Chuck Darwin<p>The Chinese government espionage campaign that has deeply penetrated more than a dozen U.S. telecommunications companies is the <br>“worst telecom hack in our nation’s history — by far,” <br>senior U.S. senator Mark Warner told The Washington Post in an interview this week.<br>
The hackers, part of a group dubbed <a href="https://c.im/tags/Salt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Salt</span></a> <a href="https://c.im/tags/Typhoon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Typhoon</span></a>, have been able to listen in on audio calls in real time <br>and have in some cases moved from one telecom network to another, <br>exploiting relationships of “trust,” <br>said Sen. Mark R. Warner (D-Virginia), chairman of the Senate Intelligence Committee and a former telecom venture capitalist. </p><p>Warner added that intruders are still in the networks.<br>
Though fewer than 150 victims have been identified and notified by the FBI <br>— most of them in the Washington, D.C., region, the records of people those individuals have called or sent text messages to run into the “millions,” he said, <br>“and that number could go up dramatically.”<br>
Those records could provide further information to help the Chinese identify other people whose devices they want to target, he said. <br>“My hair’s on fire,” Warner said</p><p>Those details, some previously undisclosed, add to the alarming understanding of the scope of the hack since late September, <br>when the U.S. government was alerted to it. </p><p>“The American people need to know” how serious the intrusion is, Warner said.<br>
The hackers targeted the phones of President-elect Donald Trump, <br>his running mate JD Vance, <br>as well as people working for the campaign of Vice President Kamala Harris <br>and State Department officials.<br>
The effort was not directly election-related, Warner noted, <br>as the hackers got into the telecom systems months earlier <br>— in some cases more than a year ago.<br>
The networks are still compromised and booting the hackers out could involve physically replacing <br>“literally thousands and thousands and thousands of pieces of equipment across the country,” <br>specifically outdated routers and switches, Warner said.<br>
“This is an ongoing effort by China to infiltrate telecom systems around the world, <br>to exfiltrate huge amounts of data,” he said.<br>
The Salt Typhoon telecom breach makes Colonial Pipeline and SolarWinds <br>— major cyberattacks linked, respectively, to Russian-speaking criminals and to the Russian government <br>— “look like child’s play,” Warner said.</p><p>The Salt Typhoon hack is seen by government officials as an espionage operation rather than pre-positioning for a critical infrastructure sabotage.<br>
Hackers have acquired access to the system that logs U.S. law enforcement requests for criminal wiretaps, <br>-- allowing the Chinese to know who is of interest to authorities. </p><p>There is no evidence so far that hackers have compromised the collection system itself through which law enforcement listens in on wiretapped calls, <br>said U.S. officials, speaking on the condition of anonymity because of the matter’s sensitivity.<br>
The calls on which Chinese hackers were able to listen in were not part of the “lawful intercept,” or wiretap, system, officials said. </p><p>But hackers also had access unencrypted communications, including text messages. </p><p>End-to-end encrypted communications such as those on the Signal platform are believed to be protected, officials said.<br>
The Post previously reported that the hackers were able to reconfigure Cisco routers to exfiltrate data from Verizon networks.</p><p>The FBI is investigating the intrusion, along with other federal agencies.<br>
“Specifically, we have identified that [Chinese government]-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, <br>the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, <br>and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders,” <br>the FBI said in a statement issued with the Cybersecurity and Infrastructure Security Agency earlier this month.<br>
So far, the hack is known to have affected major U.S. firms such as AT&T, Verizon and T-Mobile, U.S. and industry officials said.</p><p>
“This is massive, and we have a particularly vulnerable system,” Warner said. </p><p>“Unlike some of the European countries where you might have a single telco, our networks are a hodgepodge of old networks. ... <br>The big networks are combinations of a whole series of acquisitions, and you have equipment out there that’s so old it’s unpatchable.”</p><p><a href="https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">washingtonpost.com/national-se</span><span class="invisible">curity/2024/11/21/salt-typhoon-china-hack-telecom/</span></a></p>