Slashdot Mirror
Security Expert: Huawei Routers Riddled With Vulnerabilities
sabri writes "Cnet reports that German security expert Felix Lindner has unearthed several vulnerabilities in Huawei's carrier grade routers. These vulnerabilities could potentially enable attackers, or the Chinese government, to snoop on users' traffic and/or perform a man-in-the-middle attack. While these routers are mostly in use in Asia, Africa and the Middle East, they are increasingly being used in other parts of the world as well, because of their dirt-cheap pricing. Disclaimer: I work for one of their competitors."
Via the H, you can check out the presentation slides. Yesterday Huawei issued a statement 'We are aware of the media reports on security vulnerabilities in some small Huawei routers and are verifying these claims...'
I've always hated Huawei because their products seem inferior. This just reinforces that. I'm not surprised at all.
You get what you pay for. Who would trust this craptastic bargain basement shit anyway? When something is being sold for a much lower price then competing products, there is a reason for it.
could potentially enable attackers, or the Chinese government, to snoop on users' traffic
If they exist they would allow ANYBODY to snoop on users' traffic. What is this, SlashFox? How about "could potentially enable attackers, or PRESIDENT BARACK HUSSEIN OBAMA to snoop on users' traffic!." or "could potentially enable attackers, or homesexuals, to snoop on users' traffic".
So these Chinese Olympians are the rule rather than the exception? Crazytown!
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
It be because it is.
Cisco, Juniper, HP, Nortel, Ericsson are all proprietary black boxes as well. Perhaps they all have vulnerabilities like this? We will never know but perhaps our governments do?
Unfortunately, it's a niche and there are no open source carrier grade router platforms :(
The CIA did it in order to enable them to snoop on Chinese traffic!
I used a NE40 for a couple of weeks to determine if it was worth buying instead of Juniper for our network. I decided against it but I have to admit for the price it
did pretty much everything we would want it to do. The hardware build quality left a lot to be desired and it was only 32 bit CPU so the memory would never be
able to be upgraded past 4 gigs so we passed.
But to hack a few small SOHO routers and then make the claim carrier grade gear is also just as bad without ever touching or using it? I think that is pretty sad.
Does one find a bug in some crappy apache module and then make the claim apache itself is also poor? No. So why here?
I do use Huawei sonet gear though. Great bang for the buck, reliable, and just works.
Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.
'We are aware of the media reports on security vulnerabilities in some small Huawei routers and are verifying these claims...'
The only systems that were tested were low end because they were not able to get there hands on Huawei's high end products...
And hundreds of vulnerabilities in Cisco IOS were somehow different, of course.
But of course, their vulnerabilities were not related to 'Chinese government' and wouldn't make 'news for retards'.
Sigh.
http://en.wikipedia.org/wiki/Xenu
You got your thetans in my peanutbutter!
HUAWEI is SPONSORED by the GOVERNMENT. It is NOT a corporate entity, it is an EXTENSION of the government.
That said, hell, not a bad way to protect your citizens from corporate imperialism...
Neil saw it right, grand-kids are going to inhert SNOWCRASH.
You get what you pay for.... Honestly if they are cheaper than d-Link, something must be wrong.
It's just like buying your servers from Happy Fun server company. What did you expect you were getting for $49.95?
Do not look at laser with remaining good eye.
My gargantuan 3g USB-dongle mandated with my subscription from Telfort in the Netherlands is from Huwei. But I never use it, and instead have placed the SIM inside my Nokia N9 (which also tethers nicely). Still, I am claiming the Huwei tax here in the Netherlands
You can't be ahead of the curve, if you're stuck in a loop.
When you subscribe to Verizon FiOS, Verizon gives you a free ActionTec wifi router with custom firmware. No doubt it has similar backdoors.
Their competitor's hardware is truly a masterpiece of engineering, and if you're an engineer you may find it to be beautiful. I always thought they should ditch the custom VM, provide some kernel modules and ioctls for the special hardware functionality and do all their programming in C or C++, though. It's kind of hard going back to something like PLEX after programming with pretty much any other language from 1960 on.
The axe (heh heh) their competitor has to grind with Hauwei may very well be a legitimate one. There always were some shenanigans going on. Unfortunately I really don't have a lot of power over what phone switches get used anywhere, so there's not much I can do about it. I do think this possibly-unfair competition has driven more feature development than we might have seen had Hauwei not been playing their little game. So maybe in the end it's not all bad, even if it's not particularly good.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Americans want "cheap" and don't give a fuck.
This country is getting what its public, ALL of us, deserve.
Inaction is consent.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
The title of this article seems a little deceptive to me. Not that I have a particular fondness for some Chinese router company, but I think this should have been titled "Competitor: Huawei Routers Riddled With Vulnerabilities".
Having interacted with Huawei folks over the years they are nice people and driven but holy shit are they sloppy.
I don't know what environmental pressures coincide to make them think lax QA and programming standards is acceptable behavior.. if they expect to be taken seriously they need to get their shit together.
I've said it anonymously on /. since day one but Huawei is a state company whose sole purpose is to spy on citizens / companies / other states worldwide.
Cnet reports that German security expert Felix Lindner has...
Some expert. Now everyone knows who he is. Oh, wait, now I get it....
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
It's different because Cisco publicly announces their security advisories and publishes security bug information. Full disclosures:
http://www.cisco.com/en/US/products/products_security_advisories_listing.html
Other companies (such as Juniper) are a bit less public, but seem to offer more information than Huawei to their customers too:
http://s-tools1.juniper.net/support/security/report_vulnerability.html
I think the safe (and honest) assumption should be that anything coming out of a shipping container that can rub two chips together is a possible attack vector of the PRC. They are the ultimate and most effective sleeper agents ever created.
The backdoors are already in every vendors. http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act
Is it just me, or is the researcher in the article holding a "touch my monkey" pose?
lol
Perhaps there is something to be said about routing & switching performed by open source software based systems...
Thank you for that enlightening review Mr. Wong. See you at the Huawei picnic later this month!
Whether it's Huawei or some American company, as long as the source code is hidden there is no way to prove that a router does not have a trap door built in. My first thought for doing this would be through 'port knocking', which would be undetectible until actually used. No doubt, black hats have even more sneaky methods.
Huawei's stuff runs Linux. The software is written in C with a lot of the configurability written and controlled by Lua.
If it's vulnerable at the OS level then that is cluelessness or deliberate.
They are dirt cheap to work for, or rather they expect you to be. They approached us recently because we had tools they liked. They wanted us to custom port them to Linux for them. When we quoted them they came back to us with "our budget is X" where X was 1/7th of what we quoted them. We declined and told them to find another software vendor.
You should have worded your subject "You Can Only Really Know if Open Source Routers are Secure". For the sake of discussion, say I were to create the world's first 100% secure, completely unhackable router and not release its source code. It is secure, but you're assuming it isn't because you can't see that it is. At the same time you can't prove that it isn't. You could spend your entire life trying to find holes in it without ever knowing there was one. (You can't prove a negative)
Now with that said, If I were to scour the source of every open source router, I may or not find holes. Even if I didn't, does that mean that none exist? No. That just means that I was only able to validate the lack of holes within the confines of my own experience, short attention span, and ability to grasp the complexity. Sure, you have more eyes on things with Open Source solutions, but that doesn't make them immune to stupidity, lack of knowledge and complacency.
so now i'm wondering about a purchase i've been considering, gsm modules from rf solutions have huawei pdf's, really cheap stuff, would make putting together a smart phone easy. i'm slightly concerned about the quality and security of the modules now...
Yes, the subject line sucked, but its length is limited. I was going to add "proven" or "able to demonstrate some confidence to be", etc., but what I had was literally as long as was allowed.
I freely admit that being able to see source code does not guarantee that malicious programming will be spotted, but having the code at least gives people a fighting chance.