china hacks every telephone network (still there?)
ฝัง
- เผยแพร่เมื่อ 8 ก.พ. 2025
- You should start using signal, or telegram, or really anything encrypted. Turns out China has hacked into 8, and potentially more telecommunication providers in the US and other countries.
🏫 COURSES 🏫 Learn to code in C at lowlevel.academy
🔥 SOCIALS 🔥 Come hang out at lowlevel.tv
🔴 LIVE @ twitch.tv/LowLevelTV come say hi! Or don’t
LI was introduced in both TDMA and GSM systems in the early 1990s and has been included in every subsequent generation. I worked on the original LI design for TDMA with a major telecom equipment manufacturer. This was done in great secrecy. LI is to this day still part of the Conditions of Licence every CSP must abide to in order to use its allocated spectrum.
Australia shut its entire 3G network off recently ;-) Sooooooooo many backdoors. Life is fine without it, a few phones stopped working but a lot of scams did too
@@MacGuffin1 It has nothing to do with 3G. It's been part of every cellular core network design since the early 1990s. And it is not a backdoor either.
At 2:05 the best Chinese impersonation by a white guy.... Hmmm ... ha-ha
@@smcdonald9991 If you worked on creating this then you're culpable.
Damn, who could have foreseen that backdoors could be exploited by (other) bad actors?!
yeah who knew cultivating backdoors for domestic surveillance could...have bad consequences...for foreign infiltration...🤯🤯🤯
If only someone had spoken up! /s
Don't worry guys, the backdoor has rules and oversight to prevent bad actors.
@@DABATTLESUIT hey maybe a dumb question and I’m a dumb guy so forgive the dumb question.
Is that what Edward Snowden did and got in trouble for? Whistleblowing about the backdoors?
The thing is, China is not a bad actor. The United States on the other hand is a plague.
I feel like the ones who asked for the backdoors should be held accountable for it too...
Well it was George W. Bush that signed the Patriot Act which required the LI to be put into the networks. He’s got a heck of a lot more to be accountable for.
It's the NSA and asking people to install the backdoors is kinda close to their core business.
This stuff goes back to the Patriot Act in 2001 and Bush getting reelected in 2004, at that point it was clear that the American people would be fine enough with getting the full surveillance package.
Currently the FBI is backpedaling and telling people to properly encrypt after all (which is pretty hard actually if approximately every piece of hardware and Software including OS's are compromised by default) but they'll default back soon enough and before long surveillance extremists inside secret services and police departments will go and convince enough politicians to outlaw strong encryption alltogether (which the FBI actually vetoed against when it was proposed in 2019 which helped to stop the Lawful Access to Encrypted Data (LAED) Act in 2020, but "they" will surely try again).
Believe it not but there are valid cases for backdoors other than for surveillance. But, these idiot fucks in law enforcement and intelligence are too dumb to learn the risks posed by abusing backdoors non-stop as a shortcut for figuring shit out and profiling 'people of interest' instead of doing actual old-skool investigations. These idiot-fuck law enforcement types put us in this hole by citing 'national security' and 'domestic terror threat' but they'll not be held accountable ever ...
And the worst part of this story is that even after getting unbridled access to all these backdoors and deep-packet scanning tech ... these james-bond wannabes still could not prevent mass shootings and assassination attempts. The federal government is such a mega-massive clusterfuck it's unreal. I have nothing but hatred, disdain and contempt for these federal government idiots who think they know what they're doing.
@@andy02qlook a bit past the headline, best to assume they already have backdoor in many encrypted services they dont need to be that overt. its not like they won't eventually force if it truly becomes annoying for them
That might be a political question in the end, but my take on it is, if people in power decide to disable the countrys firewall and completely open the borders and in addition to that, also believe in unvalidated user input and no input sanitation what soever, probably such people of power do not really care about infrastructure security either.
Who knew having backdoors for the government was a bad idea. Now the FBI want you to use encrypted messaging apps, but they also want to put backdoors in those.
I've been using private apps for a long time, there are spyware everywhere
These people just never learn their lessons. You can't create a means to spy on people for yourself without also risking others using it.
That's why you use opensource messaging apps
@@RoboBabeXDprivate?
The government can already crack any encryption commercially available. It wouldn't be allowed to exist if they couldn't. They just talk about encryption being unable to be cracked because they don't want to reveal sources and methods of intelligence gathering. As long as they don't use something as evidence at a criminal trial they don't have to disclose it. It's why they don't use stingray data.
US government: we vow to take
action!
Everyone: so you will do something about the backdoor?
US government: ...
Everyone: you WILL do something about the backdoor...right?
They will paint it white to match the color of the walls, so no one will see it. Totally safe now.
👀 🤐😶🌫️
If the worthless-to-actively-harmful US government can be counted on, it's to do nothing productive at all in the best case. Worst case, Trump gives Chairman Pooh the nuclear codes and back door access to everything, assuming his dommy Putin gives him permission.
we didn't say appropriate action.
- the government, probably
Lock the backdoor but leave the pet opening unlocked.
iirc the military has been dealing with this as well for 10+ years now.
Dont wanna get hacked? Dont put backdoors. Lastly, pretend you are always hacked.
Also, assume that half of your users are acting in bad faith, and it's physically impossible to tell which ones are the bad ones, but you have to provide services anyways. Once you assume that most users are malicious, but you ALSO need to provide effective services anyways - that completely changes how you design software.
@@arthurwintersight7868 "assume"? No, they ARE acting in bad faith just by being too lazy to use good passwords and writing them down places and trying to be as lazy as possible when it comes to decent security and account sharing.
Well said @@arthurwintersight7868
I am baffled how people still defend all the surveillance infrastructure.
Yeah, it's never even helped in preventing terrorism like they claimed it would. Consider all of the shootings, terrorist attacks and massacres where the FBI said "they were on our radar".
How many of those are people and how many of those are "people" (bots or paid trolls)
How many people have jobs that depend on the surveillance infrastructure? You’ll find that most of them will support it unquestionably.
@@MarcoAntonio-jq7lo I will tell you... you can see the numbers. Every single person that voted Red or Blue. You can get a pretty solid count.
@@CD-vb9fi ah yes, because every person is a single-issue voter. Understood.
"Lawful intercept architecture"
Just in case you were wondering if this was legal, they put it right in the name. Privacy has always been between you, the person you're talking to, and the federal government.
👍
You think they listen to you? 🤪
Privacy was never explicitly stated to be part of the telecom network. That's the problem.
I'm surprised that they didn't they have a robust multi-factor login to the spying system.
You not getting spied on is only guaranteed in the physical mail. Every thing else is open to being tracked without a warrant.
It’s almost like what’s lawful and what’s ethical/moral/good are not equal things.
While it definitely appears like industry is giving state power access to spy on its users, it’s very important to remember and understand who truly controls state power. We’re told its citizens, but alllllll data & evidence points to capital controlling state power and the laws it puts into place.
Definitely a feature and not a bug, with their obvious response being “well we’re going to need MOAR SURVEILLANCE to protect you against these ‘bad actors’. Pay no mind to what/when/how long/where we’ve been spying on you and for what purpose. It’s in your own best interest, we pinky promise! 🥺👉🏻👈🏻
A feature, not a bug
agree
If you don't like it, you're clearly a drug dealer or terrorist right... otherwise what do you have to hide hmmmmmm?!??!
- CCP, 2024
I suggest looking up certain financial institutions that like a certain color and whether or not they may have helped a certain governments financial build up
do you want the design or the documentation
Note: Lawful intercept is not just in the 3G standard. It is in 2G, 3G 4G and 5G like it said on the page you were on. I think you got it from 3GPP which is just the worldwide standards organization for 2G, 3G, 4G, 5G and 6G. Similar to the IETF.
Exactly. It's every country's problem, not just the US. However, one massive caveat is that not every telecom provider might not have implemented the backdoor. Specially, if the government under which the provider operates, did not mandate it.
@@mintoo2cool and who is to say the backdoor isnt in the architecture itself such as the NSA backdoor within the random number generation algorithm used in common encryption, rsa, aes etc
It is pretty well all telecoms switching, has been for years. Governments insisted on it when we all went to digital switches and now it is more or less all IP based it is worse. In the old days we had to busy out a traffic circuit and run jumpers to a targets frame connection. Now the the spooks/police have access via the LIG from their desktop and we don't even know.
I was going to comment the same thing. 3GPP became the standards body for wireless providers and isn’t just for 3G standards anymore.
@@CrazyMineCuber VOIP too
I will tell you a story. I worked as a security analyst for one of the affected telecoms roughly 17 years ago. This was when Greece's telecom got compromised and the LE interfaces to Vodfone switches on the wireless network were used to eavesdrop on 100 politicians' and VIPs' cellphones. One of the executives who ran the Wireless division which was the moneymaker for the firm visited our SOC. I asked him if he was concerned about the Vodafone incident. He said he wasn't concerned since Wireless didn't use Vodafone switches.
My god 🤯. I hope you took the opportunity to sit him down and educate him. Executives are usually extraordinarily proficient at getting shit done, but they sometimes aren't technically proficient in the least.
@@trudyandgeorge I was a lowly analyst. Why would the head of the Wireless division listen to me? I let it go at that point. Educating him would have been frowned upon. I would have embarrassed my bosses had I tried.
@@johnmoore8599 gosh almighty dude what a story 😂 you've got to laugh, otherwise you'd cry 😅
@@johnmoore8599 It's interesting that you seem to hold the exec responsible for his idiocy, but your copout of being a lowly tech is fine.
Cowards are quite literally part of the problem.
@@johnmoore8599You should have grown a pair and stood up.
If necessary get a different job.
There is no excuse.
Maybe legislation to remove the requirement for a backdoor would be a start?
Or simply enforcing the motherfucking 4th amendment would be. There is absolutely no need for another goddamn amendment stuck in gridlock for the rest of our lives.
No, ban the backdoor entirely.
Don't make it optional. Make it mandatory to REMOVE the backdoors and secure the network.
Guys, you can just write legislation forcing companies to update their firmware or otherwise they have to pay massive fees. It shouldnt be cheaper to ignore these vulnerabilities.
bruh, there is no written law, but the radioactive people tell them once these things are put in, they can't tell anyone about them.
This is all literally the culmination of problems of the pattriot act.
Here's an idea: Legislation that classifies the knowing creation of backdoors as a form of cybercrime, punishable with a mandatory minimum of ten years in federal jail.
CIA: Use encrypted call apps
NSA: no no no no no!
NSA has a dual role, to also protect it's citizens... in theory
@@autohmae So, like our medical system? Keep people healthy, but not so healthy that they don't need to keep coming back for more treatment or medicine?
I'm not sure the encrypted apps help against the NSA.
@@dimitrioskantakouzinos8590 if the encrypted apps are in the US, we know from the Snowdon documents that they can get legal access.
@@autohmae Until Bush turned the NSA into an agency to spy on americans.
Bro “back to back world war champs” was the funniest thing I’ve heard in my life
🦅🦅🦅🦅🦅🦅🦅🦅🦅
Never forget baby 🇺🇸🇺🇸🇺🇸
I was laughing at that too, so out of pocket
we didn't even win the world wars, what are you talking about? 😂
@@LowLevelTV
@@TiBiAstro We for certain played a major role in tipping the scale for ww2. I am unclear as to our impact, if any on the "Great War" however.
The figure they gave during my annual cisco security training is that intruders are typically in a network for 200-ish days before an intrusion or breach is detected.
So fun fact, the NSA did *allllmooosttt* the *exact same* thing to a Greek telco around the time they were hosting the Olympics.
Whole Japan phone network is "mirrored" to usa 3 words agency's.
it has happened quite a few times since. its sad.
@@adonaros a few times? :D
Just a social engineering game of attention. If this feature is long known, then why only Chinese hackers do it .
I used to design and implement mobile networks around Europe from the late 1990s onwards (2G - 4G). Lawful Intercept (LI) is always part of the configuration - it actually uses the conference bridges that are built into switches to permit complete transparent interception. In some countries the link to the security agencies was by means of leased digital circuits - multiples of 2 Mbit/s - 30 channels, which makes the LI much more secure. The key parameter we had to work by was what proportion of calls could be concurrently intercepted - typically 1 - 2% - quite big numbers!
1-2% ? thats a lot
Ooo, conference calls, this isn't just a wiretap problem then...
@ I think you misunderstood - the conference bridges in a switch are used to perform the LI function in a completely unintrusive way, as well as providing conference call facilities.
Equifax had to pay hundreds of millions of dollars for not patching back doors over a few months.
U.S. Government:
I have a bunch of comments, but to narrow it down to important points: Telcos do not like paying to maintain infrastructure, even if they are well paid to do it, this is actually a major motivation for interest in 5G in management of AT&T for example. They also don't really care about these compromises because they have almost blanket protection legally due to arrangements with law enforcement to do exactly the same wire tapping the Chinese do.
Also, you do *not* want Cisco doing automatic updates to your network hardware, that would be insane and they aren't trustworthy in the first place.
Most of these sort of systems are running on 10 year old hardware and there is no budget. It is much easier for politicians to pass laws that say "provide access" and "be secure" than it is for them to find funding to ensure those systems get updated. Regarding automated updates, I'm sure almost no telco does this, not just because of trust issues, but they don't want a router randomly restarting in the middle of the business day, because someone pushed an update.
@@alexjenner1108 I'm not fully aware of every Cisco product, however, I don't think automatic updates are an option on enterprise hardware or even SOHO gear for that matter. But I do believe that Cisco hardware is expensive, the certs are difficult and create a lot of haters.
I work in infrastructure. Yesterday i was working on an AB PLC-5/30. From 1986. I was born in 1988. I have never been to a "modern" site that i wasn't actively building. There just isn't money to keep things modern. No one cares. They just don't want to pay taxes.
Funnily enough this is one of the proposed legislations. To punish companies on critical infrastructure for not upgrading. So, hopefully that doesn't get messed with when going through.
There is money alright... It's whats been going into the Telecoms shareholders pockets for decades. That more than government regulations and taxes, is the biggest reason why. Case in point... When was the last time you've seen a major industry self-fund their own infrastructure or tech without some direct form of subsidy or tax kick-back? Companies / Wall Street are just letting the infrastructure rot knowing that eventually the squeaky wheel will get greased.
@@backlogbuddies What they really should do: Make it illegal to sell networking equipment that doesn't have a 50 year lifespan. As in... a lifespan that has some correlation with the rest of the equipment being installed. Why the heck do so we have these ridiculously short lifespans onj networking equipment... Somebody puts in a weather stations (in Canada.) it's going to be there for 20 to 30 years... maybe be visited once or twice when something breaks, that's it. with current networking crap, they have to do three or four times the visits just to replace networking gear every three years. most of the maintenance budget is getting the flight and the rental, and the person to the site, and second guy to shoot polar bears... the networking stuff is chump change... but can you get networking gear for 20 years? no... why?
@@petersilva037 If you're really curious, it's because the landscape around IT, software and hardware, changes so quickly. Let's start with security - In 1997, we released WEP(Wired Equivalent Privacy) as a standard and it was the best they could come up with at the time. WEP was cracked a few years later, and superseded by WPA in 2003, which moved to WPA2 shortly after. Today, you can crack WEP in a few minutes with the right software, which means any system running WEP is terribly insecure. Spread that across every single encryption and security standard, and you start to get the picture. At least for now, saying a piece of technical equipment should last 50 years is like building stone castles to defend against stealth bombers.
Now let's talk functionality. Back in 1970, 50 kbps was considered a good network connection. Today, 500-600 mbps, thousands of times faster, is common for home use. Things don't last 50 years, in some cases, because 50 year old equipment would be unusable for modern purposes.
Now I suspect over the next hundred years that things will actually start to settle. Historically speaking though, this whole "IT" concept is still incredibly new, and in constant flux.
I spent a number of years in the telecom industry. It’s ruled by “if it ain’t broke don’t upgrade it “mentality. I am not the least bit surprised.
There is nothing to see here. As long as the stockholders are making money, it matters not if information was stolen, systems compromised, or anything, hell they probably sold the backdoors to make their quarter fatter. This country is now about one thing - MAKE MORE MONEY!!!!
Hell Yeah brother! Hawk Tuah! Murica!
@@skcalanderson It has always been about money post-foundation. From slavery to the Federal Reserve. The US keeps amassing a tab of evil actions in exchange for money, and this will undoubtedly catch up with it. As a result, many innocent bystanders will suffer for the actions of a few.
Always been... or do you wear rose tinted glasses when looking at history?
@@haraldbackfisch1981 It has not always been this extreme. Because people used to work in the same company, and the reputation of said company affected your reputation, people used to value their companies reputation (and thus not letting them do bad and stupid things) much more.
@@haraldbackfisch1981 Thats a little bit ahistorical.
A lot of the United States was always about making more money for the Aristocrats and Oliarchs yes.
But it is a more recent development to have the laws, legislation, and public image tied so heavily to money and Aristocracy and Oliarchy. Some of our founding fathers, including Thomas Pain the man who wrote the first draft of the consitution; left the nation after the revolutionary war to later take part in directly writting and contributing to the invention Anarcism, Money-less economic theorys, and Anarcho-Communism, mutual aid ecology(as an counter for monied economy) and even assited in the first of many tragic failed revolutions to insitute these; the Parisian Commune.
I think its more fair to say that the USA was founded on an tug of war between left-wing libritations and slave-capitalism, and while the slave part did not win, the capitalism did.
It's not as easy as upgrading your firmware. A lot of this stuff is end of life and has no patch available. Back when I was a network engineer at a major US bank we had switches and routers that were 20+ years old and the bank refused to replace them because it would cost too much.
@@rigell2764 But thats when legislation comes in. You should force these companies to replace and upgrade their stuff if there are known vulnerabilities or otherwise these companies have to pay massive fees. It shouldnt be cheaper to just not upgrade this stuff.
Not to mention that if you're running critical infrastructure, you don't just yolo auto updates and consider it finished; any update could potentially introduce breaking changes that bring down key systems. These companies are extremely conservative for a reason. That's not to say that the only alternative is never to update, but it's absolutely not "as simple as just installing updates".
This is no more than a bad excuse really. Cisco are still in business and this happens because they want you to buy new gear which has load of bugs in it. They don't want the costs involved in having and fixing all those code bases for all the old stuff they sold you that is working just fine. When network equipment is bought and used in critical infrastructure like this, they really have to maintain it until nobody uses it. This is achievable by clever software and hardware engineering but bah who needs security fix it later, thanks for all your money.
@@danp8321 But it is never an option to have a system that has KNOWN vulnerabilities and just let it sit there for hundreds of years. If it takes a little bit longer to make sure everything works fine, ok. But these companies didn't even try to update anything.
@@danp8321 In a few years that workflow will be a thing of the past; everything will be replaced by AI agents including the management of network traffic. Operating systems will not be composed of tens of millions of lines of code anymore; it's going to be a few thousand lines of industry perfected boilerplate AI with a plethora of models to load for every task and orchestrators to march the puppets towards an overall goal. Thus the next great cybersecurity front is alignment, how to break it, how to build it, how to poison it, etc..
Did my guy just say "back-to-back world war champs"?
America numba one baby!
'Murica! 🦅🔫💥
America has been owned by the Rothschild family since at least 1912. At least you're doing better than us in England, they've owned this place since the 1800s
Yup! Batting 100% baby!
No matter how they got in, until SS7 is replaced it will never be secure.
I agree. And I'd expect that if you are targeted then hackers can use SS7 to circumvent your Multifactor Authentication if it uses text messages.
Truly amazing that we're stuck with boomer tech that has zero auth / encryption / security.
@ehsnils absolutely, it doesn't even matter what carrier they have ss7 access on, you and the sender could be on a completely different carrier and you can read all SMS
@@djksfhakhaks yup. popped in seconds if need be. that simple. . oh well .. forest life looms
Let's rephrase the title to: USA gets angry at someone else also doing what they do.
Typical loser like behavior of the US.
China is gonna dominate
"You want to win but you don't want to lose? Erm... Hypocrite much?"
_Rules for thee not for me_
"I think we got all of them, see no weird processes running."
CCP Bros in ring -3 "Yeah they got all our weird processes we placed. I think they even deleted some legit ones too."
cute you still count privilege rings using the real numbers...wait till you see the stuff in ring 2+4i
Wait, if ring 0 is kernel, and ring -1 and -2 are firmware and hardware, what is -3?
@@Rudxain Intel ME/AMD PSP would be ring -3.
@@Rudxain intel management engine or AMD platform processor.
From wiki:
In x86 systems, the x86 hardware virtualization (VT-x and SVM) is referred as "ring −1", the System Management Mode is referred as "ring −2", the Intel Management Engine and AMD Platform Security Processor are sometimes referred as "ring −3".[21]
Breaking news: legislaters make it illegal to hack telicom networks and makes it so telecom companies have to have "secure backdoors."
I tell you one thing we need. We need a security system for caller ID similar to domain name security spoofing caller ID numbers and names is so out of hand that people can't trust phone calls anymore and that is fixable. We know when we go to an internet address that the gatekeepers that perform DNS for us make it relatively safe to know that our banks URL is valid, that level of security has to be instituted for phone calls
This goes back to the Communications Assistance for Law Enforcement Act and was greatly expanded on with the so called Patriot Act. I'm surprised it took so long, in fact, I'm willing to bet that as more information comes to light, we will find out that this goes back for several years.
Exactly. We NEED to get the government to repeal RISAA and start enforcing the 4th amendment again.
The National Security Letter is really scary too
My bet is it goes back to Obama era, just like recent reveals... as well as foreign interference campaign operations...
@@PrograError Bush, because of 9/11
@@autohmae no, I mean the hacking attempts and stuff.
Internet culture only really bloomed during Obama. Bush era is still really the business computer/ internet era. Obama era for Internet is really the rise of the nerds, that's when FB, YT, etc really rose up and became the tech bros.
The only law that would actually impact this is codifying security lapses as criminal negligence on the part of the C-suite. The only way those at the top will care about these sort of issues is if they can be materially impacted. Not that it's exactly the same, it's similar to BCBS reverting an unpopular policy immediately in the wake of a competitor's CEO getting shot. The challenge there is writing the law such that it can be meaningfully enforced. Look at companies that have had major security breaches that continue on almost as if it didn't happen. If we want real reform we need real consequences for people that are largely immune from consequences. What's worse is that the public is largely becoming numb to these breaches due to the continuous nature of them.
While with many things I would agree (big jailtime for the four past boeing ceo's and other execs, for example), and I too am not remotely upset about the UHC "incident" (and I'm not even american lol), but in this case, prosecuting the C-suite would be really BS. Like low level mentioned, even with infinite resources, you can't secure this leaky system (read up on SS7) without starting over from scratch. That would A; bring major service distuptions, B: take a really long time and C: probably breakt compatibility with many/most of existing standards; a lot of things are out of telco's control. It's easy to blame the execs when your lawmakers are the ones that literaly allow the placement of backdoors/require cooperation with the NSA and such organizations.
This isn't like a regular company hack, (where many things can be done to fix security, as it is all in the companies control) but cellphone infrastructure as a whole.
But hey, as long as my HTTPS packets get through, IDGAF.
We've had monumentally strong computer encryption for like 25 years now, and the US govt. is just like "Huh wow look at this fancy futuristic tech. Let's continue to actually be a joke and laughingstock on the face of the planet because we invented the internet but can't tell our ass from our elbow digitally."
Law to ban backdoors
won't happen as the u.s. operates under 2 false pretenses.
That banning "hacking" is enough and no responsibility should be placed on companies to meet certain security thresholds.
and
that qhen the cia or nsa have a way to penetrate a platform that they should keep it secret so they keep having access because the risk of a foreign enemy abusing the bug is worth it to be able to spy on its citizens/foreign citizens
Constitutional Amendment guaranteeing the right to privacy would be a start.
But there are a lot of nerve endings.
@@futuza You mean the Fourth Mother.Fucking Amendment ? (constitution.congress.gov/constitution/amendment-4/) Oh! We have had that on paper since 1791 ... People think that a piece of paper can protect them from big brother ..
@futuza that would be the 4th amendment which was confirmed in case law to protect citizens from unwarranted search and seizure of digital content (not just physical as originally drafted).
I think it would be more productive to introduce a new law that curtails the patriot act watered-down supposed checks and balances (or repeals it altogether) and reinterpret the 4th amendment more explicitly for the digital age.
In OT, it's often a problem of resources. Both financial and personnel.
A failed auto firmware update on a router at a remote pump station might mean a 12 hour round trip to restore water.
Love your content, keep up the good work
I have always operated under the assumption that every government everywhere could see and hear everything I do online and on my phone. It doesn't even feel like paranoia, rather just a simple fact. I even treat encryption with a healthy dose of skepticism and caution.
This is why users should take it upon themselves to use proper E2E encryption for their communications, and should not compromise on this -- and should be politically active against any politicians trying to restrict civil use of encryption.
But which politicians are even for ?
there's something about americans talking about the chinese that's always hilarious to me... it's kinda like, "now you're trying to do what we've been doing for years? you're evil!!!"
I work with ISP/cell backhaul and theyre replacing american contractors with overseas. Cant wait to see how that goes.
It's interesting isn't it? They don't upgrade but still pay the managers more!
ISPs can't just turn on auto updates and auto restarts for core network equipment
They need to be held to account and actually maintain their infrastructure
A decent system will have hot-swappable redundant devices in cases of failures.
They can swap out, update, swap back in.
They simply choose not to.
@@Reelix Not if that system is 2+ decades old. Hot swappable redundant devices means you're probably already on a mostly modern system.
@@futuzaBut thats the problem. It shouldnt be legal for critical infrastructure to have such old devices.
well... they could, "if" we designed infrastructure for that. I have 'load balanced' "Core Network" equipment at many companies I know of. They are also "buggy" and fail a lot and many companies don't have any at all. It's a complete "mixed bag" but if planned and designed for it... we totes can do that.
I do contract work for IT and I go out and install network equipment for every big and small company you can think of.
Our networks are free use to anyone outside the USA . Iv talked to thousands of remote support agents who configure our backbone services and they are NEVER American employees. We have sold our infrastructures integrity for pennies to anyone willing to put in the work.
Jokes on China because I don't have any friends to talk to. 😏
"Unless you literally burn down the entire network and build it from the ground up, you can never be sure that there's not hackers in there" - And even if you do that, you can't be sure, because 1) you have no idea what code is running on that equipment, and 2) most of that equipment is made in a country which has historically been (and continues to be) an adversary of the U.S.
As a Brazilian citizen, who had been our president telephone tapped by the USA, i feel avenged
When we were kids we knew which block of numbers the local telco used for dialup into various pieces of equipment including switching centers. We would then war dial the block with an analog modem until we got a modem at the other end. We discovered that a lot of equipment used the default username/pswd so in we went. Later on we discovered that where they did change the uname/pswd it was pretty well the same everywhere and someone gave that to us over the phone when we asked for it. It was that simple. They had basically no security. We didnt do anything malicious, just had some fun and learned a lot.
out of curiosity -what country? (as this is also an interest of mine..)
4:36 "Being hacked by China is now illegal" Good job guys we fixed it - Some US Senator in the near future probably
They're just mad that they are not the only ones spying on you.
Who knew that all these unconstitutional warrantless wire tap protocols could potentially be exploited?
Regarding the power grid with old firmware point (from IIoT and limited perspective):
One difficulty factory like environments have is that they operate on the intuitive but dated idea that you only make changes during maintenance windows. This can be a literal requirement to gain access to some equipment due to process hazards but it's also a process thing and can even be mandated by standard X and certificate Y.
There are also IT admin configurations that make it impossible for maintenance crews to do the required updates because of limited access and when they request access the requests can take too long (miss the maintenance window).
So it's not necessarily a "lazy f's" but it can also be a larger organizational problem (this doesn't mean that it's never lazy f's 😂)
This is the problem with backdoors.
Once the enemy finds it it's all over.
Not true... finding a backdoor is not necessarily access gained. Also... a backdoor is fine as there is still a front door. All a back door does is "increase" surface area. Devices have to be managed either way. The main problem with back doors is that they are often "far less secure by their nature" compared to the front and cannot be updated. But if we just secured the back door the same as the front door it would be far less of a problem. This is why I tell people you cannot allow anyone to operate in a shadow. You must make them always operate in the light of day to keep them honest or they never will be!
Governments saying that some other govts are stalking people is the funniest thing
Auto updates are not an option and it sounds (like most places in the US) IT departments are not funded to maintain upkeep of aging infrastructure.
Outrage! Put all the IT and engineering teams in prison!
Hospital IT here--You guys get funding???
We were underfunded for years, and now we're having so much fun (/s) replacing all the CAT5 (not 5e) cables that were even used in the freaking walls, 10/100mbps and/or 10+ year old REFURBISHED switches, and more. :')
This is what happens when the American economy is run from an instance of Microsoft Excel with an MBA sitting in front of the screen. The IT department is just another expense that interferes with beating last quarter's profits, and the MBAs are literally paid to make line go up. Their bonus is on the line.
Automated updates are (not automatic), but yes, it will take having some money/people to do it
Ken Thompson's '84 paper "Reflections on trusting trust" agrees with your take. Time to start from scratch with real open source security.
Open source is not good for these things. Open software implemented into an infrastructure starts without the initial "security through obscurity", so any bug that is not found before the implementation is now open for everybody to exploit. Infrastructure cannot be patched like an OS with software updates once per week. It is based on protocols and implementations by multiple vendors. If one needs to be changed, every single one in the country needs to be updated as well. In the meanwhile the infrastructure is down. It would be a Crowdstrike scenario every time there is a problem discovered, and there will be problems discovered due to the source being open. We are seeing Linux priviledge escalations that crept in for years even tho the source is open. 99% of them are found by good actors, but some are known to bad actors. If that happens on critical infrastructure you are toast. You don't want 99% vs 1%, you want 99.99% vs 0.01%, where the 99.99% hopefully is in house and pray the 0.01% is a friendly country.
start from scratch ? Way to throw the baby with the bath water genius.
What you are looking for and where to start is a topic called: full source bootstrap reproducible build
@ Nope, security through obscurity is still a bad idea. All the real (theory) security we rely on, including the military, leo, and TLAs, is developed in the open and audited by NSA and academia. You can't say that developing the simpler (and usually much more poorly implemented) infrastructure in the open would be less secure because it's never been tried. But we do know that cryptography can't be developed in obscurity.
It has been suggested multiple times that Australia was already aware of this and it was a big part of their recent telcom changes which took both legacy and more recent hardware and cell phones offline.
Americans should be more afraid of the SS7 feature which defeats most cellular privacy. No warrant needs to be served for spying within a domestic scope, which is simply considered exploratory. Many forms of encryption less than AES-256 are also seen as obfuscation by many experts. To restate the obvious, little to nothing is unhackable.
you remember the rainbow table A5 project that seems to have vanished?..
This just in: U.S. Senate creates Legislation, the new programming language that is 100% hacker safe.
The sad thing is that lawmakers will legislate additional administrative reporting and pentests and the like, and force these often underfunded IT/Network infrastructure departments to spend money on those rather than on new gear to replace stuff that's 5 or 10 years out of date.
Didn't the US government demand these backdoors and vulnerabilities to be designed into that network?
Yes
Anyone that knows basic security knows that it is IMPOSSIBLE to have a backdoor that can not be exploited by a bad actor. It can be extremely easy or extremely hard, but it can still happen.
They chose to disclose this now due to the strained relations between the US and China, likely aiming to justify or push for further sanctions or bans on Chinese products.
exactly.
it is fearmongering at its best.
USA is preparing the american public for the war they want to start with china.
It is a copy of the cold war CIA playbook.
Like what they did with Russia .
And since 50+% of americans are ignorant brain washed hateful racists, it is easy to "convince" them that a military intervention is a good thing( spreading "democracy" in resource rich countries in order to steal these resources )
USA is the enemy of peace and democracy.
The issue is my family can not be bothered to use any thing more, they "have nothing to hide"
I wrote my own library for a sim modem and I still treat everything like it is open to the public because good chance it is.
"Turn on auto updates" is hilarious to me.
Yeah, just turn on another backdoor! ;)
Obviously it can be done properly. But if CrowdStrike thought us anything then it is that it's not done properly even at firms whose job is being security experts.
I just find it curious that China has been able to sucker most of the "western world" in to outsourcing the production to them. China, a totalitarian country that monitors their citizens down to a personal level is apparently a really trustworthy partner to use for the production of security, networking and comms systems... We are so screwed, once China - who we are all sponsoring the military spendings of whether we like it or not - figures out it is time to grab some more land. At this time, I am fairly sure they could shut down other nations communications at the drop of a hat, without firing a single shot.
Makes you think why would that be allowed unless everyone in power sees china as a role model and not a threat.
You ever wonder how ad companies will know what to sell you, even if you show no interest in their products before? These backdoors are how. Your data is a comodity
I agree that it is impossible to check for continued intrusion by inspection. Of course it might be possible for the US or an ally to get an agent inside the Chinese security services and find out that way. But then of course we'd never know if they had or not.
There's also the risk of double agents where the CIA starts hearing a bunch of "Oh no! They kicked us out of the network! Our entire operation is doomed!" - Meanwhile they're watching the president take a poop on a hacked CCTV while listening in on his phone calls.
@5:00 you discuss the reality of this issue: There is no way of knowing if a hacker remnant code remains - ever. Your comments are so valid!
One piece of legislation that could do something is no deliberate government backdoors.
No deliberate backdoors period, for any reason, and failure to report such backdoors is an automatic ten year felony. That way managers and low level employees can't hide behind "it's the company's fault." If the US can prove they knew and said nothing, that's 10 years in federal prison for them.
I love how accesible you make news like this!
- Replace hardware with boards made in China. We can run Crowdstrike on them so we'll be safe - and leverage AI synergy! IT security is terrible because there's little financial incentive for it to be good, and even less liability when it is bad. Until that changes...
Working in cybersec myself, I love your rage at the end!
a form of legislation that might work is to require all telcos to pay for third party security audits that ensure they meet all those criteria or something, and require them to pay for that audit, and if they don't meet it by such and such time, then they aren't allowed to continue to operate.
but if they're all already doing such audits using third parties, then I'm not sure what legislation could add on top of that, besides requiring them to do so by some time frame or something.
The government should develop it own software instead of using Microsoft.
Half of Microsofts employee's are Indian, it wouldn't be hard for china to find a back door.
I work in OT, with a lot of experience in water (and other industries)
Unfortunately it's not as simple as 'turn on automatic updates.'
It OT, CIA is flipped to where Availability is key. Any downtime at a wastewater treatment plant has the potential to cause an environmental, and hence political impact. Imagine the headline 'city asked to stop pooping because engineer did a failed firmware update'
I recently upgraded an environment that was running on server2003. Replaced one of the business critical PCs with Win10, did my commissioning and let the trucks start going again. Got a call from operations about an hour later saying it wasn't working any more. Bloody thing had auto updated to windows 11! FFS.
I was also on site recently about to do another major server upgrade. About ready to finish for the day when all of a sudden the PCs started to show funny crashes. Bluescreens. Turns out the site environment had crowd strike 😂.
We just went to the pub and waited to see what happened haha
I have a button. If I press this button, all the machines in your industry explode.
I know I have this button. You know I have this button. Thousands of people know about the existence of this button as the schematics of this button have been on the public internet for the past year. Hundreds of people are building buttons of their own that do the exact same thing.
1 upgrade will make all these buttons useless.
Do you:
a.) Assume that none of the thousands of people who have access to the button press the button
b.) Do the upgrade
Because option B is currently what's being done in this exact scenario... for YEARS....
@@iGrave so if the infrastructure really is that critical (which waste water quite obviously is), why the hell is it running windows instead of an actually stable and secure platform, like Linux or BSD?
@@jetseverschuren because x insurance company won't deal with you if you use linux, so you're forced to use Micro$oft instead. At least that's usually how it goes, some dumb insurance company policy is what is making the real calls as to what software to use.
But this is exactly the problem he is referring to.
Security is not simply replacing the old with the new but having things like change management and technical change processes in place. How a critical system was replaced and no update policy was reviewed for it to the point it updated itself to Win11?
It is not that certain things are complicated/impossible to secure, *anything* is complicated/impossible to secure if you have no management over it.
@jetseverschuren the low level stuff runs on dedicated hardware called PLCs. Talking $10k just to get the processor, anywhere up to $100k's depending on how much IO you need. These things are designed to be reliable above all else, remember uptime is key. People pay for them because they're proven.
Then the engineering effort to actually program the things... Most places I work charge ballpark $200/hour. At hundreds of hours for a project, it's just expensive. These systems tend to get installed and upgraded once every 10-20 years. Then remember uptime again, once they work the attitude is DONT TOUCH THEM. It's not right I know, but it is what it is.
Regarding Linux vs windows, these PLC's need special software to program them. That is developed for windows. It is what it is.
It's not like Linux never crashes...
Seeing you get actually worked up over this is hilarious and I'm here for it. Keep up the good work, love the education and information you provide.
Not only do you have to replace everything, but you have to replace everything at once or as soon as you put something new in there they'll start attacking it.
Not quite - if new hardware was automatically infected via connection to old hardware, then the internet would be 100% compromised already. It really depends on how much the new hardware "trusts" the old hardware. Starting with the stuff closest to the internet connection is ideal, because things deeper in the network are not going to push firmware updates.
Worked for telcos for 7 years. They have no idea how their networks are built anymore. Any time I spoke with the engineers at the top level, they had no clue how things were set up decades ago. All the people who knew how it was built quit or were laid off. We're cooked. half a century of reaganomics has completely ruined nearly every industry.
"China how dare you hack our hackable users." - fbi
Recently started assisting service recovery at my job, and it terrifies me at how many issues are caused by legacy system failures. Then it raises my blood pressure when people have the nerve to ask the vendor to fix unsupported sh!t that should've been upgraded 15 years ago.
The users of those legacy HW would like to upgrade their firmware - but especially Cisco is a so F*CKed up company, that they won't let you upgrade - they want you to buy NEW hardware, and use a subscription to pay several times more money than the hardware costs in first place. That is the biggest issue. I would like to have a law, that any hardware that has firmware in it, needs to have free (security) updates. We buy hardware to do the task, not a service. If the vendor prefers to implement part of the hardware in soft/firmware - its their responsibility to bear the consequences of doing so!! The other option is - to open up the specs so that 3rd party vendors can provide replacement firmware in a more secure way than the original vendor would be able to.
If yall don’t think America is in there systems as well your crazyyy
What? No they didn't! (This comment posted from Shanghai)
Dude you’re hilarious haha b2b ww champs haha
Came for the tech stayed for the personality. Subbed.
The worst part is that the traffic can’t be detected. It doesn’t show up on your log metrics.
dns
I do incident response for tons of companies, including telecoms. Threat actors are absolutely still in their networks.
The telecom networks have been a swamp of critters and robots for years... I don't ever answer the phone. I am totally ok with burning it to the ground. Is LTE even secure? The network should be a dumb pipe of data for better options like Signal and Threema.
This is PERFECT. Now we have verifiable "I told you so" for explaining exactly why things like this should be illegal to do, "for our safety" is moot when it's not safe.
First rule of security:
There is no such thing as a perfectly secure system that is also a usable system.
The closest you can get is a computer, unplugged, inside a vault with only one way in or out, guarded by people with big guns and bad tempered dobermans. Then it MIGHT be CLOSE to secure.
Such a computer would be the most useless computer of all time.
@@mintoo2cool - Hence, "There is no such thing as a perfectly secure system that is also a usable system."
And there you have described actual critical infrastructure like nuclear power plants.
The devices in there are not allowed or able to connect to anything and no outside devices are allowed to connect to the network.
Together with solid physical security, makes Unauthorized Access quite difficult.
Convinced my whole family to switch to signal. Thankfully they are very receptive to my cybersecurity suggestions.
if it was written in prolog this wouldn't have happened
You could give your video descriptions some love. Like in this one I would have liked to see links to the articles and also that CISA list.
if it was written in rust this wouldn't have happened
Real
Facts
But a rusty backdoor is easy to break into.
all you need to do is guess a root password, many of which are not stored all that securely...
Lol. You guys are like clockwork.
I don't know; the headlines are there. One might read the articles. But hearing a live human say "Holy shirt batman! We're in deep doo doo" certainly brings the message home.
Why is no one saying that our telecom hardware is full of Chinese hardware with dormant backdoors that not only the government but the telco providers know about. They try and block those backdoors as best as they could...but it's still there and hard coded.
...because even China couldn't pwn the United States as hard as the FBI. That "lawful intercept" access is basically carte blanche to collect data on every American. Having a vulnerable router somewhere in the system isn't anywhere close to being as powerful as the "lawful intercept" backdoor.
The fact that there are ANY edge devices running known vulnerable software versions in our critical infrastructure is beyond rediculous
8:50 sounds like the point of view of someone who has zero idea how OT infrastructure works
@@Helsus49 Yup, you certainly won't "auto-update" a fucking Telco PBX. You schedule that for a maintenance window, and sadly for many companies, they won't, for many reasons, some good, some stupid upgrade software and hardware as frequently as they should. It's not just a matter of turning on auto-updates though. The upgrades won't necessarily be all that complicated in the grand scheme of things, but they're far from automatic, and need someone to monitor progress.🤦
2:50
Senior Administration Official: Low couple dozen please.
Baker: No.
Of course China is preparing this as an another type of weapon that they are going to use. I hope US and Europe are doing the same and also preparing, because boy it looks like there is going to be a lot of "geopolitical tensions" this century
The US was spying on European politicians, including German Chancellor Angela Merkel, 10 years ago, while telling everyone that they shouldn't use strong encryption. Of course they are preparing do it again.
It’s comments like these made by bloodthirsty war hawks that make me worried your so-called “prophecies” will play out exactly like you predict.
From one backdoored platform to another. They just butthurt they're not the only ones listening.
How is this not an act of war?
A lot is happening right now, a lot... It's mostly china and ruSSia, but it must be kept secret because the goal for now is to scare and destabilize our societies. If we don't know, they fail. But don't worry NATO is not waiting.
The NSA has been doing this for years, e.g. hacking other countries prime minister’s phones, even of european countries, allegedly their allies. Moral: if you’re strong enough, you can do anything without consequences. bully behavior.
Because America does the same exact shit?