21 ms·

Report on the technical vulnerabilities found in Huawei 5G [pdf]

154 points by UkiahSmith 7y ago

joshgel 7y ago
> While we cannot prove malicious intent through a technical analysis, we can concretely state that 55% of tested devices had at least one potential backdoor
- svdr 7y ago
  And: "In virtually all categories we examined, Huawei devices were found to be less secure than those from other vendors making similar devices."
  - Jhsto 7y ago
    Which seem to include Juniper and Arista and not the other base station providers listed in the review such as Nokia, Ericsson, ZTE, or Samsung.
  - djsumdog 7y ago
    I was wondering about how bad this was against industrial standards, considering they've been articles about TP-Link and other Internet-of-Trash devices that have a lot of unpatched issues. The article seems to suggest Hawaii is exceptionally bad at patching or best practices in security.
    - rossdavidh 7y ago
      It's a low bar, but apparently they managed to not clear it.
Kenji 7y ago
• 29% of all devices tested had at least one default username and password stored in the firmware, enabling access to the device if administrators don’t change these credentials. • We identified 76 instances of firmware where the device was, by default, configured such that a root user with a hard-coded password could log in over the SSH protocol, providing for default backdoor access. • 8 different firmware images were found to have pre-computed authorized_keys hard coded into the firmware, enabling backdoor access to the holder of the private key. • 424 different firmware images contained hardcoded private SSH keys, which can enable a man-in-the-middle to manipulate and/or decrypt traffic going to the device. What a witch hunt... This is state of the art in the industry. Everybody does it like that. No intelligence agency has to be involved at all, it's basic negligence. If you're behind a NAT, your device is unlikely to be attacked via these vectors.
- WordyMcWordface 7y ago
  Exactly, every vendor has default passwords. If you are doing things right all default credentials are changed or disabled. Access to any service is firewalled off or better yet only accessible out of band on a dedicated management network.
  - djsumdog 7y ago
    This is changing. I've seen a number of ISPs no longer have default passwords. Each router or modem has a random password string set to the device, it's printed out and pasted as a sticker on the modem (or some print directly to the plastic). A lot of big name devices do this now too. Sure it's a password written on the device, but it's random, you need physical access to see it, and people who are security conscious can change it. This bad practice isn't excusable, especially not by a company as big as Huawai, not if they want to be taken seriously.
    - elmo2you 7y ago
      It's definitely a good development that ISPs have started to deploy routers and modems with randomized passwords. However, please do keep in mind the deployment of consumer equipment and enterprise hardware is different. Or at least it should be, in theory. Enterprise equipment is usually not supposed to be just dropped into place, without oversight. It usually needs proper configuration/management, by qualified people. Whether this also happens in practice can be a different story altogether. Still, the security of enterprise equipment usually involves more policy and procedure than it does with consumer equipment. With the latter, security has to come more or less by default, because the people handling the devices usually have little expert knowledge.
    - SuperNinjaCat 7y ago
      From what I have seen where I live, printed passwords on things like home routers and VDSL/Fiber modems provided by major ISP's are for 802.11 stuff (WiFi passwords) and not for the devices management interface. This may have changed since I last looked into it a few years ago though. There was also the whole Netgear router "backdoor" port thingy (a device shipped by a major ISP) which I actually had to exploit to recover my password after forgetting it once, which was kind of amusing.
Noxmiles 7y ago
"On dozens of occasions, Huawei engineers disguised known unsafe functions (such as memcpy) as the “safe” version (memcpy_s) by creating wrapper functions with the “safe” name but none of the safety checks. This leads to thousands of vulnerable conditions in their code." Things like this everywhere. Just stupid programmers or method?
- dalore 7y ago
  If they copied or used code that relied on using the safe memcpy_s, instead of having to change that code to use the unsafe versions, this could just be a proxy layer that lets that code run. This might be done so it's easier to keep the other code up to date if it's getting updated else where.
  - mikeash 7y ago
    Right, but why not take thirty seconds to do the appropriate checks in the wrappers?
    - acqq 7y ago
      Because it's far from being thirty seconds (as seen in the post by ploxiln here): http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm The most interesting quote regarding these "safer" interfaces from the report: "The design of the Bounds checking interfaces, though well-intentioned, suffers from far too many problems to correct. Using the APIs has been seen to lead to worse quality, less secure software than relying on established approaches or modern technologies. ... Therefore, we propose that Annex K be either removed from the next revision of the C standard, or deprecated and then removed."
      - mikeash 7y ago
        I don’t understand. Your link is talking about the difficulty of using these functions. But here, the functions are already being used. What’s missing is implementations of them. They chose to implement these functions without the security checks, but implementing them with the security checks is not hard.
majia 7y ago
The report says that Huawei devices have unsafe functions like “memcpy” and "strcpy". Is this a coding preference or dangerous practice? To what extent can these examples reflect on code quality?
- barkingcat 7y ago
  https://news.ycombinator.com/item?id=20421634 https://news.ycombinator.com/item?id=20421634
- ru999gol 7y ago
  Its a pretty good indication how easy its gonna be to find a memory corruption vulnerability. There are very few C programmers that I would trust to write secure code at all (none of those would ever touch those functions), yet alone with critical infrastructure equipment like this.
- rightbyte 7y ago
  Unless you know the context they are used in it doesn't say anything.
  - wybiral 7y ago
    It doesn't say that those particular uses are dangerous. But it says that their overall standards don't prohibit the use of potentially dangerous methods. In a non-critical application that kind of stuff is usually fine. But for critical infrastructure there are normally rules against using potentially unsafe methods like those entirely. Huawei would need to be more transparent to show that their practices are secure and that these uses are wrapped in some kind of protective framework. But until that happens it's reasonable to be skeptical from a security (and stability) perspective.
    - letstrynvm 7y ago
      Yeah... but it's security theatre. They will just use memcpy_s with the dest len and the len set to the same var. Or strncpy with the limit set to strlen(src) etc. These guys will tell you it's suddenly using 'modern security practices'. Conversely depending on the code strcpy / memcpy can be 100% safe. I think these guys are selling static analysis, so they find themselves using these oversimplified metrics... it's a shame because it looks like there was no lack of real issues.
ru999gol 7y ago
The huawei user account hardcoded in the firmware that has sudoers permissions for insmod/modprobe is really blatant. I would have guessed the Chinese would at least attempt to hide their way in? So they sell enterprise infrastructure equipment with such an obvious backdoor? It seems the US boycott of Huawei was fully justified after all, I didn't really believe them.
- bennofs 7y ago
  That doesn't have to be a backdoor. Remember the wave of bugs caused by hardcoded secrets in Cisco hardware? Might just be some leftover debugging account or for service.
  - ABCLAW 7y ago
    >That doesn't have to be a backdoor. It is a backdoor. The definition of the term doesn't require intent.
- chasil 7y ago
  It would be both more subtle and practical had Huawei modified sshd to accept any key that had been signed by their CA. That would have been slightly harder to detect.
  - pertymcpert 7y ago
    How could that be harder to detect?
elmo2you 7y ago
It's hard to say to which extend this "assessment" is honestly backed by solid evidence, or if it was written first and foremost for political reasons. The broad claims, apparent lack of factual evidence (only statements about what has been discovered), and rather overarching nature of the whole report, sure do suggest it could be the latter. Pure speculation on my own part, of course. I have not gone through the full report (yet), but while reading just a few sections my sales-pitch-bullshit-meter went on full tilt, at least a few times. The timing of this report is also peculiar, to say the least. Who is Finite State? What is their track record, to date? Who owns the company? What business relationships/interests do the company and its owners have? Yes, I realize/know these are suggestive questions. Questions that should nonetheless have satisfying/assuring answers, in order take this report seriously. There's a lot at stake here, so at least examining the validity of this report/summary isn't just a luxury. Are the factual findings behind this report publicly available?
- gtirloni 7y ago
  They did it using their analysis automation software (iotasphere) and the list of devices is in appendix A. Someone knowledgeable about forensics with access to the same devices probably can validate those claims.
  - elmo2you 7y ago
    I sure hope that someone will. I do not have access these devices, neither do I have any inclination to buying their commercial product in order to verify their claims. Maybe their product is brilliant, and/or maybe they did a lot of manual verification of their automated scans, in which case their report could be accurate (though still hard to verify). That said, my experience with both static analysis and runtime security scanner is less than stellar. They are without a doubt useful tools, if not indispensable. But they usually generate more leads for further (manual) analyses, rather than generate (accurate) final verdicts. Granted that pen-testing is a different animal (but one I have more experience with), I often have had to explain to customers that the reports they got from security auditing companies were full of false conclusion. More often than not because those companies were relying/trusting too much on automatically generated results, in addition to them trying to sell additional services. So, forgive me if I'm skeptical. That Finite State apparently has a stake of their own here (promotion of their product), which makes me only less inclined towards giving them the benefit of a doubt. As I mentioned before, this is of course all speculation on my part. Still, until Finite State publishes their factual/detailed scan results, I believe I have every reason to consider that this might be either a political motivated report, or more likely be an attempt to use/abuse the current political climate to promote their own product and services.
TedTschopp 7y ago
The process and practice findings are the most damning in my opinion. This isn't a opps we were rushing to market, this is a problem with values and in my mind damns the whole organization.
- djsumdog 7y ago
  Basic security tooling to remove hard coded keys of any kind need to be in the process. I bet shops like Cisco/Linksys, Neatgear and others at least make some attempt of this in their CI process.
  - rndgermandude 7y ago
    No https://nvd.nist.gov/vuln/detail/CVE-2019-1804 https://nvd.nist.gov/vuln/detail/CVE-2019-1804
Shank 7y ago
Some of these items seem like they need more analysis, and that the report was rushed. We agree as a community that hard coded default passwords are bad when unchanged, but that implies that the device doesn't require them to be changed on first boot. Basic setup processes often require these credentials to change after the first provision. I would expect a report which produces claims about such comprehensive backdooring and negligence to at least demonstrate how that behavior would play out in the real world. It seems much more like they did static analysis of the binaries, identified any strings with default passwords, and then reported on them. That's okay to do, but you can't conclude that's a problem until you confirm shoddy behavior after provisioning and deployment in practice.
heisenbit 7y ago
It seems odd to have a report with a 5G label and then find information in it about core routers. Yes they play a part but it strikes me as odd that there is no focus on mobile switching, gateways, HLRs, signaling vulnerabilites etc.. When looking at the boxes they compare: Huawei: CloudEngine 12800 scales up to 2000 * 25GBit or 500 * 40GBit Juniper: EX4650 Ethernet Switch scales up 48*25GBit With all due respect but this is comparing apples with orange seeds. A carrier class switch is more complex than an enterprise switch and has a much larger attack surface.
- punnerud 7y ago
  If there was an average of 128 rating 10.0 CVE vulnerability's in Android, Google Home, Google Glass, Google Mesh.. and they also had a track record of getting more insecure over time with new updates; would you feel safe in their self driving car? Company culture on this have everything to say. So looking at their most sold products is a good testimony for lack of security focus.
- bifrost 7y ago
  Its probably a shared codebase, I wouldn't be surprised if they had a monolithic OS and just had specific daemons to run things.
  - october_sky 7y ago
    Shared codebase + more offload ASIC processors is exactly what I'd expect
    - bifrost 7y ago
      Exactly. Most network forwarding happens on ASICs, its the only reasonable way to get performance.
bifrost 7y ago
I'm so glad this isn't about how "5G is dangerous zomg". We're lucky to get this sort of report! (In case you were looking for an article about the safety of 5G -> https://medium.com/@tomsparks/is-5g-dangerous-405a19e9ea88 https://medium.com/@tomsparks/is-5g-dangerous-405a19e9ea88)
ngcc_hk 7y ago
It is not the bug now but bug in the future. It is whether you can trust a country that respect nothing human. Can you even a campaign against anything once they take over your information infrastructure. Yes NSA may do it but cf NSA with PLA ... what is your leverage. Hear of the word totalitarian...
dade_ 7y ago
Not since the days of Microsoft astro-turfing have I seen such a campaign against a tech company. Some of these metrics are very subjective and I've seen so many bone-headed security bugs in equipment over the years (Cisco, Nortel, TP link, Dlink...) that I really have difficulty believing the narrative of state sponsored malice. Regardless, Huawei needs to clean up their practices. Ineptitude isn't a defense and this level of sloppiness is unacceptable; We have too much at stake with these essential networks, and I think legislation of security practices and standards in these products should be considered.
- robocat 7y ago
  > Regardless, Huawei needs to clean up their practices. Sure. So does every crappy home router manufacturer, Android manufacturer, security cam manufacturer etc: singling out Huawei is retarded. Personally I suspect that biggest issue is that the US doesn't wish to lose their own NSA phone/txt backdoor access (thumbs in everyone's pies). They have access to most US TCP/IP traffic, so they don't need to target router manufacturers.
  - dade_ 7y ago
    Yes, but this is actually an opportunity for Huawei. If I was them, I would take these findings and hire a team of hackers/sec researches to rip their products apart, fix the issues and then put then up for independent comparison with competitors. They have all of the resources one could dream if to be the best for security. It would be nice if anyone would set a high bar.

154 points by UkiahSmith 7y ago

> While we cannot prove malicious intent through a technical analysis, we can concretely state that 55% of tested devices had at least one potential backdoor

svdr 7y ago
And: "In virtually all categories we examined, Huawei devices were found to be less secure than those from other vendors making similar devices."
- Jhsto 7y ago
  Which seem to include Juniper and Arista and not the other base station providers listed in the review such as Nokia, Ericsson, ZTE, or Samsung.
- djsumdog 7y ago
  I was wondering about how bad this was against industrial standards, considering they've been articles about TP-Link and other Internet-of-Trash devices that have a lot of unpatched issues. The article seems to suggest Hawaii is exceptionally bad at patching or best practices in security.
  - rossdavidh 7y ago
    It's a low bar, but apparently they managed to not clear it.

Kenji 7y ago

• 29% of all devices tested had at least one default username and password stored in the firmware, enabling access to the device if administrators don’t change these credentials. • We identified 76 instances of firmware where the device was, by default, configured such that a root user with a hard-coded password could log in over the SSH protocol, providing for default backdoor access. • 8 different firmware images were found to have pre-computed authorized_keys hard coded into the firmware, enabling backdoor access to the holder of the private key. • 424 different firmware images contained hardcoded private SSH keys, which can enable a man-in-the-middle to manipulate and/or decrypt traffic going to the device. What a witch hunt... This is state of the art in the industry. Everybody does it like that. No intelligence agency has to be involved at all, it's basic negligence. If you're behind a NAT, your device is unlikely to be attacked via these vectors.

WordyMcWordface 7y ago
Exactly, every vendor has default passwords. If you are doing things right all default credentials are changed or disabled. Access to any service is firewalled off or better yet only accessible out of band on a dedicated management network.
- djsumdog 7y ago
  This is changing. I've seen a number of ISPs no longer have default passwords. Each router or modem has a random password string set to the device, it's printed out and pasted as a sticker on the modem (or some print directly to the plastic). A lot of big name devices do this now too. Sure it's a password written on the device, but it's random, you need physical access to see it, and people who are security conscious can change it. This bad practice isn't excusable, especially not by a company as big as Huawai, not if they want to be taken seriously.
  - elmo2you 7y ago
    It's definitely a good development that ISPs have started to deploy routers and modems with randomized passwords. However, please do keep in mind the deployment of consumer equipment and enterprise hardware is different. Or at least it should be, in theory. Enterprise equipment is usually not supposed to be just dropped into place, without oversight. It usually needs proper configuration/management, by qualified people. Whether this also happens in practice can be a different story altogether. Still, the security of enterprise equipment usually involves more policy and procedure than it does with consumer equipment. With the latter, security has to come more or less by default, because the people handling the devices usually have little expert knowledge.
  - SuperNinjaCat 7y ago
    From what I have seen where I live, printed passwords on things like home routers and VDSL/Fiber modems provided by major ISP's are for 802.11 stuff (WiFi passwords) and not for the devices management interface. This may have changed since I last looked into it a few years ago though. There was also the whole Netgear router "backdoor" port thingy (a device shipped by a major ISP) which I actually had to exploit to recover my password after forgetting it once, which was kind of amusing.

Noxmiles 7y ago

"On dozens of occasions, Huawei engineers disguised known unsafe functions (such as memcpy) as the “safe” version (memcpy_s) by creating wrapper functions with the “safe” name but none of the safety checks. This leads to thousands of vulnerable conditions in their code." Things like this everywhere. Just stupid programmers or method?

dalore 7y ago
If they copied or used code that relied on using the safe memcpy_s, instead of having to change that code to use the unsafe versions, this could just be a proxy layer that lets that code run. This might be done so it's easier to keep the other code up to date if it's getting updated else where.
- mikeash 7y ago
  Right, but why not take thirty seconds to do the appropriate checks in the wrappers?
  - acqq 7y ago
    Because it's far from being thirty seconds (as seen in the post by ploxiln here): http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm The most interesting quote regarding these "safer" interfaces from the report: "The design of the Bounds checking interfaces, though well-intentioned, suffers from far too many problems to correct. Using the APIs has been seen to lead to worse quality, less secure software than relying on established approaches or modern technologies. ... Therefore, we propose that Annex K be either removed from the next revision of the C standard, or deprecated and then removed."
    - mikeash 7y ago
      I don’t understand. Your link is talking about the difficulty of using these functions. But here, the functions are already being used. What’s missing is implementations of them. They chose to implement these functions without the security checks, but implementing them with the security checks is not hard.

majia 7y ago

The report says that Huawei devices have unsafe functions like “memcpy” and "strcpy". Is this a coding preference or dangerous practice? To what extent can these examples reflect on code quality?

barkingcat 7y ago
https://news.ycombinator.com/item?id=20421634 https://news.ycombinator.com/item?id=20421634
ru999gol 7y ago
Its a pretty good indication how easy its gonna be to find a memory corruption vulnerability. There are very few C programmers that I would trust to write secure code at all (none of those would ever touch those functions), yet alone with critical infrastructure equipment like this.
rightbyte 7y ago
Unless you know the context they are used in it doesn't say anything.
- wybiral 7y ago
  It doesn't say that those particular uses are dangerous. But it says that their overall standards don't prohibit the use of potentially dangerous methods. In a non-critical application that kind of stuff is usually fine. But for critical infrastructure there are normally rules against using potentially unsafe methods like those entirely. Huawei would need to be more transparent to show that their practices are secure and that these uses are wrapped in some kind of protective framework. But until that happens it's reasonable to be skeptical from a security (and stability) perspective.
  - letstrynvm 7y ago
    Yeah... but it's security theatre. They will just use memcpy_s with the dest len and the len set to the same var. Or strncpy with the limit set to strlen(src) etc. These guys will tell you it's suddenly using 'modern security practices'. Conversely depending on the code strcpy / memcpy can be 100% safe. I think these guys are selling static analysis, so they find themselves using these oversimplified metrics... it's a shame because it looks like there was no lack of real issues.

ru999gol 7y ago

The huawei user account hardcoded in the firmware that has sudoers permissions for insmod/modprobe is really blatant. I would have guessed the Chinese would at least attempt to hide their way in? So they sell enterprise infrastructure equipment with such an obvious backdoor? It seems the US boycott of Huawei was fully justified after all, I didn't really believe them.

bennofs 7y ago
That doesn't have to be a backdoor. Remember the wave of bugs caused by hardcoded secrets in Cisco hardware? Might just be some leftover debugging account or for service.
- ABCLAW 7y ago
  >That doesn't have to be a backdoor. It is a backdoor. The definition of the term doesn't require intent.
chasil 7y ago
It would be both more subtle and practical had Huawei modified sshd to accept any key that had been signed by their CA. That would have been slightly harder to detect.
- pertymcpert 7y ago
  How could that be harder to detect?

elmo2you 7y ago

It's hard to say to which extend this "assessment" is honestly backed by solid evidence, or if it was written first and foremost for political reasons. The broad claims, apparent lack of factual evidence (only statements about what has been discovered), and rather overarching nature of the whole report, sure do suggest it could be the latter. Pure speculation on my own part, of course. I have not gone through the full report (yet), but while reading just a few sections my sales-pitch-bullshit-meter went on full tilt, at least a few times. The timing of this report is also peculiar, to say the least. Who is Finite State? What is their track record, to date? Who owns the company? What business relationships/interests do the company and its owners have? Yes, I realize/know these are suggestive questions. Questions that should nonetheless have satisfying/assuring answers, in order take this report seriously. There's a lot at stake here, so at least examining the validity of this report/summary isn't just a luxury. Are the factual findings behind this report publicly available?

gtirloni 7y ago
They did it using their analysis automation software (iotasphere) and the list of devices is in appendix A. Someone knowledgeable about forensics with access to the same devices probably can validate those claims.
- elmo2you 7y ago
  I sure hope that someone will. I do not have access these devices, neither do I have any inclination to buying their commercial product in order to verify their claims. Maybe their product is brilliant, and/or maybe they did a lot of manual verification of their automated scans, in which case their report could be accurate (though still hard to verify). That said, my experience with both static analysis and runtime security scanner is less than stellar. They are without a doubt useful tools, if not indispensable. But they usually generate more leads for further (manual) analyses, rather than generate (accurate) final verdicts. Granted that pen-testing is a different animal (but one I have more experience with), I often have had to explain to customers that the reports they got from security auditing companies were full of false conclusion. More often than not because those companies were relying/trusting too much on automatically generated results, in addition to them trying to sell additional services. So, forgive me if I'm skeptical. That Finite State apparently has a stake of their own here (promotion of their product), which makes me only less inclined towards giving them the benefit of a doubt. As I mentioned before, this is of course all speculation on my part. Still, until Finite State publishes their factual/detailed scan results, I believe I have every reason to consider that this might be either a political motivated report, or more likely be an attempt to use/abuse the current political climate to promote their own product and services.

TedTschopp 7y ago

The process and practice findings are the most damning in my opinion. This isn't a opps we were rushing to market, this is a problem with values and in my mind damns the whole organization.

djsumdog 7y ago
Basic security tooling to remove hard coded keys of any kind need to be in the process. I bet shops like Cisco/Linksys, Neatgear and others at least make some attempt of this in their CI process.
- rndgermandude 7y ago
  No https://nvd.nist.gov/vuln/detail/CVE-2019-1804 https://nvd.nist.gov/vuln/detail/CVE-2019-1804

Shank 7y ago

Some of these items seem like they need more analysis, and that the report was rushed. We agree as a community that hard coded default passwords are bad when unchanged, but that implies that the device doesn't require them to be changed on first boot. Basic setup processes often require these credentials to change after the first provision. I would expect a report which produces claims about such comprehensive backdooring and negligence to at least demonstrate how that behavior would play out in the real world. It seems much more like they did static analysis of the binaries, identified any strings with default passwords, and then reported on them. That's okay to do, but you can't conclude that's a problem until you confirm shoddy behavior after provisioning and deployment in practice.

heisenbit 7y ago

It seems odd to have a report with a 5G label and then find information in it about core routers. Yes they play a part but it strikes me as odd that there is no focus on mobile switching, gateways, HLRs, signaling vulnerabilites etc.. When looking at the boxes they compare: Huawei: CloudEngine 12800 scales up to 2000 * 25GBit or 500 * 40GBit Juniper: EX4650 Ethernet Switch scales up 48*25GBit With all due respect but this is comparing apples with orange seeds. A carrier class switch is more complex than an enterprise switch and has a much larger attack surface.

punnerud 7y ago
If there was an average of 128 rating 10.0 CVE vulnerability's in Android, Google Home, Google Glass, Google Mesh.. and they also had a track record of getting more insecure over time with new updates; would you feel safe in their self driving car? Company culture on this have everything to say. So looking at their most sold products is a good testimony for lack of security focus.
bifrost 7y ago
Its probably a shared codebase, I wouldn't be surprised if they had a monolithic OS and just had specific daemons to run things.
- october_sky 7y ago
  Shared codebase + more offload ASIC processors is exactly what I'd expect
  - bifrost 7y ago
    Exactly. Most network forwarding happens on ASICs, its the only reasonable way to get performance.

bifrost 7y ago

I'm so glad this isn't about how "5G is dangerous zomg". We're lucky to get this sort of report! (In case you were looking for an article about the safety of 5G -> https://medium.com/@tomsparks/is-5g-dangerous-405a19e9ea88 https://medium.com/@tomsparks/is-5g-dangerous-405a19e9ea88)

ngcc_hk 7y ago

It is not the bug now but bug in the future. It is whether you can trust a country that respect nothing human. Can you even a campaign against anything once they take over your information infrastructure. Yes NSA may do it but cf NSA with PLA ... what is your leverage. Hear of the word totalitarian...

dade_ 7y ago

Not since the days of Microsoft astro-turfing have I seen such a campaign against a tech company. Some of these metrics are very subjective and I've seen so many bone-headed security bugs in equipment over the years (Cisco, Nortel, TP link, Dlink...) that I really have difficulty believing the narrative of state sponsored malice. Regardless, Huawei needs to clean up their practices. Ineptitude isn't a defense and this level of sloppiness is unacceptable; We have too much at stake with these essential networks, and I think legislation of security practices and standards in these products should be considered.

robocat 7y ago
> Regardless, Huawei needs to clean up their practices. Sure. So does every crappy home router manufacturer, Android manufacturer, security cam manufacturer etc: singling out Huawei is retarded. Personally I suspect that biggest issue is that the US doesn't wish to lose their own NSA phone/txt backdoor access (thumbs in everyone's pies). They have access to most US TCP/IP traffic, so they don't need to target router manufacturers.
- dade_ 7y ago
  Yes, but this is actually an opportunity for Huawei. If I was them, I would take these findings and hire a team of hackers/sec researches to rip their products apart, fix the issues and then put then up for independent comparison with competitors. They have all of the resources one could dream if to be the best for security. It would be nice if anyone would set a high bar.