Risky Bulletin Podcast Summary
Episode: Between Two Nerds: How the Internet Gets Salt Typhoon Wrong
Release Date: February 3, 2025
Host/Author: risky.biz

1. Introduction and Host Discussion

In this episode of Risky Bulletin, hosts Tom Uran and Grock delve into the recent cybersecurity incident involving the Chinese hacker group Salt Typhoon. The conversation kicks off at [00:03], with Tom introducing the topic and expressing his frustration over the misrepresentation of the breach details across the internet.

Tom Uran:
"People on the Internet are wrong. So around Salt Typhoon..." ([00:11])

Grock responds by broadening the scope of Salt Typhoon's activities, suggesting that the group's reach within US telecommunications is more extensive than publicly disclosed.

Grock:
"Do they have more than eight? I mean, they've compromised most of the US essentially." ([00:43])

2. Misrepresentation of the Salt Typhoon Breach

A central theme of the discussion is the misreporting surrounding the breach. Tom clarifies that the Salt Typhoon group did not compromise the CALEA (Communications Assistance to Law Enforcement Act) system itself but rather accessed the system that logs law enforcement's wiretap requests.

Tom Uran:
"There is no evidence so far that hackers have compromised the collection system itself through which law enforcement listens in on wiretapped calls." ([02:33])

Grock counters by emphasizing the broader vulnerabilities that exist in telco communications, highlighting that the lack of encryption allows unauthorized access.

Grock:
"Communications are not encrypted. Anyone who has access to the network can see them. Therefore, for security reasons, we need to encrypt those communication systems." ([04:24])

3. Importance of Encryption and Legacy Infrastructure

The hosts discuss the inherent weaknesses in the telecommunications infrastructure, particularly focusing on protocols like SS7, which were developed in an era with different security paradigms.

Grock:
"The foundational protocols of telcos like SS7 is like 1980s or something era technology. It's from that era of the Internet... it's archaic and it cannot be fixed." ([14:52])

Tom adds that the legacy systems impose significant challenges for implementing security upgrades, making it difficult to address vulnerabilities swiftly.

Tom Uran:
"So it's hard and super error-prone to try and fix." ([15:40])

They also touch upon the concept of technical debt, explaining how the US's long-standing infrastructure complicates modernization efforts compared to countries starting with newer systems.

4. Legislative Responses and Security Incentives

The conversation shifts to the varying legislative approaches different countries have taken to bolster telco security. Tom points out that while Australia and the UK have introduced specific security measures, the US lacks comprehensive legislation, relying instead on more convoluted methods like whistleblower incentives.

Tom Uran:
"Australia had some from 2017... And then the UK has some from I think 2021... and US just basically doesn't have any legislation." ([16:50])

Grock explains the SEC’s initiative to encourage whistleblowers to report companies neglecting security, likening it to minimizing internal threats by leveraging employee oversight.

Grock:
"They're making not having good security a financial liability." ([20:28])

Tom highlights the challenges of such policies, noting that it relies on insiders to enforce security standards, which can be unreliable.

5. Targeted Espionage and Political Implications

The hosts analyze the nature of Salt Typhoon's operations, suggesting that the group's activities are highly targeted towards politically significant individuals and campaigns.

Grock:
"The victimology suggests that this was espionage. They got what they wanted and it was targeted." ([09:48])

Tom remarks on the selective outrage surrounding the breach, noting that the focus tends to be on the inadequacy of the US telcos rather than condemning the Chinese hackers themselves.

Tom Uran:
"People seem outraged that they allowed it to happen rather than outraged that the Chinese are doing it." ([10:07])

They discuss the implications for politicians, emphasizing the need for secure communication channels. Grock points out that while security protocols are advised, the practical uptake among high-profile individuals remains inconsistent.

Grock:
"I feel like they should know to take security precautions." ([11:22])

6. Conclusion

In wrapping up, Tom reiterates his primary concern about the misreporting of the Salt Typhoon breach, underscoring the importance of understanding the actual vulnerabilities rather than conflating different aspects of the breach.

Tom Uran:
"So, you know, so I've gotten my major gripe out that people were wrong." ([14:03])

He also reflects on the broader implications for telco security, acknowledging the persistent challenges posed by legacy systems and the complex landscape of cybersecurity legislation.

Tom Uran:
"It seems like this is trying to create that sort of incentive where the employees are now incentivized to make sure that their company is doing the right thing." ([21:57])

The episode concludes with mutual acknowledgments of the complexities discussed, leaving listeners with a nuanced understanding of the Salt Typhoon incident and the broader state of telco security.

Notable Quotes with Timestamps

• Tom Uran:
  "People on the Internet are wrong. So around Salt Typhoon..." ([00:11])

• Grock:
  "Do they have more than eight? I mean, they've compromised most of the US essentially." ([00:43])

• Tom Uran:
  "There is no evidence so far that hackers have compromised the collection system itself through which law enforcement listens in on wiretapped calls." ([02:33])

• Grock:
  "Communications are not encrypted. Anyone who has access to the network can see them. Therefore, for security reasons, we need to encrypt those communication systems." ([04:24])

• Grock:
  "The foundational protocols of telcos like SS7 is like 1980s or something era technology. It's from that era of the Internet... it's archaic and it cannot be fixed." ([14:52])

• Grock:
  "They're making not having good security a financial liability." ([20:28])

• Grock:
  "The victimology suggests that this was espionage. They got what they wanted and it was targeted." ([09:48])

• Tom Uran:
  "People seem outraged that they allowed it to happen rather than outraged that the Chinese are doing it." ([10:07])

• Grock:
  "I feel like they should know to take security precautions." ([11:22])

• Tom Uran:
  "So, you know, so I've gotten my major gripe out that people were wrong." ([14:03])

• Tom Uran:
  "It seems like this is trying to create that sort of incentive where the employees are now incentivized to make sure that their company is doing the right thing." ([21:57])

This episode provides a comprehensive examination of the Salt Typhoon breach, highlighting the nuances often lost in broader media reporting. Through their detailed discussion, Tom and Grock shed light on the technical and legislative challenges in securing telecommunications infrastructure, emphasizing the need for accurate information and robust security measures in the face of sophisticated cyber threats.