7 ms·
Huawei dev team submit Linux patch with backdoor, Huawei denies involvement
- fulafel 6y agoGrsecurity people have been involved in a lot of fights and accusations over the years. Also this was a first posting of the patch set. I think it's pretty hard to show malice here. Of course your bayesian prior will be influenced by how paranoid you are about Huawei in general. edit: apologies to Grsecurity, as pointed out downthread they make no accusations of backdoors. Although apparently the Grsecurity blog post was also altered after comments from Huwaeithe PSIRT, don't know what was in the original version.
- danieldk 6y agoIf you are going to try to insert backdoors, you will come up with a way to of doing it with plausible deniability. Letting an employee post the patch own their own credentials is one way way of setting up plausible deniability.
- fulafel 6y agoYes, of course. But the flip side is that any given bug is unlikely to be a covert backdoor. Considering the scrutiny Huwaei is under, and how this patch was not proposed or destined to any existing used Linux component, this would be an odd risk-reward equation. I fear this will be a nail in the coffin for any freedoms Huawei employees had to participate in open source infosec dev community on their own volition. We should be encouraging this kind of participation, not publically crucifying beginning participants and their employers for mistakes.
- cycomanic 6y agoActually if you read the grsecurity blog it is much more nuanced then the linked story (and would have been a much better source to link to IMO). In particular they do not insinuate a backdoor. In fact their post is pretty consistent in that they criticize the quality (or lack thereof) and limited understanding of security, which they have done for many others as well. This seems to really be a story blown out of proportion based on the current political climate. I don't believe a similar vulnerability in a patch from cisco, Intel, Google or any of the others (and they had patches which were similarly criticized by grsecurity) would have received a backdoor label in the headlines. That is not to say that we should not strongly scrutinise patches from Huawei.
- fulafel 6y agoGood correction. But reading the Grsecurity blog, it becomes even clearer that this is far from production code and would be very far from passing any kind of QC for production code.
- addcninblue 6y agoPrevious discussion: https://news.ycombinator.com/item?id=23137041 https://news.ycombinator.com/item?id=23137041
- voltagex_ 6y agoI wonder whether it's better just to link to grsecurity here https://grsecurity.net/huawei_hksp_introduces_trivially_exploitable_vulnerability https://grsecurity.net/huawei_hksp_introduces_trivially_expl...
- smcleod 6y agoThank you, yes that's much better.
- voltagex_ 6y agoIt turns out that this is what the previous thread that was also linked is about.
- adamrezich 6y ago>Based on publicly-available information, we know the author of the patch is a Huawei employee, and despite attempts now to distance itself from the code after publication of this post, it still retains the Huawei naming. Further, on information from our sources, the employee is a Level 20 Principal Security staffer, the highest technical level within Huawei.
- deleted 6y ago[deleted]