Hacker groups aligned with China, aka “Salt Typhoon”, “Volt Typhoon” and “Flax Typhoon”, are hacking U.S. infrastructure in a new wave of cyber attacks launching malicious IoT botnets and burrowing into U.S. Internet service providers.
Vulnerabilities in our critical infrastructure opens the U.S. up to hostile actor intelligence gathering, foreign technological advantages and exerting leverage in the event of full scale war.
What Critical U.S. Telecommunications Infrastructure Has Been Targeted?
Today’s U.S. critical infrastructure systems include power grids, water treatment facilities, transportation networks, and telecommunications systems… Such infrastructure is essential for the functioning of our republic.
According to recent reports, several aspects of our telecommunications infrastructure have been targeted including, but not limited to:
- Internet Service Providers (ISPs)
- Cellular networks
- Cable and broadband providers
- Broader supply chain telecommunications hardware providers, such as Cisco Systems and Microsoft
- Internet of Things (IoT) devices
- Communications software
- Connected vehicle technologies
Any compromise, disruption or failure in these systems can have severe consequences, including potential loss of life, economic damage, and national security threats.
By gaining access to root or core access to networked hardware, China or another foreign actor could launch a damaging cyberattack, redirect Internet traffic or install malicious software.
As recently described in court documents unsealed in the Western District of Pennsylvania, a botnet of devices was infected by People’s Republic of China (PRC) state-sponsored hackers working for Integrity Technology Group, a company based in Beijing, and known to the private sector as “Flax Typhoon.”
Common vulnerabilities and exposures (CVEs) have been found in hardware routers, IoT devices and web-facing applications, including:
- Apache (10 CVEs)
- Cisco (5 CVEs)
- Zyxel (3 CVEs)
- QNAP (3 CVEs)
- Fortinet (3 CVEs)
- Draytek (3 CVEs)
- WordPress (2 CVEs)
- Telesquare (2 CVEs)
- Ivanti (2 CVEs)
- IBM (2 CVEs)
- F5 (2 CVEs)
- Contec (2 CVEs)
- Chamilo (2 CVEs)
Any systems that are part of a supply chain may be vulnerable to a supply chain attack, or other cyber attacks, which could lead to unauthorized access, manipulation, or disruption of U.S. operations.
It could also provide a hostile foreign actor with access to private sector and public entity intelligence, including valuable industrial or military secrets.
How Did This Happen?
To be clear, this appears to be merely the latest announcement in a multiyear effort by China-linked hacking and espionage efforts to infiltrate U.S. critical infrastructure, including telecom networks.
China hacking U.S. infrastructure is believed to be an ongoing, covert threat that China consistently denies.
Many critical infrastructure systems are interconnected and rely on industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems, which were often designed without adequate security measures in mind. This leaves them open to being hacked.
However, in many cyber attacks, such as the APT 10 telecom attack of 2018-2019, hackers breach telecommunications company networks through traditional, tried and true social engineering methods, such as spearphishing emails and other tactics.
The clandestine nature of state-sponsored hackers aims to evade detection by cloaking themselves using VPNs, botnets and compromised devices to mask their activities, or misdirect authorities in the event they are noticed. Such strategies allow for long-term persistence within targeted networks.
The Problem With Backdoors Only for “Good Guys”
However, there is also evidence that the hackers exploited the backdoors mandated by the Communications Assistance for Law Enforcement Act (CALEA), a statute enacted by Congress in 1994.
CALEA required that telecommunications carriers and manufacturers of telecommunications equipment design their equipment, facilities an services to ensure that they have the necessary surveillance capabilities to comply with legal requests for information.
CALEA was intended to preserve the ability of law enforcement agencies to conduct electronic surveillance (pertinent to an investigation) while protecting the privacy of information outside the scope of the investigation. In 2005, the Commission extended coverage of CALEA to include facilities-based broadband Internet service providers and providers of interconnected Voice over Internet Protocol (VoIP) service.
Regrettably, any system that can be exploited for legal means (i.e. the “good guys”) may also be vulnerable to being exploited for illegal ones (i.e. by the “bad guys”). And it turns out that this is the case with Salt Typhoon. that the backdoors provided by CALEA were one of numerous methods used by the hackers to gain access to U.S. telecommunications networks.
Interconnected Supply Chains
The increasingly interconnected nature of programmable hardware and IoT devices, combined with the complex value chain of domestic and foreign components manufacturers of our telecommunications hardware, make the cybersecurity challenge even more daunting.
The Biden administration recently published a proposed rulemaking that prohibits the sale or import of connected vehicles that incorporate certain technology and components from “countries of concern”, specifically the People’s Republic of China and Russia.
Why Is China Hacking U.S. Infrastructure?
Cyber threats to critical infrastructure are constantly evolving, and sophisticated threat actors such as nation-states, cybercriminals, and hacktivists constantly seek to exploit vulnerabilities for various motives, including espionage, sabotage, or financial gain.
However, the China-linked hacking campaign targeting U.S. telecommunications infrastructure and IoT devices appears to be part of a long-term, strategic effort in next-level warfare, intelligence gathering and potential espionage.
China’s key objectives around hacking U.S. infrastructure may include, but not be limited to:
- Monitoring Of Political Assets: By gaining access to telecommunications infrastructure and breaching internal systems, hacking groups can obtain data records to reveal and track where certain individuals, such as political dissidents, military or government officials go and whom they contact. This provides valuable foreign intelligence.
- Preparation For Potential Conflict: Chinese state-sponsored hackers have reportedly infiltrated U.S. critical infrastructure, including telecommunications networks, and maintained a hidden presence for up to five years in some cases. This prolonged access suggests China is positioning itself to potentially disrupt or damage U.S. infrastructure in the event of a major conflict or geopolitical crisis.
- Deterrence and Leverage: By demonstrating the capability to compromise vital U.S. systems, China likely aims to deter U.S. intervention in potential future conflicts, particularly regarding Taiwan. The threat of infrastructure disruption provides China with strategic leverage against the United States.
- Intelligence Gathering: While the primary focus appears to be pre-positioning for potential attacks, these intrusions also allow China to gather valuable intelligence on U.S. telecommunications networks and other critical sectors.
- Technological Advantage: Access to U.S. telecommunications infrastructure may provide insights into advanced technologies and operational practices, potentially aiding China’s own technological development and cyber capabilities.
FBI Director Christopher Wray has warned that China is developing the “ability to physically wreak havoc on our critical infrastructure at a time of its choosing.”1
FBI Recommends End-To-End Encryption
End-to-end encryption (E2EE) is a technology that ensures data is only accessible to the sender and the recipient, providing a robust layer of security for digital communications.
E2EE services use a technology called “public key encryption”. As illustrated above, when you use a messaging service that uses end-to-end encryption, a pair of encryption keys is generated on your device:
- A public key for encrypting messages, and
- A private key for decrypting them
The public key is shared with others when you communicate, while the private key remains on your device. Messages that are encrypted end-to-end cannot be read by hackers or even the service provider, such as Apple.
After years of lobbying against the use of end-to-end encryption in the name of law enforcement, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) recently publicly recommended that people use encryption, such as iMessage, to communicate.
While iMessage does offer end-to-end encryption, it’s important to note that this end-to-end encryption applies only to messages sent between Apple devices using iMessage. Messages sent to non-iMessage users, such as those on Android devices, do not benefit from this encryption and are sent as SMS texts.
For cross-platform communications, users should consider a 3rd party messaging service, such as WhatsApp or Signal.
iMessage has continually improved its encryption protocols, recently introducing PQ3 for enhanced security against quantum attacks.
Summary
A successful cyber attack on critical infrastructure could have cascading effects, potentially causing widespread service disruptions, property damage, environmental disasters, and even loss of life. For example, a cyber attack on a power plant could lead to widespread blackouts, affecting hospitals, transportation, and other essential services.
Cyber attacks on critical infrastructure can also undermine public confidence and trust in the systems that govern modern societies, leading to social and political instability.
Implementing robust cybersecurity measures can help prevent and mitigate the impact of cyber attacks, ensuring the continuity of operations, protecting sensitive data, and safeguarding public safety and national security.
Unfortunately, in the case of CALEA, the result is yet another blow for user privacy with little to no consequences for either the hackers or the politicians who create laws requiring backdoors be implemented in critical infrastructure…
Again, China denies involvement in these cyber operations… However, U.S. officials and private cybersecurity companies have attributed the campaign to Chinese state-sponsored actors.
The persistent nature of these intrusions, despite U.S. efforts to counter them, underscores the significant and ongoing threat posed by Chinese cyber operations to U.S. national security…
Indeed, the FBI recently made a recommendation for people to use end-to-end encryption for encrypted messages on these networks.
If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3) or report online to CISA. You may also contact your local FBI field office directly.
The FBI continues to investigate Integrity Technology Group’s and Flax Typhoon’s computer intrusion activities.
