US CISA Endorses Encrypted Apps Amid Chinese Telecom Hack

Telecom networks overwhelmed by Chinese hackers prompted U.S. government officials Wednesday to urge senior political officials to adopt encrypted communications and other strict mobile security measures.

See Also: Mitigating Identity Risks, Lateral Movement and Privilege Escalation

The Cybersecurity and Infrastructure Security Agency released guidance Wednesday additionally advising top government leaders to avoid SMS-based multi-factor authentication and set telco PINs for sensitive operations.

The U.S. cybersecurity agency told reporters the guidance stems from federal investigations into the Salt Typhoon hacking campaign, in which Chinese nation-state hackers infiltrated broadband infrastructure used for court-authorized wiretaps. Attackers also targeted President-elect Donald Trump and his running mate throughout the 2024 presidential campaign. (see: Feds Probe Chinese ‘Salt Typhoon’ Hack of Major Telcos).

“There is no single solution that will eliminate all risks” to mobile devices, CISA’s Executive Assistant Director for Cybersecurity Jeff Greene said during a media briefing on the new guidance. But adoption measures such as encrypted chat and more robust multi-factor “will significantly enhance the protection of your communications.” Salt Typhoon hackers collected audio calls made by U.S. political figures and accessed unencrypted communications including text messages.

Officials stressed the guidance is applicable to anyone and strongly encouraged for a small number of highly targeted individuals who may possess “information of interest” to Beijing. Trump and Vice President-elect J.D. Vance were among a group of Verizon customers, both within and outside the government, whose phone numbers were targeted by Chinese cyberespionage throughout the year, along with prominent Capitol Hill figures and staffers on Vice President Kamala Harris’ presidential campaign (see: Chinese Hackers Reportedly Targeted Trump, Vance Phones).

CISA warns the Chinese hackers are still embedded in U.S. telecom infrastructure and says the espionage campaign “enabled the theft of customer call records and the compromise of private communications.” Agency officials earlier this month said it’s impossible to predict when cyber defenders will fully evict Beijing actors.

The guidance includes recommendations specific for iPhone and Android users such as enrolling in Apple iCloud Private Relay and configuring Android Private DNS. Highly targeted individuals should enable FIDO phishing-resistant authentication, which CISA says is effective against many MFA bypass techniques, and use a password manager to store all passwords for online services and accounts. The agency also issued enhanced visibility and hardening guidance for communications infrastructure earlier this month to provide network vendors with tailored recommendations amid the ongoing threat from Chinese hackers.

The latest security guidance is a “great first step” but overlooks certain mobile defense capabilities, such as protections against jailbreaking, malware scanning for malicious or data-leaking apps and safeguards against network-based threats like WiFi attacks, according to Jim Coyle, U.S. public sector CTO at mobile security firm Lookout. Coyle told Information Security Media Group the guidance appears “to leave room for flexibility” to be adopted into specific government agency and private corporation environments.

“We are seeing unprecedented levels of zero day vulnerabilities, attacks on critical infrastructure, communication systems and there’s unfortunately nothing in place today stopping them from a diplomatic pressure perspective,” he added.

The Cyber Safety Review Board will launch an investigation into the Chinese hacking campaign, marking the board’s fourth review, following an April report that condemned Microsoft over a series of “avoidable errors” that allowed Chinese hackers to infiltrate top U.S. officials’ email accounts (see: Key Federal Cyber Panel to Probe Chinese Telecoms Hacking).