According to a CCTV News report on October 19, 2025, the U.S. National Security Agency (NSA) took advantage of security vulnerabilities in overseas mobile phone brands' short message services to carry out secret cyber attacks and controls on the mobile phone terminals of multiple staff members of China's National Timing Center, and used this as a springboard to further invade the center's computer system in an attempt to preset a backdoor program with paralysis and destruction functions.
What is the National Time Service Center? It is located in Xi'an, Shaanxi Province, under the jurisdiction of the Chinese Academy of Sciences. Its main task is to maintain the national time and frequency benchmark. This thing sounds quite abstract, but it actually has a great impact. For example, satellite navigation, communication networks, financial transactions, etc. all depend on it to synchronize time. If there is a problem with the time benchmark, the operation of the whole system will be messed up. Starting from March 25, 2022, the U.S. National Security Agency has been eyeing this center, taking advantage of the short message service vulnerability of a foreign brand mobile phone to secretly control the mobile phone terminals of multiple staff members. Stealing sensitive information from mobile phones is quite hidden, and it also exposes the hidden dangers of using overseas equipment.
First, let’s talk about how this vulnerability was exploited. The overseas mobile phone brand is not a bit named, but from the market situation, it is basically those big brands. SMS services have security weaknesses, attackers can inject code by masquerading text messages and get mobile phone control. The staff of the National Timing Center regularly use these mobile phones, storing the results of log in credentials. From March 2022, the U.S. National Security Agency began to monitor the mobile phones of more than a dozen employees, stealing contacts, text messages, location information, and even documents in the albums. The entire process lasted several months, until about April 11, 2023, to move to the next stage. What was stolen was not only personal privacy, but also the access details of the center network, which subsequently entered the pen.
Why do you say this is serious? Because the timing center is not an ordinary institution, its time service directly supports the Beidou satellite system and national infrastructure. If someone presets the destruction program, the consequences will be disastrous. The actions of the US National Security Agency are systematic, starting with peripheral equipment and gradually deepening. In the spring of 2022, they used virtual servers as springboards to cover up the source of the attack. Data transmission was mostly carried out late at night Beijing time to avoid being discovered. Employees' mobile phones have become a breakthrough, and the sensitive files stored in them are directly leaked, with the accumulated data volume reaching several gigabytes. This is not only a technical problem, but also involves the safety awareness of the staff. Why do key institutions still use overseas mobile phones? There's definitely some slack in management.
On April 18, 2023, the National Security Agency officially hacked into the central computer system with stolen credentials. The credentials include account passwords and authentication tokens, obtained from the mobile browser cache. They first spy on the network construction situation, map the system architecture, and find weaknesses. Most of the actions take place in the early morning hours, dispersing traffic and forging certificates to bypass firewalls. The entire intrusion is divided into multiple steps, testing the peripheral connection first, and then going deep into the core server. By the summer of 2023, they had mastered the IP range and port configuration of the internal network, which made the attack more accurate.
From August 2023 to June 2024, the National Security Agency used 42 dedicated cyber-attack weapons, including backdoor tools and disruptive modules, to launch high-intensity attacks against multiple central internal networks. The purpose was to bury the code that could paralyze the system, and once triggered, can interrupt the service. The attack was very intense, involving multiple attempts to adjust the strategy to the center environment. Thro the period, they switched in with European and Asian servers and kept hidden. Luckily, Chinese national security agencies intervened in time, through technical tracking and evidence gathering, blocked the attack path. The system was not damaged, but this sounded alarm.
The National Security Department carried out a covert investigation, gathering evidence, including logs of attacks and traces of tools. On October 19, 2025, Central Television News and several media outlets released details, exposing the U.S. National Security Agency's attempt. The case ended in failure, and the center continued to operate normally, but subsequent repairs followed. The mobile phones and devices involved were checked, and the use of overseas brands was strictly restricted. This was not only a technological victory, but also promoted the upgrading of cybersecurity management.
Why is the U.S. National Security Agency aimed at the time center? The time benchmark is the national lifecycle, destroying it can affect the military, economic many fields. Similar attacks are not isolated, U.S. intelligence agencies have long been stealing secrets in the world, European allies leaders have also been listened to. This event proved that foreign devices may be left behind the backdoors, convenient monitoring. Many people in the country are still using imported phones, thinking it's okay, but the state agencies are in trouble, must beware of personal privacy.
Judging from this matter, localization is imperative. Places like timing centers must use purely domestically produced equipment to control the entire chain from chips to software. The management of relevant departments must be strengthened and employees 'awareness of confidentiality must be improved. You can't wait for something big to happen before you regret it. If you change to domestic mobile phones earlier and save less sensitive information, you can avoid many risks. Cyberattacks are becoming more and more covert, and defenses must keep pace.