9 ms·

The author admits to having zero experience with carrier-level infrastructure, but their suspicions are essentially correct. I actually have done a fair bit of

The author admits to having zero experience with carrier-level infrastructure, but their suspicions are essentially correct. I actually have done a fair bit of 4G and 5G specific pentesting and security research for a number of major carriers. While it varies between carriers and between product vendors, it's still an absolute horror show. Until very recently, the security was entirely achieved through obscurity. The 4G and 5G standards have started to address this, but there are still gaps big enough to be deeply concerning. I don't think it's overly hyperbolic to assume that any moderately sophisticated threat actor who wants a beachhead on a carrier can achieve it. I've demonstrated this multiple times, professionally. IMHO the hardware vendors from a certain East Asian state have such poorly written software stacks, that they could almost be classified as APTs - security is non-existent. There are valid reasons Western countries have banned them. Western hardware vendors have significantly more mature software, but are still many years behind what most of us would consider modern security best practices.

matthewdgreen 2y ago
A few years back the U.K. tried a political experiment in which it purchased Huawei equipment and also set up a special government/Huawei lab where they could analyze the source code to ensure it was safe to use. GCHQ found that the code quality made it unreviewable, and that they could not even ensure that the source code provided actually ran on the equipment (because Huawei had direct update capability.) I believe that equipment has been banned since 2020. https://www.washingtonpost.com/world/national-security/britains-spy-agency-delivers-a-scathing-assessment-of-the-security-risks-posed-by-huawei-to-the-countrys-telecom-networks/2019/03/27/ab16d7d2-50fd-11e9-8d28-f5149e5a2fda_story.html https://www.washingtonpost.com/world/national-security/brita...
- 0xbadc0de5 2y ago
  Correct. Both the US and Canada also did similar investigations and came to similar conclusions.
  - gmueckl 2y ago
    The ban always seemed weird to me. Not even a shred of a technical argument made it into public discourse when this was an issue. Governments just said "trust us" without giving any examples. This thread is the first time I read a hint at why that decision was made. Still, I don't know how much of this was a political stunt vs. grounded in reality. Maybe I am too jaded/cynical?
    - dralley 2y ago
      I mean, it obviously did make it to the public because that WP article was written in 2019, and I remember hearing some of those details (that it wasn't so much "the code has backdoors" as "the code is so shit, it doesn't even matter if there's a backdoor in there deliberately") back then. By the time any highly-technical topic makes it to the mainstream discourse, the details tend to get stripped out simply because none of the 70 year olds watching CNN or Fox appreciate the difference and none of the anchors or panelists know what they're talking about either.
      - some_furry 2y ago
        A song parody comes to mind (HN strips the music emoji) We built this city We built this city We built this city on broken code
    - 0xbadc0de5 2y ago
      When it comes to government, it's hard to be too cynical. But in this particular case, it definitely was not a political stunt. There are a number of reasons for the limited disclosure - including NDA's signed by the governments and labs with the vendors in order to gain access to their intellectual property at a level sufficient to conduct the depth of analysis required.
    - heraldgeezer 2y ago
      Government has a mandate. That's how it can function. They have evidence, why reveal it to the public (and thus china)? I grew out of my Ron Paul phase at 15. You trust China over your own government? Move then.
- FreebasingLLMs 2y ago
  I've been personally involved in evaluating the security of a certain vendor starting with the letter H. Let us just say they are "less than honest". I had pcaps of their bullshit trying to reach out to random C2 shit on the internet, which garnered a response of "there must be a mistake, that is not our software". Let China sell their telecom bullshit to all the poor people of the world - they will learn hard lessons.
  - codedokode 2y ago
    Does it send more data to more endpoints than US-made Windows OS (I wiresharked it in a VM so I know)?
    - FreebasingLLMs 2y ago
      I'm not comparing it to an OS. I'm comparing it to other competitors in the particular solution space. To answer your question: no one else's equipment behaved in that manner.
      - smolder 2y ago
        > To answer your question Maybe I'm being pedantic, but that doesn't answer their question.
        FreebasingLLMs 2y ago
        [dead]
    - jeroenhd 2y ago
      That question doesn't make any sense. Windows isn't used to run core network infrastructure on that level. These devices should never ever call out to remote servers unless explicitly configured to do so, and even then that should be a select list of customer defined servers. Obviously Windows will send more telemetry if telemetry it sent at all, because it's doing more stuff. Then again, Window's telemetry is nothing compared to what Huawei phones will send to the mothership, and Huawei phones are nothing compared to an Amazon Alexa. Not that any of that is relevant.
- Scoundreller 2y ago
  That kind of analysis needs a control. But I guess it’s like you said: a political experiment.
  - Etheryte 2y ago
    Does it really need a control when many countries across the globe have independently tried it out and reached the same conclusion? I would say the results are pretty clear.
    - kbolino 2y ago
      The purpose of the control would be to establish whether the competition is actually any better.
      - tristor 2y ago
        That control already exists because similar levels of audits have already happened on the competition. I'm not saying the competition is a shining example of quality, it definitely isn't, but it meets a bar of some set of basic security compliance standards.
      - matthewdgreen 2y ago
        The main purpose of this system was not to judge code quality (although that's a very useful side effect!) The goal was to convince politicians that they could allow the installation of cheaper telecom hardware made by a geopolitical rival, yet also protect themselves from espionage and deliberate sabotage. Now personally I would say that this is a crazy idea from the jump, given the usual asymmetry between attackers and defenders. But even if you grant that it's possible, it requires that you begin with extremely high standards of code quality and verifiability. Those were apparently not present.
        thfuran 2y ago
        But if they're no worse than the alternative, there's no point in spending the extra money.
- urban_winter 2y ago
  The media coverage at the time (which I followed closely because I worked in this space) indicated that the UK was under a great deal of pressure from the US to ban Huawei. The US was allegedly concerned that the use of Huawei equipment would allow US/UK shared intelligence to be eavesdropped by the CCP. The US pressure was widely viewed in the UK as having an economic purpose disguised as security. A quick search found: https://www.euractiv.com/section/politics/short_news/uk-banned-huawei-because-us-told-us-to-former-minister/ https://www.euractiv.com/section/politics/short_news/uk-bann...
  - gadders 2y ago
    >> The US pressure was widely viewed in the UK as having an economic purpose disguised as security. I live in the UK. This may have been part of it, but to think that a communist dictatorship that (to pick a random example) harvests organs from political opponents is above backdooring their own kit is beyond naïve.
- gnfargbl 2y ago
  You're thinking of HCSEC. In the majority of their reports they repeatedly complained that they couldn't even get binary equivalence with Huawei's deployed builds (which clearly obviates the value of any code review) but in the most recent available report from 2021 [1], they do report that Huawei had finally achieved that binary equivalence for a core product set. The government chose to stop publishing HCSEC reports after 2021. I'm unable to work out whether HCSEC itself is still operating or not. [1] https://assets.publishing.service.gov.uk/media/60f6b6be8fa8f50c7a1b9ffd/2021_HCSEC_OB_REPORT_FINAL__1_.pdfhttps://assets.publishing.service.gov.uk/media/60f6b6be8fa8f50c7a1b9ffd/2021_HCSEC_OB_REPORT_FINAL__1_.pdf https://assets.publishing.service.gov.uk/media/60f6b6be8fa8f...
ghostpepper 2y ago
How does a regular hacker get their hands on this kind of equipment to do research?
- 0xbadc0de5 2y ago
  eBay, Alibaba, various grey-market sellers. There's no shortage of availability if you know what to look for.
- deleted 2y ago
  [deleted]
markus_zhang 2y ago
Just curious is there write ups on certain devices? Would love to buy one from Ali express and look into this. Is this a good starting point? https://vulners.com/search/types/huawei https://vulners.com/search/types/huawei
hulitu 2y ago
> IMHO the hardware vendors from a certain East Asian state have such poorly written software stacks, that they could almost be classified as APTs - security is non-existent. Thank god we have the hardware and software vendors from a certain north american state, who take security very seroisly. Oh, wait ... /s
- shakna 2y ago
  At least those can currently pass industry level audits.
  - mschuster91 2y ago
    Given that Cisco has RCEs and hardcoded credential CVEs at least once every half year or so, the question does arise if our current level of audits is even remotely sufficient. And it's not Cisco alone - any major vendor of VPN or firewall or general network gear suffers from the same problem.
    - Veserv 2y ago
      They are not. Cisco and literally every other major commercial IT vendor has software that can only be considered a pile of trash that is grossly and criminally inadequate against commonplace threats and attacks. But imagine how bad your software has to be to not even be good enough to qualify as a pile of trash. Do not let terrible be the friend of bad.

matthewdgreen 2y ago

A few years back the U.K. tried a political experiment in which it purchased Huawei equipment and also set up a special government/Huawei lab where they could analyze the source code to ensure it was safe to use. GCHQ found that the code quality made it unreviewable, and that they could not even ensure that the source code provided actually ran on the equipment (because Huawei had direct update capability.) I believe that equipment has been banned since 2020. https://www.washingtonpost.com/world/national-security/britains-spy-agency-delivers-a-scathing-assessment-of-the-security-risks-posed-by-huawei-to-the-countrys-telecom-networks/2019/03/27/ab16d7d2-50fd-11e9-8d28-f5149e5a2fda_story.html https://www.washingtonpost.com/world/national-security/brita...

0xbadc0de5 2y ago
Correct. Both the US and Canada also did similar investigations and came to similar conclusions.
- gmueckl 2y ago
  The ban always seemed weird to me. Not even a shred of a technical argument made it into public discourse when this was an issue. Governments just said "trust us" without giving any examples. This thread is the first time I read a hint at why that decision was made. Still, I don't know how much of this was a political stunt vs. grounded in reality. Maybe I am too jaded/cynical?
  - dralley 2y ago
    I mean, it obviously did make it to the public because that WP article was written in 2019, and I remember hearing some of those details (that it wasn't so much "the code has backdoors" as "the code is so shit, it doesn't even matter if there's a backdoor in there deliberately") back then. By the time any highly-technical topic makes it to the mainstream discourse, the details tend to get stripped out simply because none of the 70 year olds watching CNN or Fox appreciate the difference and none of the anchors or panelists know what they're talking about either.
    - some_furry 2y ago
      A song parody comes to mind (HN strips the music emoji) We built this city We built this city We built this city on broken code
  - 0xbadc0de5 2y ago
    When it comes to government, it's hard to be too cynical. But in this particular case, it definitely was not a political stunt. There are a number of reasons for the limited disclosure - including NDA's signed by the governments and labs with the vendors in order to gain access to their intellectual property at a level sufficient to conduct the depth of analysis required.
  - heraldgeezer 2y ago
    Government has a mandate. That's how it can function. They have evidence, why reveal it to the public (and thus china)? I grew out of my Ron Paul phase at 15. You trust China over your own government? Move then.
FreebasingLLMs 2y ago
I've been personally involved in evaluating the security of a certain vendor starting with the letter H. Let us just say they are "less than honest". I had pcaps of their bullshit trying to reach out to random C2 shit on the internet, which garnered a response of "there must be a mistake, that is not our software". Let China sell their telecom bullshit to all the poor people of the world - they will learn hard lessons.
- codedokode 2y ago
  Does it send more data to more endpoints than US-made Windows OS (I wiresharked it in a VM so I know)?
  - FreebasingLLMs 2y ago
    I'm not comparing it to an OS. I'm comparing it to other competitors in the particular solution space. To answer your question: no one else's equipment behaved in that manner.
    - smolder 2y ago
      > To answer your question Maybe I'm being pedantic, but that doesn't answer their question.
      - FreebasingLLMs 2y ago
        [dead]
  - jeroenhd 2y ago
    That question doesn't make any sense. Windows isn't used to run core network infrastructure on that level. These devices should never ever call out to remote servers unless explicitly configured to do so, and even then that should be a select list of customer defined servers. Obviously Windows will send more telemetry if telemetry it sent at all, because it's doing more stuff. Then again, Window's telemetry is nothing compared to what Huawei phones will send to the mothership, and Huawei phones are nothing compared to an Amazon Alexa. Not that any of that is relevant.
Scoundreller 2y ago
That kind of analysis needs a control. But I guess it’s like you said: a political experiment.
- Etheryte 2y ago
  Does it really need a control when many countries across the globe have independently tried it out and reached the same conclusion? I would say the results are pretty clear.
  - kbolino 2y ago
    The purpose of the control would be to establish whether the competition is actually any better.
    - tristor 2y ago
      That control already exists because similar levels of audits have already happened on the competition. I'm not saying the competition is a shining example of quality, it definitely isn't, but it meets a bar of some set of basic security compliance standards.
    - matthewdgreen 2y ago
      The main purpose of this system was not to judge code quality (although that's a very useful side effect!) The goal was to convince politicians that they could allow the installation of cheaper telecom hardware made by a geopolitical rival, yet also protect themselves from espionage and deliberate sabotage. Now personally I would say that this is a crazy idea from the jump, given the usual asymmetry between attackers and defenders. But even if you grant that it's possible, it requires that you begin with extremely high standards of code quality and verifiability. Those were apparently not present.
      - thfuran 2y ago
        But if they're no worse than the alternative, there's no point in spending the extra money.
urban_winter 2y ago
The media coverage at the time (which I followed closely because I worked in this space) indicated that the UK was under a great deal of pressure from the US to ban Huawei. The US was allegedly concerned that the use of Huawei equipment would allow US/UK shared intelligence to be eavesdropped by the CCP. The US pressure was widely viewed in the UK as having an economic purpose disguised as security. A quick search found: https://www.euractiv.com/section/politics/short_news/uk-banned-huawei-because-us-told-us-to-former-minister/ https://www.euractiv.com/section/politics/short_news/uk-bann...
- gadders 2y ago
  >> The US pressure was widely viewed in the UK as having an economic purpose disguised as security. I live in the UK. This may have been part of it, but to think that a communist dictatorship that (to pick a random example) harvests organs from political opponents is above backdooring their own kit is beyond naïve.
gnfargbl 2y ago
You're thinking of HCSEC. In the majority of their reports they repeatedly complained that they couldn't even get binary equivalence with Huawei's deployed builds (which clearly obviates the value of any code review) but in the most recent available report from 2021 [1], they do report that Huawei had finally achieved that binary equivalence for a core product set. The government chose to stop publishing HCSEC reports after 2021. I'm unable to work out whether HCSEC itself is still operating or not. [1] https://assets.publishing.service.gov.uk/media/60f6b6be8fa8f50c7a1b9ffd/2021_HCSEC_OB_REPORT_FINAL__1_.pdfhttps://assets.publishing.service.gov.uk/media/60f6b6be8fa8f50c7a1b9ffd/2021_HCSEC_OB_REPORT_FINAL__1_.pdf https://assets.publishing.service.gov.uk/media/60f6b6be8fa8f...

ghostpepper 2y ago

How does a regular hacker get their hands on this kind of equipment to do research?

0xbadc0de5 2y ago
eBay, Alibaba, various grey-market sellers. There's no shortage of availability if you know what to look for.
deleted 2y ago
[deleted]

markus_zhang 2y ago

Just curious is there write ups on certain devices? Would love to buy one from Ali express and look into this. Is this a good starting point? https://vulners.com/search/types/huawei https://vulners.com/search/types/huawei

hulitu 2y ago

> IMHO the hardware vendors from a certain East Asian state have such poorly written software stacks, that they could almost be classified as APTs - security is non-existent. Thank god we have the hardware and software vendors from a certain north american state, who take security very seroisly. Oh, wait ... /s

shakna 2y ago
At least those can currently pass industry level audits.
- mschuster91 2y ago
  Given that Cisco has RCEs and hardcoded credential CVEs at least once every half year or so, the question does arise if our current level of audits is even remotely sufficient. And it's not Cisco alone - any major vendor of VPN or firewall or general network gear suffers from the same problem.
  - Veserv 2y ago
    They are not. Cisco and literally every other major commercial IT vendor has software that can only be considered a pile of trash that is grossly and criminally inadequate against commonplace threats and attacks. But imagine how bad your software has to be to not even be good enough to qualify as a pile of trash. Do not let terrible be the friend of bad.