5 ms·

I don't know exactly the US story, but the UK has forced operators to remove "5G" huawei equipment. This becomes pretty farcical when you realise they are still

I don't know exactly the US story, but the UK has forced operators to remove "5G" huawei equipment. This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together), and they are used in nearly every single fibre to the cabinet deployment (and at least some of the newer FTTH). It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment, OR banning future installs, but at getting them to trash just 5G equipment is a political stunt, IMO.

ixfo 5y ago
Openreach in the UK are deploying 0% new Huawei for FTTP and have basically stopped using them for FTTC because of the 30% rule. EE still use Huawei for new 5G deployments - but only in the access leg and for no more than 30% of their new builds. They've already forced removal from core/security-critical roles, but that takes serious time to actually implement.
nradov 5y ago
Carriers will begin decommissioning their 4G networks in the next few years to cut operating costs and free up spectrum.
- martinald 5y ago
  They really won't. 2G is going very strong, and 3G is maybe getting shut down in next couple of years. 4G will be the primary access technology for at least 10 years and probably longer. If this is such a big security problem then surely 10+ years is an unacceptable amount of time to have potentially compromised equipment in the supply chain?
  - teruakohatu 5y ago
    Which country are you in? Here in New Zealand only one network still has 2G and they are threatening to shut it down. 3G won't be far behind.
inkyoto 5y ago
> This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together) No, it is not a purely political farce. There is a fundamental architectural difference (that amounts to a technical one as well) that translates into a reason why 4G deployments are more «secure» as opposed to 5G deployments. Unlike in 4G, where the data that is tunneled through the core network is always encrypted, 5G allows for encrypted tunnels to get terminated near 5G base stations to enable the mobile edge computing amongst other reasons. Server equipment that is deployed at the 5G base station site then can take an advantage of the substantially decreased latency for latency sensitive workloads (ehrm, 5G enabled Doom/Quake, anyone?). AWS have a product, Wavelength, that does precisely that, and I am pretty confident there are other telcos/products doing the same. 4G, on the other hand, never terminates encrypted tunnels and passes them through the core network unchanged. Therefore, retaining the potentially compromised 4G core network equipment alongside the 5G one is somewhat «safer» – in the sense that at least the unencrypted email etc traffic won't leak out. Especially considering that 4G is on the way out (medium to long term), hence there is no need to rush and start pouring massive amounts of money into replacing/decommissioning the 4G equipment now, although it might speed up the demise of 4G in the UK and other countries.
- martinald 5y ago
  But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? Also, nearly everything is HTTPS these days so I still don't see a massive attack vector here (at least one that wouldn't be spotted immediately like MITMing TLS connections). I think the much greater "threat" rather than messing round with traffic itself is just to shut down masses of the towers and core networks remotely. In that case, switching off 4G would be way worse as (at least in the UK) all networks doing 5G require a 4G signal as well to bond against. So having separate 5G equipment wouldn't help one iota if the 4G stuff is down.
  - inkyoto 5y ago
    > But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? The major attack vector for the compromised 4G equipment is the remote deactivation (or a wipeout or both) of it by an adversary. Breaking the encryption on the fly for volumes of traffic traversing mobile core networks is still technologically challenging. Hence the plain text communication can still be considered somewhat protected.
varispeed 5y ago
> It's clearly political. Is that an euphemism for corruption? It's almost certain hands were greased. That however seem to have been aligned with many interests, also of those who are supposed to protect us, but nevertheless it's worrying that there is no investigation of any kind.
- martinald 5y ago
  No. The 5G part does not make any sense, but I think politicians think that 5G is some all seeing dancing future (it isn't, it's a marginal improvement over 4G) that must be secured at all costs.
nonethewiser 5y ago
>It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment You vastly overestimate the competence of government.
- GekkePrutser 5y ago
  Well not just that. If the government mandates all Huawei equipment to be thrown out, the providers will go to court and the government will most likely end up paying for it. In the middle of a global pandemic and resulting supply chain crisis, a rapidly intensifying fight against climate change and other expensive issues it's probably not a great idea to throw more billions away. Of course it could be a risk but it can be mitigated in other ways like multiple layers of encryption. That's never a bad idea anyway.

ixfo 5y ago

Openreach in the UK are deploying 0% new Huawei for FTTP and have basically stopped using them for FTTC because of the 30% rule. EE still use Huawei for new 5G deployments - but only in the access leg and for no more than 30% of their new builds. They've already forced removal from core/security-critical roles, but that takes serious time to actually implement.

nradov 5y ago

Carriers will begin decommissioning their 4G networks in the next few years to cut operating costs and free up spectrum.

martinald 5y ago
They really won't. 2G is going very strong, and 3G is maybe getting shut down in next couple of years. 4G will be the primary access technology for at least 10 years and probably longer. If this is such a big security problem then surely 10+ years is an unacceptable amount of time to have potentially compromised equipment in the supply chain?
- teruakohatu 5y ago
  Which country are you in? Here in New Zealand only one network still has 2G and they are threatening to shut it down. 3G won't be far behind.

inkyoto 5y ago

> This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together) No, it is not a purely political farce. There is a fundamental architectural difference (that amounts to a technical one as well) that translates into a reason why 4G deployments are more «secure» as opposed to 5G deployments. Unlike in 4G, where the data that is tunneled through the core network is always encrypted, 5G allows for encrypted tunnels to get terminated near 5G base stations to enable the mobile edge computing amongst other reasons. Server equipment that is deployed at the 5G base station site then can take an advantage of the substantially decreased latency for latency sensitive workloads (ehrm, 5G enabled Doom/Quake, anyone?). AWS have a product, Wavelength, that does precisely that, and I am pretty confident there are other telcos/products doing the same. 4G, on the other hand, never terminates encrypted tunnels and passes them through the core network unchanged. Therefore, retaining the potentially compromised 4G core network equipment alongside the 5G one is somewhat «safer» – in the sense that at least the unencrypted email etc traffic won't leak out. Especially considering that 4G is on the way out (medium to long term), hence there is no need to rush and start pouring massive amounts of money into replacing/decommissioning the 4G equipment now, although it might speed up the demise of 4G in the UK and other countries.

martinald 5y ago
But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? Also, nearly everything is HTTPS these days so I still don't see a massive attack vector here (at least one that wouldn't be spotted immediately like MITMing TLS connections). I think the much greater "threat" rather than messing round with traffic itself is just to shut down masses of the towers and core networks remotely. In that case, switching off 4G would be way worse as (at least in the UK) all networks doing 5G require a 4G signal as well to bond against. So having separate 5G equipment wouldn't help one iota if the 4G stuff is down.
- inkyoto 5y ago
  > But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? The major attack vector for the compromised 4G equipment is the remote deactivation (or a wipeout or both) of it by an adversary. Breaking the encryption on the fly for volumes of traffic traversing mobile core networks is still technologically challenging. Hence the plain text communication can still be considered somewhat protected.

varispeed 5y ago

> It's clearly political. Is that an euphemism for corruption? It's almost certain hands were greased. That however seem to have been aligned with many interests, also of those who are supposed to protect us, but nevertheless it's worrying that there is no investigation of any kind.

martinald 5y ago
No. The 5G part does not make any sense, but I think politicians think that 5G is some all seeing dancing future (it isn't, it's a marginal improvement over 4G) that must be secured at all costs.

nonethewiser 5y ago

>It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment You vastly overestimate the competence of government.

GekkePrutser 5y ago
Well not just that. If the government mandates all Huawei equipment to be thrown out, the providers will go to court and the government will most likely end up paying for it. In the middle of a global pandemic and resulting supply chain crisis, a rapidly intensifying fight against climate change and other expensive issues it's probably not a great idea to throw more billions away. Of course it could be a risk but it can be mitigated in other ways like multiple layers of encryption. That's never a bad idea anyway.