FBI cyber cop: Salt Typhoon pwned 'nearly every American' China's Salt Typhoon cyberspies hoovered up information belonging to millions of people in the United States over the course of the years-long intrusion into telecommunications networks, according to a top FBI cyber official. "There's a good chance this espionage campaign has stolen information from nearly every American," …
This. Halfway through the article I stopped and went "wait a minute, how much of this information was collected by a domestic megacorp which then Salt Typhoon collected due to their sheer negligence?" We've had so many data breaches from data hoarding companies in the last decade that virtually everything on everyone from their medical records to credit card statements are public information now. I know Salt Typhoon is actively penetrating infrastructure, but I bet the bulk of the information they have on people is simply stuff corporations hoarded in insecure databases. This is like leaving a ton of rotting food out and then blaming the cockroaches infesting your house for your poor living conditions.
Don't forget that other article -- Chinese spies are *still* in 'Murrican systems.
- https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
The Chinese attacked US-mandated backdoors. That's how they got in - through the door - that's how they spread, and it was very effective. This should *not* be considered individual corporations' lack of security -- this is a government-mandated failure, one that everyone who uses a computer has spoken vehemently against since the gov. started clamoring for Encryption backdoors.
How does it feel?
>> Salt Typhoon collected "bulk information from millions of Americans."
And the USA collects bulk information from the whole world.
It would be nice if Jessica Lyons asked Machtinger a few questions, rather than acting as his mouthpiece. You see, if you want to be treated as a serious journalist you should ask difficult questions. Instead what we have here is FBI propaganda.
The USA is the threat to the world. It is not our friend. Those tariffs are not friendly. We won't forget.
Then the horse is out of the barn door. We need to collectively adopt measures that assume my name, address, SSN, mother's maiden name and so forth is out there, and set up methods where I can identify myself that isn't limited to "what I know".
For instance, I ought to be able to "lock" my credit using 2FA linked to my phone (by that I don't mean SMS) so even if someone gets their hands on my info that they can't open credit cards in my name and I would need to unlock my credit using my phone before I'm able to do that, or take out a mortgage or whatever.
Maybe this is just the sort of kick in the pants we'll need to eventually move on from this shitty system where if someone knows your SSN they can ruin your life.
For instance, I ought to be able to "lock" my credit using 2FA linked to my phone (by that I don't mean SMS) so even if someone gets their hands on my info that they can't open credit cards in my name and I would need to unlock my credit using my phone before I'm able to do that, or take out a mortgage or whatever.
Then your phone gets stolen...
When your phone becomes your avatar whoever has your phone becomes you.
If my phone is stolen a crook is not going to be able to use it as the second factor, because he can't unlock it. Or are you assuming it has been stolen by a master criminal specifically because he wants to impersonate me, and has access to Cellebrite level technology so he can unlock an iPhone? Any criminal that capable won't bother with small time credit fraud criming.
They would have to shoot me, or act very quickly since I would put the device in Lost Mode to lock it as quickly as possible. I talked my daughter through this 2 mins after her iPhone was stolen, then through the remote wipe, and then "go to the Apple store and buy a new one and switch Stolen Device Protection on just in case the next their knows your passcode and tell me how much to send you". Sad day - it's not nice having something you value stolen - and expensive Dad day, but I appreciate the data protection feature. To access anything available the phone thief would also need to find and steal my ObiKey. Yes I am that paranoid, its a little inconvenient but better too be safe...
So now I'm supposed to think using a phone as a second factor is a bad idea because I might meet a criminal willing to commit murder to give him access to my phone? All to "impersonate" me and take out credit in my name? To say you're REALLY reaching here is quite the understatement!
I really hate phones. Only a few people can ring me and even then it is really just 1 person.
If my phone gets stolen or dies, that is the end - not wanting to replace, but no, these days I to have apps for this that and the other and then MFA - so stop making phones the be all and end all
*May look at just a data only SIM, but they cost more than a standard SIM, and android really does not like working on a phone device if the phone and SMS apps are removed
Your handle reflects that , and its something I can get behind , mainly from a UI pov . Tasks that I could do blindfold on a pc seem impossible on a phone .
A simple example ( of hundreds) is how do I hover the mouse over an XKCD cartoon to see the bonus punchline?
I made the URL a link so phone users wont have to fuck about selecting cutting pasting etc etc , another task that I would nt even have attempted on a phone
It'd be nice to have some sort of luddite icon for those that refuse to leave the command line. Some say even coming down from the trees was a bad idea.
It's the clearest example of mass technological regression since Dark Ages Europe forgot how to do clean running water. It's not just that a desktop or even a lightweight laptop/palmtop is so much better than a pokey touchscreen phone, even a very small device with a proper keyboard like a Blackberry makes infinitely more sense. How do you browse the web on a touchscreen phone when basic manipulation of the URI is impossible, there's no real concept of having multiple pages open at once, and nearly every website you try to use wants to run it's own bespoke app?
It's as if we were happily driving cars then suddenly Segways became a thing and overnight everyone forgot how good cars were.. (Unintentionally ironic analogy seeing as how this appified b.s. *is* now ruining cars as well)
The hover for the XKCD image is a long press, and most browsers have tabs too. But to your point, I dislike phone typing, especially in recent years as the predictive autocorrects on most virtual keyboards have gotten so opinionated that they'll substitute entire words for more common ones, five or six times in a row for the same word! It impedes technical conversation, and my healthy blood pressure levels lol.
On the original topic, I am really sick of [in]security culture and childish war games. America is a class and culture war zone filled with refugees of its practice of burning cultures and ecologies for fuel, and all of the smartest most sensitive people take the brunt of the natural consequences. It's hard to be creative and truly innovate in constant grief, when most everyone left (and anyone with any actual power) is stupid, selfish, shortsighted, petty, and extremely cruel. We are bankrupt. Drugs, bullying, and sexual harassment run every single workplace, nobody trusts each other, nobody can get healthcare or basic living security. The whole thing is a trash fire and a farce. The imperial boomerang is landing hard in America's face right now. Most everyone I like or respect is horrified and scared. Hard to do good creative engineering work in these conditions.
/rant
Don't get me wrong, we are living creatures born to thrive and I still have hope for the contingent of our species with a functioning neocortex. The LLM's are pretty cool, and SOME cultures on this planet are still doing good scientific research without committing heinous crimes against humanity and nature. And the phones, though inconvenient, are pretty cool tools for global communication. I'll need to escape the US Southeast (an international cultural treasure, as sick as we are) to rejoin that whole jam session, and my outlook will improve. The insecure war pigs will always set me off tho. They always have.
I'm glad I'm not the only one noticing how enshittified touch keyboards have become.
It's happened to me twice; first with Swype which started off with almost telepathic abilities to recognise which word I was after, but slowly descended in to just randomly picking words from the dictionary. I moved to the Samsung keyboard which was never as good in the first place, but again degraded to the level that it can't even get the simplest words in under 6 tries.
Typing rather than swiping on on screen keyboards is magnitudes slower than the old T9 predictive text on physical number keys - that's today's idea of progress for you.
I have one for 1€ a month as a backup. It has (or had, don't know, they keep adding MBs) about a 200MB per month (though the unused allowance goes to the next month's, up to 6 or so). Of course, you can contract for XXGB a month, and the price goes up.
If you are in Europe I'm pretty sure you can find something similar.
As for android misbehaving... I didn't have a problem with it, but haven't tried it in one of the recent versions.
I locked mine down years ago. All 3 credit agencies. If you are older, you likely aren't opening new accounts all the time so not that inconvenient. If younger, it would be a pain. I also put a pin on my IRS filings. That was another easy scam. File in someone else's name and get a refund leaving them to sort it out with the IRS. I've also a PIN on my cell # so no one can re-assign the number. It is crazy one needs to do all this and probably more not to be scammed in the most trivial attacks.
1 why did they dismantle the cyber security agency?
2 Why do they allow companies to collect tons of data? For the telecoms carrier name, address, phone number, email, bank account number should be enough, right? They don't need my sex/gender/kinks/persons in the household/date of birth etc. to be stored indefinitely (dob is important when signing the contract, to check if you are a minor, not needed after that.
One of the first things that Trump did in his first term was to refuse to give up his phone for a secure one because, obvs, social media access is more important than national security. When the people running the country have got such attitudes about inconvenience vs security then it's little wonder that the the rest of the country leaks like a sieve.
Another thing he did in his first term was to magically declassify over a hundred top secret documents so he could take them home to Mar Lardo and have somebody read them to him, slowly. Luckily for the
US they were safely and securely stored in bathrooms and on stages. Oh, and gave classifies Israeli information to Vlad. One has to wonder if that was why Kim loved him so much
At least in his second term he found several people that were more incompetent with secret information than he was(?). Deflection is the name of his game.
Salt Typhoon exploited backdoors the US government had forced companies to put in their systems.
This is the key reason that crypto backdoors are unsafe for everyone. If your own government can spy on you, hackers will hack your government to get that information.
It will be the EU, UK and Australian citizens' turn next.
Using the US government provided back-doors ?
Np, no, no. You don't understand how American politics work. It was the Dems that planted the back doors so they could secretly download very very naughty pictures and buy canned baby, mostly girl babies for some reason, from their basement bunkers under Pizza parlors. I know this to be true because the all seeing eye on my dollar bill told me so. I call him (has to be a him, because) by his initials QA so as to not give the cabal any clues they can use to find him.
Not what I've seen. I worked at a place that used a service to keep all the on-premise machines running. The service would install some important Microsoft patches, but not most of them. The service would never update firmware. When I took over managing them and reviewed the state of things, I was horrified. The service felt it was in our best interest to make sure they didn't do anything that might impede us...like updating firmware...at least that was their story.
So rather than backdoors, I propose it is mostly horrible IT practices.
Based only on the above observations.
Nothing new. Intelligence agencies are simply collecting info about every human on earth.
A database containing the information of all humans and all their contacts and connections is not only valuable for Meta and Google ad networks. It's also valuable for other entities that want to exploit as many humans as possible.
Intelligence organisations are obvious customers and users of such databases.
It is very rare when such information is used to the benefit of the subjects.
Consumer products are a joke now. Might as well say "Home DDoS Node with some gateway routing features, maybe."
If you can, get yourself a mini PC with 8GB RAM and low end but workhorse CPU (and at least 2 eth ports of course, more if you want to avoid needing a switch). These are like $150-$200 on Amazon.
Install opnSense and turn on IPS. Use your old router as a WiFi access point. Maybe think about replacing it one day because I doubt it's WiFi impl isn't full of flaws too.
Profit. You will have to keep it updated, but at least you have the keys to your own home's network now and aren't just some schmuck left to whims to every botnet campaign targeting the latest flaws.
Consumer products have always been crap. That's nothing new. Consumer network gear is a trade off between features and usability...it's not a scam, people buy shit because it's easy to setup and get going.
I use OPNSense myself, but I'd never recommend it to someone without the knowledge to set it up or maintain it...unless they're paying someone to do it for them or I am doing it for them.
The main problem with consumer kit isn't the kit itself, it's often fairly good hardware for the price, the problem is the proprietary firmware and shitty operating systems. Consumer routers really ought to be standardised and regulated...we also need legislation that permits the consumers choice of hardware rather than what is foisted upon them by the ISP. Whether an ISP wants to support the router or not is irrelevant, their responsibility should stop at the socket unless they provided the router upon request of the customer.
I dearly wish I could get rid of my fucking crap Virgin Hub.
Yeah, but the difference is if you end up with crap enterprise gear, it's because you cut corners and hired a frickin' chump to suggest it and install it. That is simply karma.
Back in the day, the hallmark of all crappy network engineers was those crappy "stackable" switches by 3COM I think it was, they were called "superstack" I think...they had these massive proprietary connectors on the back with ludicrously thick cable and always needed to be booted in the right order to work. Usually the order the switches were installed in the rack was not the order you needed to power them on because at some point you know the engineer dicked around with it until somehow it worked.
It was also guaranteed there would be at least one switching loop somewhere with those switches because at some point someone would arrive and not know how those switches work and installed an uplink from each switch to the "primary" switch to try and resolve a network issue, which would work until someone came along and booted everything in the right order...a switching loop just hiding there, like a secret land mine.
Thing is it's difficult for a government to get people to give a shit about foreign nations spying on them when they are also spying on their citizens.
It's like the school bully beating you to steal your homework and justifying it by saying the Chinese kid sat behind you was looking over your shoulder copying you as well. Both folks are stealing off you, but only one of them is an immediate threat...Chinese kid might be a communist, but it's the kid nearer to you, beating the shit out of you that you need to worry about.
If your government is also a bully stealing your homework, you have nobody to turn to if the Chinese kid is looking over your shoulder. That's the problem.
Your government should have no interest in you as long as you're a law abiding citizen and you pay your taxes. They should not be engaging in the same practices as a foreign nation in order to try and stop the foreign nation doing what they're doing...because as far as their citizens will be concerned, if they're going to be spied on no matter what, why should they even care?
We used to call the practice of providing protection then shaking you down for money and information "racketeering" and it was a criminal offense...these days, it's perfectly acceptable government behaviour it seems.
