14 ms·
Huawei was able to eavesdrop on Dutch mobile network KPN: Report
- encryptluks2 6y agoI could have hacked the electric grid. Just cause someone could have done something doesn't mean that they did. This is pandering to political bias.
- contravariant 6y agoDepending on what you mean by 'hacked' that's still newsworthy. In this article 'wiretapped' means that they had uncontrolled and unlimited access to all conversations. The problem isn't so much that it could have happened but that it might have happened.
- 1cvmask 6y agoEvery potential access or potential hack is newsworthy then. That’s about a million articles a day then. Which would mean it is not newsworthy then. Everything is a potential this or potential that by the reasoning.
- jand 6y agoThis article contains no new revelations on top of previous articles: "Huawei’s says it never acted inappropriately by abusing its position in the Netherlands. KPN says in a response that it has no indications that lines were tapped or that customer data was stolen."
- ajross 6y agoThe spin on this situation is dumb. What it amounts to is that KPN hired Huawei on a contract basis to administer its equipment, and as a result those contract administrators had... administrator privileges on the Huawei equipment. Now, obviously telco equipment can be used for spying, but there's absolutely no allegation of wrongdoing here at all. If there is any finger to point, it's at KPN for hiring an untrusted contractor and giving them sensitive access.
- Gys 6y ago> for hiring an untrusted contractor So you agree Huawei cannot be trusted. I think that is the whole point of the discussion.
- simion314 6y agoNot OP, but must probably this is just part of the anti-China propaganda , I think it started with the false accusations from Bloomberg... so I expect that any Huawei related news is false until some actual evidence is presented to the police or something.
- hn8788 6y agoHuawei doesn't really deserve the benefit of the doubt, a lot of their early success was due to hacking Cisco and Nortel then building competing products based on stolen information, all while the Chinese government was restricting non-Chinese telecom vendors from operating in the country.
- simion314 6y agoI personally don't like to be manipulated by media. So for this case I am just saying be aware not to be a tool/pawn is some big player's game, I suggest you either do more digging , wait for some real evidence - but downvote if the mention of the Bloomberg fake article or innocent until proven guilty is a something wrong that needs to be hidden.
- jryle70 6y agoYou're contradicting yourself here, as you don't want to be manipulated but are already convinced that this is part of anti-China propaganda. Also, innocent until proven guilty should only apply to regular people, not state actors. Many historical events are only declassified after 50, 60 years, or never at all. Believe a story or not is your judgement, but asking for proofs are either naive, or just looking for excuses.
- the-dude 6y agoOriginal title : Huawei was able to eavesdrop on Dutch mobile network KPN: Report Dupe : https://news.ycombinator.com/item?id=26842733 https://news.ycombinator.com/item?id=26842733 ( 65 comments )
- roenxi 6y agoI dunno how newsworthy the "Huawei" part of this is. The options seem to be go with a local provider or accept some level of risk of exfiltrated data. For example, nobody is pretending that Cisco is trustworthy. I'm sure the Chinese spies made off with some stuff that they shouldn't have because they'd be stupid not to - but if anything this sounds so brazen that I assume the access was mostly for routine tech support. KPN clearly needs some help with their IT.
- slver 6y ago> I dunno how newsworthy the "Huawei" part of this is. Actually, it's very fashionable to suspect Huawei of whatever, and ban them from doing whatever.
- kube-system 6y agoEverything has risk, but that doesn't mean that all risk is equal. There are a lot of things to consider when evaluating the risk of any vendor, even domestic vendors.
- 1cvmask 6y ago< KPN says in a response that it has no indications that lines were tapped or that customer data was stolen. So there is no story, but a potential story on a potential (fill in the blanks) < The Capgemini report stated that Huawei staff, both from within KPN buildings and from China, could eavesdrop on unauthorized, uncontrolled, and unlimited KPN mobile numbers. The company gained unauthorized access to the heart of the mobile network from China. How often that happened is not clear because it was not recorded anywhere. So you outsourced some services as many companies do and failed to keep tabs on it, just like many companies do. Forgetting to audit outsourced work is extremely prevalent. < Based on the Capgemini report, KPN decided to refrain from outsourcing the full maintenance of the mobile core network. To this day, the telecom company maintains its mobile core network itself, with the help of Western suppliers. To tackle the risks in the systems of the network, KPN said it was implementing an improvement plan. A report by Capgemini, a leading Western supplier for outsourced personnel to telecommuncations companies. No conflict of interest there.
- lucb1e 6y ago> So there is no story, but a potential story on a potential For what it's worth, GDPR fines have been handed out for missing access restrictions, e.g. for sensitive data not having or checking audit logging and applying 2FA. Though I do agree it makes for a more lousy news story than if it had happened.
- MrsPeaches 6y ago> A report by Capgemini, a leading Western supplier for outsourced personnel to telecommuncations companies. No conflict of interest there. Way to bury the lede! [1] [1] https://en.wikipedia.org/wiki/Capgemini https://en.wikipedia.org/wiki/Capgemini
- jryle70 6y agoWe have another thread actively discusses potential issues with Google's FloC [0], which is only a proposal at this time, no harm done yet. Do you think Huawei/China is less of a potential thread than Google? If not why do you think there is no story here? [0] https://news.ycombinator.com/item?id=26854073 https://news.ycombinator.com/item?id=26854073
- londons_explore 6y agoI "could have" wiretapped KPN when I worked in the networks department. Without any evidence that any wiretaps actually occurred, I'm afraid this is just fearmongering...
- treve 6y agoFor a potential security breach at this level, if access was possible, and no records exists if it happened, you operate under the assumption there was a breach.
- arp242 6y agoWell, yes; but this is missing the context that you don't have a history of doing so. By now there is plenty of evidence that China does engage is large-scale hacking campaigns to steal trade secrets, and before anyone brings on the "but whadabout the US?", the scope is much larger (US is mostly focused on security, not trade secrets) and the US has imperfect but at least some oversight. Was this actually used to gain unauthorized access to information? Maybe, maybe not. It was still bad to grant this access in the first place, and arguably the only reason it didn't lead to unauthorized access is because action was taken. "We let a known serial killer loose but he didn't kill anyone" is still pretty bad. Also that this was kept secret for 12 years doesn't exactly inspire confidence.
- the-dude 6y agoNSA tapped German Chancellery for decades, WikiLeaks claims : https://www.theguardian.com/us-news/2015/jul/08/nsa-tapped-german-chancellery-decades-wikileaks-claims-merkel https://www.theguardian.com/us-news/2015/jul/08/nsa-tapped-g... Supposedly, that did actually happen.
- DaiPlusPlus 6y agoEveryone spies on everyone[1][2][3] - that's why everyone's government buildings all have their own secure-rooms. The diplomatic thing is to not go-public about ones' allies doing it unless you have a reason to embarrass them for something else. [1] https://www.cnn.com/2015/06/25/opinions/france-spy-claims https://www.cnn.com/2015/06/25/opinions/france-spy-claims [2] https://www.politico.com/story/2013/10/marco-rubio-nsa-spying-098840 https://www.politico.com/story/2013/10/marco-rubio-nsa-spyin... [3] https://www.usnews.com/news/best-countries/articles/2018-10-25/khashoggi-crisis-highlights-how-countries-spy-on-each-other https://www.usnews.com/news/best-countries/articles/2018-10-...
- jollybean 6y agoIt did happen. But it's not really news that spy agencies spy. Although maybe a little bit that NSA was spying on Germans, but that's probably not really news either, even for the Germans. But if a private corp. doing contract work for another entity spies - and when the ownership of that corp is tied the government - that's news. The question marks as to whether this was merely 'Huawei as admins have access' or 'Huawei has access and abused it' ... is the high relevant issue that needs to be fully sorted out.
- nyolfen 6y agoi would suggest that german telecoms not contract their mobile network deployment and management to nsa, then
- Cacti 6y agoWhataboutism at its finest.
- aritmo 6y agoThis is getting silly. Huawei is the most prominent Chinese company and because of the economic war, you get such speculative articles. And a few days ago, Cisco was found to have a bug in their routers for small businesses that lead to remote code execution. https://portswigger.net/daily-swig/cisco-router-flaws-left-small-business-networks-open-to-abuse https://portswigger.net/daily-swig/cisco-router-flaws-left-s...
- slver 6y ago- Yesterday: Huawei eavesdropped on a foreign telecom! - Today: Huawei could have eavesdropped on a foreign telecom. - Tomorrow: Huawei didn't eavesdrop on a foreign telecom. Imagine if they did though. Chills. I'm so over this.
- deleted 6y ago[deleted]
- edhelas 6y agoWhy do we need Chinese technologies in Europe again?
- severino 6y agoThis looks like western propaganda to make us think that it's better to just keep the US wiretapping our networks, as always.
- game_the0ry 6y agoAmerican, here. Given that there is no hard proof that Huawei actually spies on their customers and that Huawei critics use the same talking points in the media to criticize Huawei and China, I am starting believe that this is not about China as a threat. That they could be a threat is not the same as the being a threat. Rather, Western leaders no longer have the willingness or belief that we can compete in tech with China (on the contrary, we can and should), so they've given up and threw a tantrum, screaming 'no fair no fair, they steal our IP', which is predictable, given that Western corporate leaders have outsourced all manufacturing to China...dumb. There are real issues to criticize with China, and Huawei is not the worst one.
- someonehere 6y agoDo you even know how businesses are supposed to operate in China if they’re from the outside? My understanding from a security friend is there are all these hurdles and the Chinese government wants access to networks and source code for anything that’s operating within the country. Also, there have been plenty of stories on HN where American businesses are ripped off by China knockoffs and there’s no way to really sue them or stop them in court. China has its claws in everything. Everything that’s based out of China should be considered an entity working for the government. Even Huawei
- ethbr0 6y agoYou also described America, circa-1800s.
- tpmx 6y agoWe're living now, not in the 1800s. That may be historically interesting, but not that much interesting beyond that. It's not about who's "good" and who's "evil", now or then.
- hda2 6y agoI think GP's implied point about copying ideas still stands. Like the US in the 1800s, they're not just making clones. They're making better ones. They're innovating. Taking good ideas and improving them is - and will always be - the fundamental corner stone of human development. That's why "ripping off" more advanced competitors worked out well for the US when they did it, it worked out well for Japan when they did it, it's working out well for China now that they're doing it, and it will work out well for whoever decides to work hard next. Do you know what isn't fundamental to human development? Made-up concepts like intellectual "property" that only serve the stagnant that aim to rent-seek (and not innovate). These concepts are what lulled the US into a false sense of security and allowed China to excel. The reality of the matter is that IP laws are nonsense. They only serve to hold back those it binds. Instead of being upset when other people don't play by your made-up rules, you should work harder and become competitive again. Disclosure: I have no love for China. It is a horrible country with disgustingly abhorrent views. That said, I don't think we should put our collective heads in the sand and avoid addressing the giant elephant thrashing in our room.
- christkv 6y agoI’m more worried about Europe letting the Chinese government buy into crucial infrastructure https://www.google.com/amp/s/energy.economictimes.indiatimes.com/amp/news/renewable/china-three-gorges-enters-spanish-energy-market-with-solar-plants-buy/77625608 https://www.google.com/amp/s/energy.economictimes.indiatimes... How is this even sensible and there is no way the Chinese government will ever let a non Chinese firm control their infrastructure so why is this not stopped. What politicians are making money on this?
- de6u99er 6y agoI'd like to remind everybody of the Snowden revelations. Maybe the real issue is, that US intelligence agencies are not able to force Huawei to add backdoors into their equipment.
- deleted 6y ago[deleted]
- f430 6y agocant wait to see how Huawei apologists will spin this one off
- losvedir 6y agoYou have to assume the network can eavesdrop. Just goes to show the importance of end-to-end encryption.
- justicezyx 6y agoIn China's South Song dynasty, a military leader by the name Yue Fei (岳飞) [1], was sentenced to death by his political enemy Qin Hui (秦桧) [2] on false accusations. What made this event particularly memorable, in addition to the fact that Yue Fei was considered a patriot; was that Qin Hui had blatantly responded to questions of how can you prove your accusations? Qin Hui's reply: Yue Fei, when given, the right power, probably would commit those wrongdoings. This is called 莫须有 [3]. You know why Chinese are not as angry as an American could be on Huawei's situations? Because everyone understand this is a political conflict. For this type of conflicts, only true power and strength can get any answer. Talking is not only futile, it's countereffective. [1] https://en.m.wikipedia.org/wiki/Yue_Fei https://en.m.wikipedia.org/wiki/Yue_Fei [2] https://en.m.wikipedia.org/wiki/Qin_Hui https://en.m.wikipedia.org/wiki/Qin_Hui [3] https://zh.m.wikipedia.org/wiki/%E8%8E%AB%E9%A0%88%E6%9C%89 https://zh.m.wikipedia.org/wiki/%E8%8E%AB%E9%A0%88%E6%9C%89
- swordsmith 6y agoThe difference here is Yue Fei has had a solid track record of being loyal to the emperor. In contrast with Huawei being CCP controlled, having poor track record of intellectual theft, and that CCP having clear conflicts of interest with the countries Huawei is doing business with.
- justicezyx 6y ago> having poor track record of intellectual theft, and that CCP having clear conflicts of interest with the countries Huawei is doing business with. You manage to generate completely nonsensical gibberish in very short sentence: > having poor track record of intellectual theft You are saying CCP did a poor job of stealing IP? Or you are saying CCP had done well in stealing IP? If the latter, where is your evidence? CCP uses market coercion to force IP transfer, that's a well known practice. But where are the state sponsored IP theft? > CCP having clear conflicts of interest with the countries Huawei is doing business with. How so? Obama called for G2 in [1], that's some serious recognition of the common interests between US and China. Right before Trump, you can find overwhelming official documents calling the sino us relationship being a overall positive one. So suddenly, CCP becomes the bad guy because CCP had lots of conflicting interest? And, for all the conflicting interests, other than the unfounded cyber security nonsense, what are the interests that huawei had a stake in? [1] https://en.m.wikipedia.org/wiki/Group_of_Two https://en.m.wikipedia.org/wiki/Group_of_Two
- my-hn-account 6y agoSomewhat related to this and, in particular, the comment section: how many of the comments on HN are from cn bots / govt paid trolls? Would be curious to know if there's been research into where comments come from broadly on HN.
- dang 6y ago"Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
- floatboth 6y agoWhy does anyone still care about eavesdropping on mobile networks? How come it is still not 100% universally acknowledged that the network is hostile and carriers should not be treated as anything but a dumb pipe for IP over which you have your own security on the application layer? Maybe carriers should just straight up declare regular phone calls as non-private and start publishing all recordings of literally everyone's calls ever straight to their website. Seems like we need that kind of nuclear option to finally destroy the remaining false sense of security in the plain old telephone system.
- Chiba-City 6y agoAmericans are lying whiny bitches. How do know when Americans are lying? They are opening their bitchy mouths. Ignore whining bitchy lying Americans. I worked for State Dept. I even wrote some paychecks for some filthy paid DC liars. Flag waivers are noisy sissies. Ignore them.
- alfiedotwtf 6y agoMaybe we should stop using infrastructure that allowed eavsdropping in the first place, we'd be fine? Then again, if everyone used e2e security, our spies wouldn't be able to spy :shrug:
- russli1993 6y agoProtocols like TLS and encryption is there because any physical network is untrusted. If you have sensitive data, use e2e encryption. And any sensitive data is most likely already using such scheme. Also today's routers and physical network has insane bandwidth. 100 to 400 Gbps networks, billions of packets per second, millions of flows. To sniff the physical network and gather specific useful data, such as a personal contact, some files, or a message, especially from encrypted steams, is a huge endeavor. you would need a large dedicated ASIC with Gigabytes of memory, storage and large power budget. And you need a team of people to work on the software and hardware of such system. And there is no way you can hide such endeavor. Huawei has foreign people in key executive position and in multiple countries. I don't think its possible for the company to keep people quiet on things if these people feel its wrong. If Huawei's attempt to sale networking gear is a secret campaign to sniff and spy on world's data, there is no way these people would not find signs of it and stayed quiet. This whole scrutiny on Huawei has been a long time, multiple years. If foreign employees saw anything internally they would have whistle-blown by now. Honestly, if you want to know what Huawei is really up to, you could get some high ranking foreign employees to check up on executive meetings and documents. Huawei also have customers and partners working closely with each other. They also allow third party's review their source code and products. Many times partners are saying there is no evidence of security issues. Frankly, if a bad actor wants to get access to secret data, its much more useful to hack OS, servers and databases.
- crote 6y agoI'm seeing a lot of misinformation here. The original source[0] is De Volkskrant, which is a _very_ reputable independent newspaper. It does not do sensation pieces. Key points, from top to bottom: - When a daughter company of KPN was looking for a new customer management system, Huawei's price was only 25% that of the competition. This was so low that employees initially thought it was a mistake. - In 2009, KPN wants to reduce the cost of managing the mobile network by outsourcing ot to Huawei. It asked Capgemini to analyze the risks, which is the now-leaked report. - The results are alarming enough that they are declared secret. Literally, "if those results were to become public, there will be a mass exodus among companies and governmental organisations to other providers. The existance of KPN as a whole would be seriously threatened". - The core network is managed by Chinese citizans from a dedicated room in The Hague. - Access from China is possible, but strictly limited. It requires explicit permission from the KPN NOC, who are supposed to provide temporary access. - Unauthorized and uncontrolled access from China has been detected after 28 october 2009. - The KPN network has a wiretapping system. A record of phone numbers being tapped is kept on a secure server. This server is managed by Huawei, who refuse to provide information about who has access to it and how it is secured. After a lot of pressure, they discover that tyis security is extremely weak and that Huawei has full control over it - meaning that Huawei has full knowledge of all numbers being wiretapped by the police and intelligence agencies. - The six Chinese employees use a tool which allows them to listen to any phone call on the network. This is in direct violation of the law and it violates the agreement between Huawei and KPN. They can use this tool without anyone at KPN being made aware of it. - Huawei is supposed to have access to second-long snippets for quality assurance. In practice, they had full access to all phonecalls. KPN had no way of knowing what they were doing. - The tool used has no record keeping and the interface is in Chinese, meaning nobody is able to understand what they are doing. So yeah, yikes. This is way beyond admins having admin access. This is Huawei having unlimited access far beyond what they are supposed to, and evidence of this access being actively misused. It's not just the regular propaganda. [0]: https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle-gesprekken-van-mobiele-kpn-klanten-afluisteren-inclusief-die-van-de-premier~bd1aece1/ https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle...
- swordsmith 6y agoHopefully this get upvoted to the top. Answers a lot of speculations and questions in the thread.
- pabs3 6y agoThis reminded me of "How Tech Loses Out at Companies, Countries and Continents" by Bert Hubert of PowerDNS. https://berthub.eu/articles/posts/how-tech-loses-out/ https://berthub.eu/articles/posts/how-tech-loses-out/ https://news.ycombinator.com/item?id=26849669 https://news.ycombinator.com/item?id=26849669 KPN should be administering their own equipment.
- est 6y agoJust a thought experiment, for every Huawei-bashing news out there, there would be an equivalent Cisco-bashing or Ericsson-bashing article in China.
- greatgib 6y agoEven if you read with good intention, and consider that the backdoor/workaround was not used, here you have the proof that Huawei is caught lying publicly. See: https://www.c4isrnet.com/battlefield-tech/it-networks/5g/2020/02/12/white-house-claims-huawei-equipment-has-backdoor-for-spying/ https://www.c4isrnet.com/battlefield-tech/it-networks/5g/202... <<Huawei denies that claim and issued a statement Wednesday saying the company "has never and will never covertly access telecom networks, nor do we have the capability to do so.">> The report on KPN proves that they have the "capability" and they they know it!