9 ms·
Vodafone Found Hidden Backdoors in Huawei Equipment
- deleted 8y ago[deleted]
- okket 8y ago"While the carrier says the issues found in 2011 and 2012 were resolved at the time, the revelation may further damage the reputation of a Chinese powerhouse."
- NotPaidToPost 8y agoI'm sure that they're going to find out that some people at Huawei do not wash their hands after going to the toilet. Do you really want your data in those hands?
- SiempreViernes 8y agoDo the Snowden documents contain any NSA guidelines on sanitation procedures after taking a leak? If they a rigorous the NSA might be up for an unexpected boost in popularity!
- NotPaidToPost 8y agoI think they might still have had "don't ask, don't tell" at the time.
- dang 8y agoPlease don't do this here.
- NotPaidToPost 8y agoWhat is 'this'? Sarcasm or not following groupthink?
- dang 8y agoPost unsubstantive comments, especially snarky or indignant ones. There's obviously no 'groupthink' on HN about Huawei.
- NotPaidToPost 8y agoMy comment was 'substantive', as you put it. Sarcastic, but substantive. It's funny how you felt you had to use the word 'obviously'...
- dang 8y agoI just mean that people argue about Huawei and other China-related stories quite fiercely whenever they come up (often too fiercely: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). 'Groupthink' is refuted by a quick glance into any such thread. Actually though, the word 'groupthink' usually isn't about anything other than oneself. It's a form of internet preening: I the noble freethinker, towering above the deluded masses in whose midst I deign to glide. In other words, a middlebrow 'sheeple'. (Sorry if that feels like I'm picking on you personally; I don't mean to.)
- steve19 8y agoHard to know from the article, and Bloomberg does not have a good track record, if the 'backdoor' was a vulnerability , an unwanted feature or an actual backdoor. I might imagine a Chinese headline with "US firm Intel backdoors every CPU", which may or may not be true depending on your feelings on Intel ME
- undecisive 8y agoYeah. Quite telling when every quote from Vodaphone uses the word "Vulnerability", not backdoor.
- kbumsik 8y ago> Europe’s biggest phone company identified hidden backdoors in the software that could have given Huawei unauthorized access to the carrier’s fixed-line network in Italy, a system that provides internet service to millions of homes and businesses I think it is enough to be called a "backdoor".
- gloflo 8y agoNo, when reading the whole article, there are much more varied interpretations. Bloomberg added the 'political' backdoor spin.
- danarmak 8y agoA backdoor is a deliberate remote-access vulnerability that the creator intended to use for illegitimate access. The same code, but intentional, is a bug and vulnerability, but not a backdoor. Same security implications, but a big difference wrt. culpability, appropriate punishment, and expectations of future behavior.
- chopin 8y ago>A backdoor is a deliberate remote-access vulnerability that the creator intended to use for illegitimate access. I beg to differ. A backdoor gives access which the legitimate owner cannot control. I don't mind any intention.
- klagermkii 8y agoThis article dances back and forth between saying "vulnerability" and "backdoor", which while they may have the same end result wildly differ in intent. I can't tell the seriousness of this except for the telnet one.
- Aissen 8y agoHow anyone trusts Bloomberg after the Seamicro chip story is beyond my understanding. (and specially the way it was handled and not retracted — anyone can make mistakes, but owning them is most important). Even the title could have been something else. Like this excerpt from the article: > "Vodafone has defended Huawei against the U.S. onslaught"
- jdsully 8y agoThe article takes a lot of words to explain they left a telnet server open. It wasn’t some super secret hidden thing.
- sterlind 8y agoAh, but the article said that the telnet server "could still be launched," not that it was necessarily open. It could be one of those "magic knock" packets that 'launches' telnet, like the backdoor found in some Cisco routers a while back. Also weird is that Huawei insisted on keeping it open until they'd completed testing... does that mean it's phoning home? Or that they have their own technicians coming around to service it? Such a crappy article. Bloomberg should have learned from the Supermicro fiasco to include more details and not parrot a single source. At this point if IC is serious about Huawei posing a national security risk they should arrange a leak of their actual intel to force real public discussion..
- jeroenhd 8y ago"Never attribute to malice that which is adequately explained by stupidity" Some lazy engineer probably added the feature as a remote monitoring/debugging tool with no regard for security because it needed to work before the next big release. Disabling the feature before the next release would probably break all kinds of support and monitoring, potentially leading to instability or them being unable to service failing equipment.
- threeseed 8y agoThankfully not all of us take your approach. Because you should always assume malicious intent when it comes to IT security.
- jsty 8y agoWhether or not it was the intention here, leaving a common or garden vulnerability as a backdoor gives excellent plausible deniability. "Whoops, we overlooked that" is much easier to explain away than an obviously designed remote access mechanism
- O_H_E 8y agoClean, no paywall, no ads: https://outline.com/VVdLhT https://outline.com/VVdLhT
- swarnie_ 8y agoHas anyone else noticed the increased "scrutiny" the US has been putting on Chinese companies recently? Huawei seems to be the biggest example and its worrying me because they are starting to strong arm EU allies to follow in their footsteps. Both Germany and the UK have cleared Huawei to take put in 5g rollouts against the USA's wishes. I'm not sure who to side with here, the company with multiple allegations against it or the country which is known to do exactly the same thing except maybe worse...? Try not to dismiss this because its not dripping in pro-usa sentiment, i'm interested to hear what people inside the bubble think.
- NotPaidToPost 8y agoTelecommunication is of strategic importance and the West has had a monopoly on it. This monopoly had ended and that makes some people uncomfortable. > Both Germany and the UK have cleared Huawei to take put in 5g rollouts France has as well, as they said that all suppliers will be treated equally and subject to the same security tests.
- swarnie_ 8y ago> France has as well, as they said that all suppliers will be treated equally and subject to the same security tests. This is the bit that gets me. I simply don't believe you would approve a supplier with a question mark over them without running it past GCHQ/MI5/MI6 ect..... Presumably Germany and France did the same thing with their security services. It leaves me wondering if the US know something their 3 closest allies don't or if their position is purely economic/ideological.
- bildung 8y agoAs apparently no one who opposes Huawei seems to be bothered with e.g. Ciscos security track record, it has to be either corruption or ideology.
- tpetry 8y agoI guess it's mostly ideological. The US has been spying on europeans for _years_. All these leaks by Snowden showed really good how they threat europeans. Everything which has been leaked can't be used anymore. So if you want to continue spying on telecommunications you need to have some control. There's nothing more easy than a smearing campaign against the only other big telecommunications vendor and putting some pressure on the decision makers behind curtains. For any european country there's no difference between spying equipment from the US or China.
- amelius 8y agoCan't Huawei just license their technology to a US firm, so this hardware can be implemented and produced under US supervision?
- mr__y 8y ago>Chinese company licensing their technology to a US company that would be a remarkable plot-twist On the other hand given how sophisticated these things are , even if all the source code is available you can't be 100% sure to spot all the bugs/vulnerabilities/backdoors. I guess this applies to hardware equally well.
- negamax 8y agoI can’t tell if this is true or an organized smear campaign against Huawei for monetary reasons.
- danarmak 8y agoWhy not both? Many routers have had remote access vulnerabilities, but there's a clear reason to write about 2012-era vulns about Huawei and not some other manufacturer.
- mr__y 8y agoI believe it's both. I mean there could be some backdoors and there are some vulns portrayed as backdoors but probably the situation is no different for any other manufacturer. But since there is a campaign against Huawei everyone is concentrated on researching and reporting problems with that particular brand while ignoring all the others
- _cs2017_ 8y agoMy guess is it's not an organized smear campaign. Rather, it just happens to be a hot topic these days, an easy way to gain some clicks and subscriptions. Kinda like UFOs, government conspiracies, "Elvis Presley Seen Alive" etc., but for a slightly more sophisticated audience.
- agumonkey 8y agoWho would benefit from Huawei being out ? (genuinely curious)
- 0898 8y agoAs Jon Gruber says: "Bloomberg, of course, is the publication that published “The Big Hack” in October — a sensational story alleging that data centers of Apple, Amazon, and dozens of other companies were compromised by China’s intelligence services." "The story presented no confirmable evidence at all, was vehemently denied by all companies involved, has not been confirmed by a single other publication (despite much effort to do so), and has been largely discredited by one of Bloomberg’s own sources." "By all appearances “The Big Hack” was complete bullshit. Yet Bloomberg has issued no correction or retraction, and seemingly hopes we’ll all just forget about it. I say we do not just forget about it. Bloomberg’s institutional credibility is severely damaged, and everything they publish should be treated with skepticism until they retract the story or provide evidence that it was true."
- wqwh 8y agoSo like any other media publication? They are all in the business of lying, for profit or otherwise. I assume people at Bloomberg shorted Huawei stock before they published that.
- tikkabhuna 8y agoThe Economist frequently publishes corrections. I've also seen them note when one of their stakeholders is also linked to the topic of an article.
- terlisimo 8y ago
- SiempreViernes 8y ago> Abandoning Huawei for 5G, with Europe already lagging behind China and the U.S., could force them to rip out the supplier’s 4G gear Does anyone know what this is about? Both the need to rip out 4G gear if they don't want to use the new 5G stuff, and also the statement about Europe being behind China and the USA?
- jeroenhd 8y agoI think the idea is that Europe would rip out all Huawei components after the scandal, requiring a revamp of both 4G and 5G networks. I doubt the US is that much ahead of Europe. It's true 5G networks are yet to really roll out, but with the higher population density the 4G coverage and residential internet is better in most of Europe, making the current 4G network suffice for now for many people.
- SiempreViernes 8y agoYeah, Bloomberg themselves list Nokia and Ericsson as the next largest actors on the market after Huawei in an infographic, and I don't think those count as US companies so I'm not sure what that comment was about.
- bildung 8y agoI doubt many in the US (and Europe) even have full 4G speeds, e.g. 1 gigabit/s downstream.
- icebraining 8y agoSupposedly higher density makes 5G more important, not less, since it supports way more devices in the same area, while it doesn't really improve on the coverage distance, which is more important for more rural areas.
- caprese 8y agoAlternate headline: Chinese intelligence joins US and Five Eyes coalition in public-private partnership global surveillance program, information sharing agreement to be discussed in upcoming trade talks. Whataboutisms only work when the accuser is assuming something un-ordinary is happening, after knowingly or unknowingly exempting themselves from the behavior they already practice.
- gloflo 8y agoOne could replace 'Huawei' with 'Cisco' in this article and everyone would just nod and sigh. The political spin on it is concerning.
- O_H_E 8y agoI was skeptical about "boycotting" China and Huawei for a long time; just thought that they make cheap phones, and innovative tech, so why not. I changed 180 degrees when I started learning about the growing Chinese influence, how politically corrupt they are, and the excessive violence and human rights violations exercised against minorities. China is growing its economic dominance very quickly. They are gaining many growing Asian and African countries under their belts (pun intended with the belt & road initiative [1]) These poor counties don't really have a say when offered china's generous offers, but we do. It is going to be expensive, just like trying to fix climate change is: We have to be willing to pay to fix our mistakes (or other people in our society, if we want better future for our [grand]kids. But we will only be paying the price of our mistakes: depending that much on sweatshops, factory workers who are paid next to nothing, and collaborating with an authoritarian regime that clearly opposed our values for the longest time. [1] https://en.wikipedia.org/wiki/Belt_and_Road_Initiative https://en.wikipedia.org/wiki/Belt_and_Road_Initiative Concentration camps and race-based terrorism in Xinjiang: https://www.businessinsider.com/what-is-life-like-in-xinjiang-reeducation-camps-china-2018-5 https://www.businessinsider.com/what-is-life-like-in-xinjian... Belt and road effect on nature: https://www.businessinsider.com/china-belt-road-encourages-invasive-species-2019-1 https://www.businessinsider.com/china-belt-road-encourages-i... PS: I agree with the stance on bloomberg, but that doesn't really defy my point. I just had to get something off my chest.
- icebraining 8y agoWhat do you suggest we do? I'm asking in good faith; I think the worries of the influence of the CPC in the world are valid, but China can't simply be boycotted like any small country, and it's also not clear to me those boycotts (Cuba, Iran, etc) really effect change.
- joaomacp 8y agoI think it's important to show our governments that we're worried about this influence. Hopefully they'll react to that and move closer to the people's wants (you know, like democracies are supposed to work)
- 8y ago
- andrzejg 8y agoIt would be nice if they compare Huaweii to other vendors. I am quite sure Erricson and Nokia had some backdoors/critical vulnerabilities as well. It is quite common if the policies are poor and they skip some penetration tests. I don't think anyone would make such silly backdoors on purpose (like unsecured telnet connection).
- Uptrenda 8y agoAs opposed to backdoors in: - The SIM card for remote operator app provisioning. - The baseband processor (that supports over-the-air fireware updates, "typhoon boxes", and other horrible crap) - The GSM spec, lulz (that allows for binary SMS app pushes signed by certain keys, "silent" SMS to track location, and so on by protocol standard.) - Obsolete, broken, and purposefully weakened crypto that remains in use for backwards compatibility (and spying.) Not that it would matter anyway because traffic is unencrypted over core links. Vodafones entire business model depends on backdoors for controlling customer equipment and tracking subscribers. Also, China numba wun!
- csin 8y agoNot be mention being fined in multiple countries for shady marketing practices!
- apexalpha 8y ago>Vodafone said in the report that Huawei would need to remove or inhibit a so-called telnet service—a protocol used to control devices remotely—that the carrier said was a backdoor giving Huawei access to sensitive data. This seems like a diagnostic telnet port left open by accident. I'm very sceptical at this point at any American government or media finding a 'backdoor' in Huawei. A backdoor implies this is intentionally left open to later get unauthorized access. Why would anyone build a 'backdoor' on an open telnet port? This seems intentionally blown out of proportion to fit a narrative.
- threeseed 8y agoIt's not just American government or media who are wary of Huawei. It's EU, Japan, Australia, New Zealand, Canada, UK etc.
- BLKNSLVR 8y agoAustralia, New Zealand, and Canada are only on your list because of the American government's narrative. The UK are being threatened by the American government because the UK intends to continue using Huawei equipment. EU has specifically said the American government's narrative will NOT be taken into account. The EU will do their own due diligence. As an aside: I would hazard a guess that Germany isn't paying much attention to the American government's narrative due to the well-documented bugging of Angela Merkel's phone by US spooks.
- HenryBemis 8y agoI have been playing VikingMUD for more than a decade. I have been 'backdoor/hacking' it when I was using telnet to connect? I have been audit in IT/IT Audit/IT Security for quite a while. Having ability to telnet in is not a crime. We got firewalls for stuff like that. Even if it is not documented in whatever paperwork have been provided, it takes 5 seconds on a scan to pick this up. There also a bunch of IDS/IPS out there that would spot and kill such a connection attempt in a millisecond. Also, telnet is unencrypted. Who attacks something when everything is readable? It beats the purpose. This story has so many holes that a junior net-admin could prevent in their first week. I will assume that Vodafone has 'an army' of highly skilled network and security administrators that have "block telnet" in the first page of their checklists. I am not taking sides. I am just thinking of ways I have reacted in the past when I found on firewall logs blocked connect attempts. I also think Bloomberg should stick to what they do best, money. Let the IT Sec to far more qualified outlets. Or if they really want to do this right, and not just aim for clickbaits, get a team of experts to go through their material before they post.
- Fnoord 8y agoBackdoors are always hidden. Else it is a "frontdoor".
- fredgrott 8y agoleaving un secure stuff open is not the same as a damn backdoor BUT, being lax in rigour concerning what ports, etc are left open and the security reasons why is just at some point a question of are they an unknowing asset of China Gov... Both are equally important
- tinus_hn 8y agoIt’s one of these debug interfaces they find all the time in network equipment, either Chinese or by Cisco.