FBI Warnings on SMS and Mobile phone calls

On December 3, 2024, CISA, NSA, FBI and International Partners published a guide for protecting communications infrastructure.  In this guide, they warn about infiltration of the US and International communications grid by a hacking group called Salt Typhoon who is purportedly associated with China's Ministry of Public Security.

The basic message of this guide is to warn American citizens that text messages sent from Android to Apple or Apple to Android devices are not encrypted, and may be exposed to the hacking group and their benefactors.  This may also carry over to phone calls make by the default applications.

It is their recommendation to move to a more secure application that ensures end to end encryption of all communication to keep your conversations safe.  Signal is an open source application dedicated to secure communications (text, voice, video).  It supports all major operating systems and devices and is free to use. WhatsApp is another similar application that is owned by Meta, the company behind Facebook.  Both these applications use Quantum Safe end to end encryption which ensures that no one, even the hosting companies cannot see the messages being sent.

One common response I get is, "Brian, no one is going to care about my text messages so I'm not worried." The problem is, a lot of information can be learned from someone's texts.  That information can then be used against you when trying to scam you in the future.  For example, if you happened to mention your uncle's full name in a text.  It might seem benign, but a criminal would know that this might be the same as your mother's maiden name, a piece of information frequently used for resetting passwords.  Also, does your bank ever text you a one time passcode to type in when you log into your account?  This information could be stolen and then used to log into your account (with a stolen password).

For me, it is a simple move to Signal.  It is easy to use and many of the folks I know have it installed.  My immediate family is using it, and I'll spread the word over the holidays as well.

Safe computing!
Brian