3 ms·

The UK did a good job writing this up in a security report. It's not just a baseless attack, Huawei has poor software engineering practices. https://www.gov.uk

by kyrra 3y ago

The UK did a good job writing this up in a security report. It's not just a baseless attack, Huawei has poor software engineering practices. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2020 https://www.gov.uk/government/publications/huawei-cyber-secu...

londons_explore 3y ago
Sure - but security isn't the major focus for many buyers. As long as it routes data from A to B and can keep the population connected, many governments and companies are happy to take the increased spy-risk in return for lower costs. Lets be honest, the future is end-2-end encryption and a dumb network, and then the security of the network becomes far less important.
- sodality2 3y ago
  Never overlook the ex NSA chief Hayden’s timeless remark: “We kill people based on metadata”. Owning or controlling these dumb pipes still means wielding enormous amounts of power, political or military.
- kube-system 3y ago
  There's not a network out there that won't work smoothly without support. Hardware breaks, software breaks, vulnerabilities are found. When sanctions ratchet up or bombs start falling, which support contract is still honored?
  - blitzar 3y ago
    > When sanctions ratchet up or bombs start falling, which support contract is still honored? The contract with the company owned by the right honourable member of the house of lords of course. Not only will they fulfill the contract at the highest possible price, but they will fulfill it with the cheapest, least compliant product possible and worry about being sued later ...
vlovich123 3y ago
As someone who’s seen the code for Qualcomm’s cellular modem (granted in 2009) and worked with their engineers, it would be impressive if it was tangible worse. I think we should be clear about the strategic threat of having a foreign company own telecommunication infrastructure, but that’s technically true for US allies as well. The main distinction is that China is not an ally. Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well (& doesn’t touch the question of who owns the infrastructure).
- girvo 3y ago
  As someone who works with cell modems from basically all major and a couple minor manufacturers (mostly NB-IoT and 2G but not just) — they’re all bug ridden crap lol
- thaumasiotes 3y ago
  > Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well It can't even theoretically accomplish much given easy naturalization.
- mderazon 3y ago
  Honest question, if all communication is E2E encrypted (it's not, but let's assume), what's the risk of foreign countries controlling the infra ?
  - kredd 3y ago
    At the very least, the ability to bring down the public comm channels is pretty risky.
  - myself248 3y ago
    1: Simply bringing it down. If tensions escalate and someone has the ability to cripple their adversary's communications, obviously it's a string they can only pull once, but knowing they can pull it when the time is right, is a big deal. 2: E2EE doesn't insulate you from baseband vulnerabilities. You can think of a modern phone as having two processors, though in practice it's many more, think of the Application Processor (AP) and the Baseband (BB). The AP is basically the CPU that user code runs on. The baseband (so called because it deals with the radio signals once they've been downconverted from their broadband modulations) is sort of like a NIC, it provides connectivity to the main CPU. Now, if you're familiar with server NICs, imagine a server BMC that has god-level access to the hardware on which the application runs. That's roughly how the baseband is situated in the phone. Obviously you'd only connect such a BMC to an internal management network that's only accessible to trusted parties, right? Not to one that your adversary controls? YEahhhhh. If the adversary controls the cellular network and talks directly to the BB/BMC, it doesn't matter how secure the AP/CPU is, it's game over.
croes 3y ago
> It's not just a baseless attack, Huawei has poor software engineering practices. Incompetence is not malice or do you accuse Cisco of the same thing?

by kyrra 3y ago

londons_explore 3y ago

Sure - but security isn't the major focus for many buyers. As long as it routes data from A to B and can keep the population connected, many governments and companies are happy to take the increased spy-risk in return for lower costs. Lets be honest, the future is end-2-end encryption and a dumb network, and then the security of the network becomes far less important.

sodality2 3y ago
Never overlook the ex NSA chief Hayden’s timeless remark: “We kill people based on metadata”. Owning or controlling these dumb pipes still means wielding enormous amounts of power, political or military.
kube-system 3y ago
There's not a network out there that won't work smoothly without support. Hardware breaks, software breaks, vulnerabilities are found. When sanctions ratchet up or bombs start falling, which support contract is still honored?
- blitzar 3y ago
  > When sanctions ratchet up or bombs start falling, which support contract is still honored? The contract with the company owned by the right honourable member of the house of lords of course. Not only will they fulfill the contract at the highest possible price, but they will fulfill it with the cheapest, least compliant product possible and worry about being sued later ...

vlovich123 3y ago

As someone who’s seen the code for Qualcomm’s cellular modem (granted in 2009) and worked with their engineers, it would be impressive if it was tangible worse. I think we should be clear about the strategic threat of having a foreign company own telecommunication infrastructure, but that’s technically true for US allies as well. The main distinction is that China is not an ally. Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well (& doesn’t touch the question of who owns the infrastructure).

girvo 3y ago
As someone who works with cell modems from basically all major and a couple minor manufacturers (mostly NB-IoT and 2G but not just) — they’re all bug ridden crap lol
thaumasiotes 3y ago
> Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well It can't even theoretically accomplish much given easy naturalization.
mderazon 3y ago
Honest question, if all communication is E2E encrypted (it's not, but let's assume), what's the risk of foreign countries controlling the infra ?
- kredd 3y ago
  At the very least, the ability to bring down the public comm channels is pretty risky.
- myself248 3y ago
  1: Simply bringing it down. If tensions escalate and someone has the ability to cripple their adversary's communications, obviously it's a string they can only pull once, but knowing they can pull it when the time is right, is a big deal. 2: E2EE doesn't insulate you from baseband vulnerabilities. You can think of a modern phone as having two processors, though in practice it's many more, think of the Application Processor (AP) and the Baseband (BB). The AP is basically the CPU that user code runs on. The baseband (so called because it deals with the radio signals once they've been downconverted from their broadband modulations) is sort of like a NIC, it provides connectivity to the main CPU. Now, if you're familiar with server NICs, imagine a server BMC that has god-level access to the hardware on which the application runs. That's roughly how the baseband is situated in the phone. Obviously you'd only connect such a BMC to an internal management network that's only accessible to trusted parties, right? Not to one that your adversary controls? YEahhhhh. If the adversary controls the cellular network and talks directly to the BB/BMC, it doesn't matter how secure the AP/CPU is, it's game over.

croes 3y ago

> It's not just a baseless attack, Huawei has poor software engineering practices. Incompetence is not malice or do you accuse Cisco of the same thing?