowing that enables additional features, but it also enables Apple to similarly respond to court ordered subpoenas in the case of Advanced data protection. If that's not what you want, or if you're and if you're not in the United Kingdom and all of your devices are running Apple OSs that support ADP, you know, iOS or iPadOS 16.2 or later in the case of iPhone and iPad, then you can turn that on and a new private key Apple has never seen will be created and shared only among your idevices. So no one should confuse Apple's state of the art encryption technology and for that matter signals with what Elon is peddling. I'm not suggesting that anyone necessarily needs end to end encrypted DMS on X, but everyone should be aware that they're not really available there to the same degree they are elsewhere. Nor for that matter are they available on Facebook, messenger or Instagram, which, as Matthew Green notes, similarly stores its users private keys in their own data centers in order to enable the features that are necessary. Leo, we're at an hour in. I want to talk about what we learned about Telegram. Let's take our third break.
