Back doors
-
If you build a SUPER SEEKRIT backdoor to something, someone's gonna find it and exploit it...
Like Chy-na.
News broke this weekend that China-backed hackers have compromised the wiretap systems of several U.S. telecom and internet providers, likely in an effort to gather intelligence on Americans.
The wiretap systems, as mandated under a 30-year-old U.S. federal law, are some of the most sensitive in a telecom or internet provider’s network, typically granting a select few employees nearly unfettered access to information about their customers, including their internet traffic and browsing histories.
But for the technologists who have for years sounded the alarm about the security risks of legally required backdoors, news of the compromises are the “told you so” moment they hoped would never come but knew one day would.
“I think it absolutely was inevitable,” Matt Blaze, a professor at Georgetown Law and expert on secure systems, told TechCrunch regarding the latest compromises of telecom and internet providers.
The Wall Street Journal first reported Friday that a Chinese government hacking group dubbed Salt Typhoon broke into three of the largest U.S. internet providers, including AT&T, Lumen (formerly CenturyLink), and Verizon, to access systems they use for facilitating customer data to law enforcement and governments. The hacks reportedly may have resulted in the “vast collection of internet traffic” from the telecom and internet giants. CNN and The Washington Post also confirmed the intrusions and that the U.S. government’s investigation is in its early stages.
The goals of the Chinese campaign are not yet fully known, but the WSJ cited national security sources who consider the breach “potentially catastrophic.” Salt Typhoon, the hackers in question, is one of several related Chinese-backed hacking units thought to be laying the groundwork for destructive cyberattacks in the event of an anticipated future conflict between China and the United States, potentially over Taiwan.
Blaze told TechCrunch that the Chinese intrusions into U.S. wiretap systems are the latest example of malicious abuse of a backdoor ostensibly meant for lawful and legal purposes. The security community has long advocated against backdoors, arguing that it is technologically impossible to have a “secure backdoor” that cannot also be exploited or abused by malicious actors.
“The law says your telecom must make your calls wiretappable (unless it encrypts them), creating a system that was always a target for bad actors,” said Riana Pfefferkorn, a Stanford academic and encryption policy expert, in a thread on Bluesky. “This hack exposes the lie that the U.S. [government] needs to be able to read every message you send and listen to every call you make, for your own protection. This system is jeopardizing you, not protecting you.”
“There’s no way to build a backdoor that only the ‘good guys’ can use,” said Signal president Meredith Whittaker, writing on Mastodon.
