Light

Episode #1031 Quiz

How Salt Typhoon Gets In
Date: 2025-06-24 | Length: 2.75 hrs | Episode page at twit.tv

About this episode

Episode 1031 details China’s Salt Typhoon cyber espionage exploiting outdated Cisco IOS XE vulnerabilities, notably CVE-2018-0171 (CVSS 9.8) and CVE-2023-20198 (CVSS 10.0), to infiltrate telecom providers for years. Attackers obtained credentials, pivoted between networks, modified device configs, and exfiltrated data via remote packet captures, highlighting critical patching failures and insecure management policies.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the primary reason Salt Typhoon was able to maintain persistent access to multiple telecommunications networks for years?

Question 1

According to the episode, what is the primary reason Salt Typhoon was able to maintain persistent access to multiple telecommunications networks for years?

Salt Typhoon exploited zero-day vulnerabilities in newly released Cisco firmware unknown to Cisco. The networks continued running older Cisco devices with unpatched, critical vulnerabilities like CVE-2018-0171 and CVE-2023-20198. The compromised telecom providers failed to use multi-factor authentication for device logins, allowing easy credential theft. Salt Typhoon implemented supply-chain attacks on Cisco to insert backdoors during manufacturing.

Question 2: What Cisco device configuration modification technique did Salt Typhoon use to evade detection and access other network devices?

Question 2

What Cisco device configuration modification technique did Salt Typhoon use to evade detection and access other network devices?

Injecting code into Cisco IOS kernel modules to disable logging functions entirely. Enabling default guest accounts with administrative privileges to gain broad access. Modifying the loopback interface IP address on compromised switches to source SSH connections and bypass ACLs. Changing routing protocols to reroute traffic through attacker-controlled VPNs without modifying interfaces.

Question 3: Regarding the 2023 CVE-2023-20198 vulnerability exploited by Salt Typhoon, what is its CVSS score and what does that imply about its severity?

Question 3

Regarding the 2023 CVE-2023-20198 vulnerability exploited by Salt Typhoon, what is its CVSS score and what does that imply about its severity?

It has a CVSS score of 7.5, indicating a high severity but with some mitigations available to reduce risk. It has a CVSS score of 10.0, indicating the highest possible severity with no mitigations making it less critical. It has a CVSS score of 5.0, indicating medium severity typically requiring manual intervention. Cisco has not assigned a CVSS score to this vulnerability as it is considered non-critical.

Question 4: What key failure in Cisco's device design philosophy does the episode critique as contributing to Salt Typhoon's success?

Question 4

What key failure in Cisco's device design philosophy does the episode critique as contributing to Salt Typhoon's success?

Using weak cryptographic algorithms for VPN tunnels by default in Cisco IOS XE devices. Not supporting multi-factor authentication on all management interfaces out of the box. Requiring all devices to run Linux-based virtual environments susceptible to rootkit insertion. Allowing default remote web management interfaces to be globally accessible without mandatory IP filtering by default.

Question 5: What operational capabilities were observed by Cisco Talos in Salt Typhoon's custom tool 'JumbledPath' used on compromised Cisco devices?

Question 5

What operational capabilities were observed by Cisco Talos in Salt Typhoon's custom tool 'JumbledPath' used on compromised Cisco devices?

Executing remote packet captures via jump hosts, compressing and encrypting data for covert exfiltration across multiple network hops. Remotely resetting routers and switches to factory defaults to erase forensic evidence instantly. Injecting kernel rootkits to hide network traffic and disable device logging permanently. Scanning local networks for IoT devices to expand the botnet for distributed denial of service (DDoS) attacks.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.