4 ms·

I think the Economist had a good take: https://www.economist.com/leaders/2020/01/25/huawei-is-a-cyber-security-risk https://www.economist.com/leaders/2020/01/25

I think the Economist had a good take: https://www.economist.com/leaders/2020/01/25/huawei-is-a-cyber-security-risk https://www.economist.com/leaders/2020/01/25/huawei-is-a-cyb... There is a real risk in using Huawei equipment, but the risk can be mitigated. If the Chinese government tells Huawei to insert a backdoor, Huawei will certainly comply. But state actors don't necessarily need backdoors to exploit equipment. They're going to look for bugs, which they're just as likely to find in competitor's equipment as anything else. So the real solution is not to exclude Huawei because they're Chinese, but to make sure engineers fully understand the system from the hardware on up. This means insisting on open source systems and then conducting thorough audits.

blackrock 7y ago
Fascinating, so China will be the #1 supporter of open source software? All their code must be open sourced, in order to win foreign contracts. And all it took was a little trade war.
- yorwba 7y ago
  Not open source, just available for review by government agencies. The UK's Huawei Cyber Security Evaluation Centre has had access to Huawei's source for a while now, and has been complaining about bugs for about as long. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2019 https://www.gov.uk/government/publications/huawei-cyber-secu...
  - ngcc_hk 7y ago
    Hardware open sourced and audited ? Are you joking ? They can be changed by a fix and it is networked. Also vulnerability is another vector. You concentrate on what you know but not others left open is very hard to know.
  - blackrock 7y ago
    This is actually even more interesting. Now, China can get buy-in from the UK. The two are basically married now. Huawei can require that the UK certifies the source code, and to even do the actual compilation step itself, and to sign the final executable programs and configuration files. At which point, the binaries are created, and the UK will have a cryptographic signature of the file. Thus the binary is now cryptographically secured, that even China, with their mysterious black magic, cannot break the mathematical and thermodynamic laws of nature. /s The UK team then approves this binary, and allows Huawei to begin mass installation on the hardware via firmware flashing. Then Huawei will initiate mass production, and begin shipping out the hardware to worldwide customers. Then the UK can post-certify that the same source code that they compiled and published, is the exact same code that is in the hardware. The same process can be done for continuing code updates. Huawei can mandate that the UK provides a team to do the final compilation and verification step, and this team must promise (by penalty of law) to remove themselves from any conflict of interest, meaning they cannot work on similar technologies in the future, to compete against Huawei. It’s like a non-compete agreement. And they also cannot disclose any Huawei trade secrets, or algorithmic details of Huawei’s 5G hardware. Their responsibility is to just ensure security, and do penetration testing for security weaknesses. And China can even mandate that the UK team relocate to China, to view the source code onsite. And they can even run this for all hardware blueprints too. And monitor the code that also goes into the other chips on the SoC motherboard. Then Huawei and China can claim that the code was validated by the UK itself, and here’s the genuine certification ID. And that it’s free of any known defects or spyware code.
c0restraint 7y ago
I’d agree with you, but then you hand-waved past forcing Hauwei to open source their IP.
biztos 7y ago
> This means insisting on open source systems and then conducting thorough audits. That would be nice, and in any case I'm a big believer in protecting your information at the protocol level instead of trusting this or that foreign government. But once you've put that much effort into vetting it, aren't you pretty close to being able to roll your own on commodity hardware?
- badrabbit 7y ago
  None of that matters if they can bring down a nation's network or use metadata (IMEI) to track users, that's very harmful enough!
3pt14159 7y ago
The risk cannot be truly mitigated even though we keep pretending it can be. The British should know better than to allow this in, but they try to kick the can down the road just like we've done over and over again. Audits won't cover everything and code is updatable anyway. The Americans are right on this one: Chinese networking gear shouldn't be trusted. I know G5 is a red herring (plenty of 4G equipment came from / comes from China), but network attacks are real and the attack surface area is exploding as everything gets put online. Ultimately this is a problem with the technical literacy of our politicians and a matter of underpaying people that work for the technical agencies responsible for national security like GCHQ.
- Macuyiko 7y ago
  Agree and disagree with you and your parent commentor. > They're going to look for bugs, which they're just as likely to find in competitor's equipment as anything else. > [T]he real solution is not to exclude Huawei because they're Chinese, but to make sure engineers fully understand the system from the hardware on up. > [T]his is a problem with the technical literacy of our politicians [...] In my simple view [1], we're all thinking from an engineering "global optimum" mindset, as happens often here, but none of these solutions are realistic. Neither now nor going forward. If you look at it from a political POV, the question should be: "how did Huawei find itself in a position like this?" The approach, hence, should be a combination of a renewed massive investment in tech (similarly to military spending) on the one hand, and strong state support on the other hand. That sounds crazy and even "socialist" to a US audience, but on the other hand wouldn't be the first time this has been done. A follow up question would be about what's holding us back. I'll leave that to think about. Similar reasoning for general infrastructure projects, I feel. [1]: I'm not putting this out as gospel, so feel free to offer counters.
  - 3pt14159 7y ago
    I'm not thinking from a global optimum mindset. I'm reading the actual DNI reports, I've talked with actual people in cyberwarfare (a major, even) and I've talked with people in both the OSINT community and the SIGINT / COMINT community. I have a family member that works on blackers all day long for the government of Canada and I've gone to conferences on both attack (Infiltrate) and defence. China has a competitive advantage on creating tech at lower cost. America is awash in investment dollars, but has burdens that the Chinese do not have (IP, compliance, competition with other market participants like Google / Apple for the same talent) and it isn't realistic to keep our hopes on America or other western countries always matching the lowest cost. Some things need to be prioritized strictly because they're national security interests. Our media companies shouldn't be owned by state backed foreign interests, our defence companies shouldn't be, and our networking gear shouldn't be riddled with gear from a country like China that mass incarcerates people based on religion or ideology. I'm not saying things will be perfect if we keep China out of our 5G space—far from it—but the internet is essentially a nervous system for machines and if we allow their gear all over our networks it's going to be utilised against us. In an ideal world even a country like Canada would have their own networking gear providers, so that if a country like the USA slides into despotism we wouldn't have to worry about getting strong armed, but we're far from that ideal scenario and I'm only hoping for less of a bad bargain than we're likely to find ourselves in 20 years from now.
KaiserPro 7y ago
This is missing the point. All Comms kit has back doors in it. Its about choosing whom you allow to put them in. Cisco was riddled with backdoors, and if you were interesting, the five eyes would specially intercept your kit and put extra bits in before it was delivered to you. The issue here is geopolitical. Who has control of your friend's internet. Now there are few ways to look at this: 1) this is the present government's master plan to use this as a bargaining chip in negotiations 2) The kit is going to be at the edge, which if the network is designed properly, will mitigate attempts to snoop or spoof 3) GCHQ et al, can't plan for shit. 4) The government and civil service can't plan for shit, don't understand how tech can influence geo politics 5) Trump is trying to get allies to buy shitty expensive kit from the USA. Out of all of these 4 is my favourite hypothesis, but there are bound to be more factors. Yes, Huawei have sponsored a lab to prove that their kit is secure. But of course they would, they are not going to ship gimped kit to be tested. Also, As Huawei kit already operates vast parts of openreach's network (the company that runs the vast majority of landlines and fibre) the point is kind of moot. The decision to allow this is why marconi bit the bucket, killing the last bit on comms design the UK had. (like every other pioneering electronics/computing company in the UK.)
- badrabbit 7y ago
  Another subtle post I see... Existing Huawei equipment should be removed. Sunken cost fallacy is well...a fallacy. You mentioned Trump to ellicit political emotions but oppositiin to Huawei by US started during Obama's era and had bipartisan support. GCHQ and the UK can indeed plan "for shit" as you put it, possibly more than you CCP fellas. Whether they use this a bargaining chip or not does not change China's hostilities. And last but far from least!!!!! It does not matter if their equipment is on the edge, do you want HN readers to suspend all knowledge of networking? Even if their equipment is purely layer2 and will only see encrypted traffic: 1) this still lets them be poisitoned to exploit and track arbitrary devices. 2) this still let's be in a position where they can abuse trust with the core or exploit the core. 3) this still lets them be in a position where they can cripple UK's communication infrastructure (DOS),which if they're smart,that's the primary vulnerability they will exploit in case of an invasion/war/pre-kinetic-war

blackrock 7y ago

Fascinating, so China will be the #1 supporter of open source software? All their code must be open sourced, in order to win foreign contracts. And all it took was a little trade war.

yorwba 7y ago
Not open source, just available for review by government agencies. The UK's Huawei Cyber Security Evaluation Centre has had access to Huawei's source for a while now, and has been complaining about bugs for about as long. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2019 https://www.gov.uk/government/publications/huawei-cyber-secu...
- ngcc_hk 7y ago
  Hardware open sourced and audited ? Are you joking ? They can be changed by a fix and it is networked. Also vulnerability is another vector. You concentrate on what you know but not others left open is very hard to know.
- blackrock 7y ago
  This is actually even more interesting. Now, China can get buy-in from the UK. The two are basically married now. Huawei can require that the UK certifies the source code, and to even do the actual compilation step itself, and to sign the final executable programs and configuration files. At which point, the binaries are created, and the UK will have a cryptographic signature of the file. Thus the binary is now cryptographically secured, that even China, with their mysterious black magic, cannot break the mathematical and thermodynamic laws of nature. /s The UK team then approves this binary, and allows Huawei to begin mass installation on the hardware via firmware flashing. Then Huawei will initiate mass production, and begin shipping out the hardware to worldwide customers. Then the UK can post-certify that the same source code that they compiled and published, is the exact same code that is in the hardware. The same process can be done for continuing code updates. Huawei can mandate that the UK provides a team to do the final compilation and verification step, and this team must promise (by penalty of law) to remove themselves from any conflict of interest, meaning they cannot work on similar technologies in the future, to compete against Huawei. It’s like a non-compete agreement. And they also cannot disclose any Huawei trade secrets, or algorithmic details of Huawei’s 5G hardware. Their responsibility is to just ensure security, and do penetration testing for security weaknesses. And China can even mandate that the UK team relocate to China, to view the source code onsite. And they can even run this for all hardware blueprints too. And monitor the code that also goes into the other chips on the SoC motherboard. Then Huawei and China can claim that the code was validated by the UK itself, and here’s the genuine certification ID. And that it’s free of any known defects or spyware code.

c0restraint 7y ago

I’d agree with you, but then you hand-waved past forcing Hauwei to open source their IP.

biztos 7y ago

> This means insisting on open source systems and then conducting thorough audits. That would be nice, and in any case I'm a big believer in protecting your information at the protocol level instead of trusting this or that foreign government. But once you've put that much effort into vetting it, aren't you pretty close to being able to roll your own on commodity hardware?

badrabbit 7y ago
None of that matters if they can bring down a nation's network or use metadata (IMEI) to track users, that's very harmful enough!

3pt14159 7y ago

The risk cannot be truly mitigated even though we keep pretending it can be. The British should know better than to allow this in, but they try to kick the can down the road just like we've done over and over again. Audits won't cover everything and code is updatable anyway. The Americans are right on this one: Chinese networking gear shouldn't be trusted. I know G5 is a red herring (plenty of 4G equipment came from / comes from China), but network attacks are real and the attack surface area is exploding as everything gets put online. Ultimately this is a problem with the technical literacy of our politicians and a matter of underpaying people that work for the technical agencies responsible for national security like GCHQ.

Macuyiko 7y ago
Agree and disagree with you and your parent commentor. > They're going to look for bugs, which they're just as likely to find in competitor's equipment as anything else. > [T]he real solution is not to exclude Huawei because they're Chinese, but to make sure engineers fully understand the system from the hardware on up. > [T]his is a problem with the technical literacy of our politicians [...] In my simple view [1], we're all thinking from an engineering "global optimum" mindset, as happens often here, but none of these solutions are realistic. Neither now nor going forward. If you look at it from a political POV, the question should be: "how did Huawei find itself in a position like this?" The approach, hence, should be a combination of a renewed massive investment in tech (similarly to military spending) on the one hand, and strong state support on the other hand. That sounds crazy and even "socialist" to a US audience, but on the other hand wouldn't be the first time this has been done. A follow up question would be about what's holding us back. I'll leave that to think about. Similar reasoning for general infrastructure projects, I feel. [1]: I'm not putting this out as gospel, so feel free to offer counters.
- 3pt14159 7y ago
  I'm not thinking from a global optimum mindset. I'm reading the actual DNI reports, I've talked with actual people in cyberwarfare (a major, even) and I've talked with people in both the OSINT community and the SIGINT / COMINT community. I have a family member that works on blackers all day long for the government of Canada and I've gone to conferences on both attack (Infiltrate) and defence. China has a competitive advantage on creating tech at lower cost. America is awash in investment dollars, but has burdens that the Chinese do not have (IP, compliance, competition with other market participants like Google / Apple for the same talent) and it isn't realistic to keep our hopes on America or other western countries always matching the lowest cost. Some things need to be prioritized strictly because they're national security interests. Our media companies shouldn't be owned by state backed foreign interests, our defence companies shouldn't be, and our networking gear shouldn't be riddled with gear from a country like China that mass incarcerates people based on religion or ideology. I'm not saying things will be perfect if we keep China out of our 5G space—far from it—but the internet is essentially a nervous system for machines and if we allow their gear all over our networks it's going to be utilised against us. In an ideal world even a country like Canada would have their own networking gear providers, so that if a country like the USA slides into despotism we wouldn't have to worry about getting strong armed, but we're far from that ideal scenario and I'm only hoping for less of a bad bargain than we're likely to find ourselves in 20 years from now.

KaiserPro 7y ago

This is missing the point. All Comms kit has back doors in it. Its about choosing whom you allow to put them in. Cisco was riddled with backdoors, and if you were interesting, the five eyes would specially intercept your kit and put extra bits in before it was delivered to you. The issue here is geopolitical. Who has control of your friend's internet. Now there are few ways to look at this: 1) this is the present government's master plan to use this as a bargaining chip in negotiations 2) The kit is going to be at the edge, which if the network is designed properly, will mitigate attempts to snoop or spoof 3) GCHQ et al, can't plan for shit. 4) The government and civil service can't plan for shit, don't understand how tech can influence geo politics 5) Trump is trying to get allies to buy shitty expensive kit from the USA. Out of all of these 4 is my favourite hypothesis, but there are bound to be more factors. Yes, Huawei have sponsored a lab to prove that their kit is secure. But of course they would, they are not going to ship gimped kit to be tested. Also, As Huawei kit already operates vast parts of openreach's network (the company that runs the vast majority of landlines and fibre) the point is kind of moot. The decision to allow this is why marconi bit the bucket, killing the last bit on comms design the UK had. (like every other pioneering electronics/computing company in the UK.)

badrabbit 7y ago
Another subtle post I see... Existing Huawei equipment should be removed. Sunken cost fallacy is well...a fallacy. You mentioned Trump to ellicit political emotions but oppositiin to Huawei by US started during Obama's era and had bipartisan support. GCHQ and the UK can indeed plan "for shit" as you put it, possibly more than you CCP fellas. Whether they use this a bargaining chip or not does not change China's hostilities. And last but far from least!!!!! It does not matter if their equipment is on the edge, do you want HN readers to suspend all knowledge of networking? Even if their equipment is purely layer2 and will only see encrypted traffic: 1) this still lets them be poisitoned to exploit and track arbitrary devices. 2) this still let's be in a position where they can abuse trust with the core or exploit the core. 3) this still lets them be in a position where they can cripple UK's communication infrastructure (DOS),which if they're smart,that's the primary vulnerability they will exploit in case of an invasion/war/pre-kinetic-war