Didn't find this posted here, yet, so...

quote:

FBI warns texts between Android and iPhone users pose cyber risk

Officials say the cyber breach is ongoing, and it may take time to fully root out the bad actors from telecom systems

The FBI and a leading federal cybersecurity agency are warning Android and iPhone users to stop sending unencrypted texts to users of the other operating system after the Salt Typhoon hack of several major U.S. telecommunications providers.

Officials with the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) are warning that the Salt Typhoon cyber breach, which was conducted by actors in China, targeted telecom firms. The hackers accessed call records, live phone calls of certain specific targets and systems companies use to handle court orders from law enforcement and intelligence agencies to track calls.

While the breach is yet to be remediated, officials are encouraging users to communicate using encrypted messaging systems.

Apple's iPhone and Google's Android smartphones have encryption for iPhone-to-iPhone messaging and Android-to-Android messaging, respectively, but messages between Android and iPhone users aren't encrypted.

Full article: FBI warns texts between Android and iPhone users pose cyber risk

Note this is a telcom provider issue, not an issue with either iOS or Android, per se. (Objections, vis-a-vis Apple's RCS foot-dragging, noted.)

My recommendation, as always, is to always use Signal Private Messenger. Everything's always E2EE (end-to-end encrypted), regardless of end-point platforms.

Whoa!

Welcome back ensigmatic!

Thanks, Pipe Smoker

I think calling the interception of personal communications a "cyber risk" is a bit of a stretch. It is not like the miscreant gains control of a user's device, passwords, encryption keys, etc. So they can read your texts, listen in on your calls...isn't that what our Govt. has been doing for decades?

Oh, maybe the bad guys are listening in to Govt. calls? That can hardly be allowed.

They may be clever enough to intercept my texts... are they clever enough to decipher the spelling errors?

My texts are valueless to anyone but myself and my wife. I doubt China cares that I'm on the way home or my wife is on aisle 18.

quote:

Originally posted by Fredward:
My texts are valueless to anyone but myself and my wife. I doubt China cares that I'm on the way home or my wife is on aisle 18.

Or what she is bringing for supper...

Yes, because the FBI has been so trustworthy of late...

quote:

Originally posted by architect:
I think calling the interception of personal communications a "cyber risk" is a bit of a stretch. It is not like the miscreant gains control of a user's device, passwords, encryption keys, etc. So they can read your texts, listen in on your calls...isn't that what our Govt. has been doing for decades?

Oh, maybe the bad guys are listening in to Govt. calls? That can hardly be allowed.

One article I read (I didn't save it so no link, sorry) stated that there were significantly more interception attempts in the area around Washington.

quote:

Originally posted by Fredward:
My texts are valueless to anyone but myself and my wife. I doubt China cares that I'm on the way home or my wife is on aisle 18.

You might be surprised.

Bear with me for a moment, if you will.

I'm sure you're aware of the "Loose lips sink ships" trope from WWII. That warning was meant to apply not to just sailors, but their friends, families, people who worked in shipyards, their friends and families, etc. Pretty much just about everybody.

Why? Because with enough disparate information from enough sources a sharp analyst with a good memory could piece them together and create a whole.

In this day-and-age, with the advent of AI (which isn't really intelligence, per se, but that's another discussion), it's trivial to do the same--inputting essentially everything one can and letting the AI make associations.

The point being: While your domestic habits, taken in isolation, may be mind-numbingly mundane, when pieced-together with millions-upon-millions of other bits of mundane, and maybe not so mundane information, could be useful to somebody, somewhere, at some time.

(Yes: I'm above-average paranoid and have a vivid imagination.)

The other part of this equation is this: If you can frustrate eavesdropping, you should do so just on General Principles. Every bit of effort bad actors have to spend on discovering anything, no matter how useless, takes that much more away from their efforts to discover something useful.

Put more simply: If the only people to encrypt their communications are people who need to encrypt their communications, the bad guys know upon whom to concentrate their efforts.

Further: For years elements within various governments, including our own, have been attempting to pass laws to force providers of encrypted information tools to build back doors into them so those governments could access the decrypted information at will. Just as leftists suddenly discovering the advantages of gun ownership aids the RKBA, everybody developing a fondness for reliable information encryption makes it just that much more difficult for those actors to make their case, because there'll be that many more people opposed to their efforts.

Lastly: Circling back to WWII: Make no mistake: In many ways we are at war.

quote:

Originally posted by Rightwire:
Yes, because the FBI has been so trustworthy of late...

There is that, too.

Ensigmatic, welcome back, and I have a question for you.

Apple's iOS now supports RCS (Rich Communication Services), as the article linked explains. Apple users should check to see if RCS is turned on; I see RCS listed when I get a message from an Android user (my daughter and her husband, unfortunately!).

Doesn't this make the original post obsolete? Or are there potential issues with cellular providers?

Thanks

How to enable RCS for secure cross-platform messaging

I suppose the risk is not just to any one individual node (person) in the network but the risk is the whole network is being surveilled, not just by our own government, but by other countries such as China.

Whoa! is right, welcome back.

Samsung just pushed us to Google messages, which supports encryption with a wider range of devices (Iphone included)

Not all messages are though, it depends on the particular devices being used. It does let you know if the message is secure, but yo udo have to look.

quote:

Originally posted by sjtill:
Ensigmatic, welcome back, and I have a question for you.

Thanks!

quote:

Originally posted by sjtill:
Apple's iOS now supports RCS (Rich Communication Services), ...

I see RCS listed when I get a message from an Android user (my daughter and her husband, unfortunately!).

Doesn't this make the original post obsolete?

Maybe. Maybe not. As the article notes: With some you may get RCS, with others you won't. When I exchange text messages with one of my best friends on Android it says "Text Message • SMS" ¯\_(ツ)_/¯

quote:

Originally posted by smschulz:
Whoa! is right, welcome back.

Thanks!

quote:

Originally posted by Gibb:
It does let you know if the message is secure, but yo udo have to look.

Signal (Private Messenger) on Android originally allowed one to specify using Signal's app for all texting: SPM as well as SMS/MMS. They removed that capability a year or two ago because they felt different-colored texts, based on whether the messaging was secure or not, wasn't secure enough.

This is the same problem Apple has had with iMessage all along. Too many people didn't understand why there was a green vs. blue. Thought it was a way for Apple/Apple users to distinguish themselves from "lowly Android users." When, in reality, it was to inform Apple users when their messaging was secure or not.

Or so Apple claimed.

Even with the advent of RCS and the possibility of secure E2EE messaging between iThings and other platforms, Apple plans to retain the blue/green thing for Apple/non-Apple messaging. So maybe the critics have had a point all along, after all

quote:

Originally posted by architect:
I think calling the interception of personal communications a "cyber risk" is a bit of a stretch. It is not like the miscreant gains control of a user's device, passwords, encryption keys, etc. So they can read your texts, listen in on your calls...isn't that what our Govt. has been doing for decades?

Oh, maybe the bad guys are listening in to Govt. calls? That can hardly be allowed.

So, would that mean if someone breaks into your home, rifles through your stuff, reads all your bills, letters, will, whatever you have, goes through your wifes personal drawers, but doesn't steal anything, well, that's ok since its nothing of real importance....

The real issue is that they broke into peoples personal devices, it doesn't matter if you have national secrets or just text about the grandkids and what you need from the grocery...

All this is telling us is that SMS text is not secure. Never has been. Apple's iMessage is encrypted and pretty secure, and available on all iPhone-to-iPhone messages. And it works internationally even if you swap SIM cards because it's tied to your Apple ID. Also works on Macs and iPads.

iPhone to Android has been SMS for a long time, and I get frustrated with people that only use SMS and no other apps that are more secure.

RCS should improve things.

We don’t have to get to broad conspiracy levels. The biggest reason why this is important has nothing to do with Android-iPhone communications.

It’s MFA tokens. “Send a code to this number” after login.

Though Call Detail Records (CDR) are excellent for building pictures of activity. As evidenced from the divorce subpoenas I used to send them in for.

quote:

Originally posted by SigJacket:
We don’t have to get to broad conspiracy levels. The biggest reason why this is important has nothing to do with Android-iPhone communications.

It’s MFA tokens. “Send a code to this number” after login.

the exposure is Apple to Android communication right? MFA tokens aren't sent between devices so I'm not sure how that would be impacted other than most are still just SMS and those have always been in the clear.