The Risks of Consumer 'Secure' Messaging Apps

The Salt Typhoon cyberattacks represent a pivotal moment for organizations in critical infrastructure, enterprise, and government sectors. These sophisticated attacks exposed fundamental vulnerabilities in global telecommunications networks and interconnected systems. They demonstrated the advanced capabilities of state-sponsored threat actors to compromise trusted communication channels and public-facing infrastructure.

In the wake of Salt Typhoon, as network operators struggle to mitigate the damage caused, US officials are now recommending the use of encrypted messaging and communications whenever possible to protect information from data-in-transit theft and eavesdropping.

"Encryption is your friend – whether it is on text messaging or if you have the capacity to use encrypted voice communications," Jeff Greene, executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA), said. "Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible, if not really hard, for them to detect it. So, our advice is to try to avoid using plain text."

However, while organizations may be inclined to switch to popular consumer messaging apps like WhatsApp or Signal for encrypted communications, they should carefully consider 'How secure is WhatsApp or Signal for enterprise/government use?'.

While these apps, from major tech companies, are known for their user-friendly design and implementation of end-to-end encryption, they are ill-equipped to protect against the complex risks and advanced threat vectors that are now pervasive in enterprise and government environments.

The exploits used in Salt Typhoon, including compromising public-facing servers, leveraging legitimate admin tools for covert lateral movement, infiltrating lawful intercept systems, exploiting trust between networks, and potentially manipulating supply chains, reveal that truly secure communications demand more than just an extra layer of encryption.

Effective protection requires a dedicated, enterprise-grade platform that is engineered from the ground up with robust security controls, operational resiliency, regulatory compliance, and rapid incident response capabilities.

The Sophistication of Salt Typhoon Tactics

Salt Typhoon, attributed to a highly capable state-sponsored Advanced Persistent Threat (APT) group, executed a multifaceted campaign that breached critical telecommunications infrastructure and public-facing systems.

The attack was notable for its use of multiple sophisticated tactics:

1. The Exploitation of Public-Facing Server Vulnerabilities - The attackers took advantage of zero-day flaws or unpatched vulnerabilities in public-facing systems such as Ivanti Connect Secure to gain initial access to target networks.
2. Lateral Movement Using Legitimate Tools - Once inside networks, Salt Typhoon stealthily spread using trusted administrative tools like Windows Management Instrumentation Console (WMIC).
3. Compromise of Wiretap Systems - The attackers managed to gain access to lawful interception systems (CALEA) used by telecom providers.
4. Exploitation of Trust Between Networks - Salt Typhoon took advantage of the complex web of interconnectivity and peering relationships between telecom networks.
5. Possible Supply Chain Compromise - The level of sophistication suggests the adversaries may have compromised software, hardware, or firmware supply chains.

Why Consumer "Secure" Messaging Apps Fall Short

While consumer messaging apps like WhatsApp and Signal are popular for their easy-to-use encrypted messaging, they were never designed to withstand APT-level attacks targeting enterprises and governments. Multiple aspects of their architecture, reliance on public infrastructure, and limited enterprise management capabilities leave them ill-suited for mission-critical secure communication.

Vulnerability to Public-Facing Server Exploits

Encrypted messaging apps like WhatsApp and Signal implement end-to-end encryption, but their server infrastructure is still exposed to the public Internet. A compromise of their servers or takeover of message routing channels could allow highly capable adversaries to disrupt communications or selectively degrade service.

Metadata Leakage Despite Encryption

Both WhatsApp and Signal generate metadata like IP addresses, phone numbers, and message timestamps that can reveal highly sensitive information about contacts and communication patterns even without access to message contents.

Susceptibility to Manipulated Routing and Connectivity

WhatsApp and Signal rely fundamentally on the public internet backbone, global DNS infrastructure, and third-party content delivery networks (CDNs) to transmit messages between different devices and regions. Highly sophisticated adversaries can potentially exploit blind spots in these trust relationships through tactics like rerouting data flows or launching man-in-the-middle interception attacks.

Providing a False Sense of Security

One of the most pernicious aspects of these messaging apps in sensitive environments is that they can instill a false sense of security among high-value targets. Users may feel protected because their messages are "end-to-end encrypted", not realizing that resourceful adversaries have numerous other ways to access their communications.

The Historical Trail of Compromises

Several high-profile security incidents have already proven how vulnerable telephone networks, as well as enterprise and consumer messaging apps, can be against determined attackers:

• Operation Socialist (2010-2013): Britain's GCHQ successfully infiltrated the networks of Belgacom, a major Belgian telecom company.
• Android FakeSMS Malware (2021): Researchers discovered Android malware that targets messaging apps like WhatsApp, WeChat, and Twitter.
• SolarWinds Supply Chain Breach (2020): Russian intelligence hackers compromised the update infrastructure of SolarWinds' Orion software.
• WhatsApp's CEO-impersonation Hack (2019): Security researchers demonstrated a social engineering attack against WhatsApp's verification system.

Why Cellcrypt Is the Solution

In contrast to the band-aid of consumer apps, Cellcrypt offers a secure communication platform built from scratch for enterprise and government needs. It's designed with full understanding that sophisticated adversaries can simultaneously attack multiple layers of the communication stack.

Full Deployment Control

Cellcrypt can be fully deployed on an organization's infrastructure or within dedicated, secure cloud environments. This provides complete control and sovereignty over message routing, cryptography, and server configurations.

Hardened End-to-End Encryption with Post-Quantum Protection

• Military-Grade Encryption: Cellcrypt utilizes FIPS-validated cryptographic algorithms, including ChaCha20, AES-256, and Elliptic Curve Cryptography.
• Post-Quantum Cryptography: Cellcrypt was the first secure communications solution to integrate quantum-resistant algorithms and new post-quantum cryptographic standards.

Compliance and Information Governance

• Granular Metadata Management: Full administrative control over metadata storage, user identity management, and encryption key lifecycles.
• Enforceable Security Policies: Admins can define and universally enforce custom security policies and set granular authentication rules.

Incident Response Readiness

Cellcrypt's out-of-band, cryptographically segregated communication channels allow for real-time incident response coordination without alerting attackers if primary networks are compromised.

Recommendations

The post-Salt Typhoon cybersecurity landscape demands that organizations drastically improve their communication security approach:

1. Conduct Comprehensive Risk Assessments - Perform in-depth analyses of your current messaging platforms.
2. Implement Defense-in-Depth - Embrace solutions that provide end-to-end encryption at the application layer with network-level encryption.
3. Adopt True Zero-Trust Principles - Look for solutions designed to be fully secure, even within compromised networks.
4. Gain Full Deployment Control - Consider on-premises or private cloud deployment models for sensitive communications.
5. Prepare for Post-Quantum Cryptography - Begin adopting quantum-resistant cryptographic standards.

Conclusion

The Salt Typhoon attacks must serve as a forceful wake-up call for any organization looking to secure its most sensitive communications. While apps like WhatsApp and Signal provide a thin veneer of encryption, they are fatally outflanked by the multi-pronged tradecraft of state-sponsored advanced attackers.

In an era of highly organized, militarized hacking campaigns, truly secure communications demand a platform built uncompromisingly with government and enterprise needs at its core. Cellcrypt offers exactly such a platform.

The time to secure that future is now.