7 ms·
Huawei risk can be managed, say UK cyber-security chiefs
- amelius 8y agoDid they also consider DOS attacks of various kinds?
- gadders 8y agoYeah. I mean one attack is eavesdropping on conversations, but almost as bad a threat would be to just remotely disable the equipment.
- creato 8y agoAren't most of the alternatives to Huawei EU companies? e.g. Ericsson, Nokia? If they are acknowledging there is a risk, why not buy from them instead?
- setquk 8y agoProbably costs more and after the recent cell network outage here, caused by a certificate failure, I think they prioritise availability over absolute security. Huawei seem to produce some half decent stuff aside from the security issue.
- kingosticks 8y agoIt's also a message to those EU companies they need to remain price competitive. You can surely get a better deal if you have Nokia and historically-cheap Huawei battling for your order.
- Dahoon 8y agoThe thing is this isn't cheap Chinese gadgets. The main thing I see mentioned is that Huawei is years ahead. Being cheaper is just icing on the cake. Huawei use a lot more on R&D than the competition.
- kingosticks 8y agoOh no, I was thinking about IP infrastructure. Core/edge routers and the like. I don't see any technological advantage they have in that market but I could be wrong as I have not seen any product comparisons in a while. As I understood it, their wins are due to their pricing.
- deleted 8y ago[deleted]
- entity345 8y agoThere is always a risk from buying technology from suppliers you have no full control over. This is Brexit. The UK is trying not to depend on the EU too much either and are actively trying to diversify.
- notzuck 8y agoAre you claiming security policy is being driven by a need to pull back from the EU? Who do you know at GCHQ?
- entity345 8y agoI am claiming that the UK has to be realistic. The whole security story around Huawei is largely overblown and driven by the US's increasing realisation that they won't be the undisputed top dog for long. The UK is not in that situation. They are a medium power leaving the largest trading bloc in the world and they need China. As such they need to be realistic when assessing risk and have a pragmatic approach.
- roca 8y agoOverblown? Does anyone seriously believe that if Xi Jinping orders Huawei to deploy a backdoor, they will resist?
- entity345 8y agoAs I mentioned in another comment this is a risk that exists for every supplier that you haven't got full control over. As someone else further mentioned, the UK has setup an evaluation centre with Huawei where GCHQ experts check Huawei products before deployment. Again, let's not pretend that the the US are in good faith here even if security should of course always be considered. This is an obvious FUD campaign to slow the rise of a new superpower and of a major competitor in a sensitive industry.
- creato 8y ago
- Dahoon 8y agoTwo things I have seen mentioned from industry people: Huawei is a lot better in R&D (use more money than Apple) and getting some feature you want deployed is easier and faster. Secondly Huawei is not only cheaper but also higher quality. I know this doesn't fit with the witch hunt on Chinese companies the US is running but there you have it.
- justinjlynn 8y agoNot only that, they also heavily benefit from the R&D done at other companies. Add in generous subsidies from their parent government and you have a very attractive commercial offering, certainly. Indeed, this kind of money is rarely invested without a known, outsized, expected return and, in this, I seriously doubt Huawei and their owners are lacking in intelligence. I mean, who do we think they are - Winnie-the-Pooh?
- bwilli123 8y agoNot only that, Boeing and Airbus also heavily benefit from the R&D done at other companies. Add in generous subsidies from their parent government and you have a very attractive commercial offering, certainly. Indeed, this kind of money is rarely invested without a known, outsized, expected return and, in this, I seriously doubt Boeing and Airbus and their owners are lacking in intelligence. I mean, who do we think they are - Winnie-the-Pooh?
- justinjlynn 8y agoPower is as power does, or so I've been told.
- Dahoon 8y agoContrary to popular belief, Huawei isn't some big evil entity more or less under the thump of the Chinese state. It is owned by 80.000 of their own employees.
- justinjlynn 8y ago
- arethuza 8y ago"Managed" by who exactly?
- thornjm 8y agoSome context for those unfamiliar; Huawei and the UK government setup the “Huawei Cyber Security Evaluation Centre” to review Huawei device inner workings and updates before deploying in the UK. Despite this, it sounds like the UK is still removing Huawei devices from the most critical areas of their networks.
- entity345 8y agoThe UK is in the midst of Brexit and is trying to increase trade with China. In addition, the Chinese seem the only ones able or willing to supply nuclear plants to the country... They cannot afford to fall for the US-led hysteria.
- alt_f4 8y agohow does one manage a closed source binary with a backdoor in it in one's network equipment
- arethuza 8y agoProbably by deploying another closed binary from a US supplier to "monitor" it.
- unmole 8y agoCSEC has access to the code that is runs on Huawei's kit. Huawei is required to have reproducable builds to show that the code running in the network is the exactly same as what was vetted by CSEC.
- roca 8y agoWhich provides exactly no protection against hardware backdoors. HCSEC had 30 staff in 2015. Are they claiming to have done a line-by-line audit of all Huawei's code by now?
- acqq 8y agoObviously software build reproducibility “Huawei is required to have reproducable builds” doesn’t protect from hardware backdoors. That solution is the proper solution to the software backdoors, again: “the code running in the network is the exactly same as what was vetted by CSEC.”
- roca 8y agoI know it's obvious. The point is that some tens of HCSEC staff (mostly Huawei employees) thoroughly "vetting" tens of millions of lines of Huawei code for backdoors would prove nothing, even if it wasn't ludicrous, which it is.
- acqq 8y ago> would prove nothing It could surely prove something: those are reproducible builds. That means you can prove after some breach is detected that it originates from the given sources, if it is so. That in turn means that if something happens it won’t be Huawei employees who would investigate these sources. I’m sure that once a company offers the sources like this the company itself won’t plan to mess with the sources. Because then the unwanten intervention can be proved.
- skilled 8y agoLooking forward to seeing Huawei OS being announced, and the backlash that is going to trigger across the whole world.
- unmole 8y agoHuawei already has an OS for IoT applications: https://en.wikipedia.org/wiki/LiteOS https://en.wikipedia.org/wiki/LiteOS
- ShorsHammer 8y agoSource code here: https://github.com/LiteOS/LiteOS https://github.com/LiteOS/LiteOS
- fredley 8y agoThis is interesting. What this says to me is that the UK is essentially saying to China "Yeah we'll play your game". They're expecting some sort of attack, but they reckon that they've got the capability (at GCHQ or wherever) to counter that, and possibly turn the tables by feeding back counterintelligence. It could potentially be a good book in 1-200 years' time once all this is declassified.
- unmole 8y agoOr, could it be possible that they audited the code and found no backdoors or security issues? Now that would be crazy! /s
- krona 8y agoNot really. The public reports detail the altogether deficient way the hardware and software is being developed and manufactured. Hauwei know what they are and have failed to improve (much) over the past few years.
- giancarlostoro 8y agoOn that note, backdoors would either be hidden in proprietary apps, or delivered through OTA updates. Maybe a mix of both. I'd be interested in a diff of stock binaries vs recompiled "source" binaries to see if they differ significantly enough.
- pjc50 8y agoYears ago someone was telling me about the GCHQ facility at Martlesham Heath that was reverse-engineering all the incoming kit for use by BT. I think that pre-dated the Huawei Cyber Security Evaluation Centre in Banbury. HCSEC is a bit odd, it seems to be a joint venture between the fox and hens to guard the henhouse.
- entity345 8y agoEveryone expects attacks from everyone else... And conducts attacks on everyone else.
- tarcyanm 8y agoThe way I heard it is that the U.S. could not domestically provide an off the shelf end-to-end 5G solution. In addition, Huawei had at some point declined to install NSA backdoors. This was essentially the backdrop that led to Huawei being tarred and feathered.
- doktrin 8y ago> The way I heard it > In addition, Huawei had at some point declined to install NSA backdoors I think a statement like this needs some corroboration beyond word of mouth
- amaccuish 8y ago> I think a statement like this needs some corroboration beyond word of mouth I'd like to see that same standard applied to the initial allegations against Huawei. Still no proof that they've done anything wrong.
- bildung 8y agoNot GP, but I, too find it suspicious that e.g. Cisco, I direct competitor to Huawei, gets caught with yet another new backdoor almost monthly[1], and apparently the US administration has no qualms with buying Cisco hardware or with Cisco continuing to sell unsecure hardware worldwide. [1] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...