Slashdot Mirror
Security Expert: Huawei Routers Riddled With Vulnerabilities
sabri writes "Cnet reports that German security expert Felix Lindner has unearthed several vulnerabilities in Huawei's carrier grade routers. These vulnerabilities could potentially enable attackers, or the Chinese government, to snoop on users' traffic and/or perform a man-in-the-middle attack. While these routers are mostly in use in Asia, Africa and the Middle East, they are increasingly being used in other parts of the world as well, because of their dirt-cheap pricing. Disclaimer: I work for one of their competitors."
Via the H, you can check out the presentation slides. Yesterday Huawei issued a statement 'We are aware of the media reports on security vulnerabilities in some small Huawei routers and are verifying these claims...'
I've always hated Huawei because their products seem inferior. This just reinforces that. I'm not surprised at all.
You get what you pay for. Who would trust this craptastic bargain basement shit anyway? When something is being sold for a much lower price then competing products, there is a reason for it.
Nice try, Chinese government.
Cisco, Juniper, HP, Nortel, Ericsson are all proprietary black boxes as well. Perhaps they all have vulnerabilities like this? We will never know but perhaps our governments do?
Unfortunately, it's a niche and there are no open source carrier grade router platforms :(
Agreed. Someone in Slashdot needs to read up on the differences between "vulnerability" and "back door".
Windows 10 is great - I used it to download Linux.
I used a NE40 for a couple of weeks to determine if it was worth buying instead of Juniper for our network. I decided against it but I have to admit for the price it
did pretty much everything we would want it to do. The hardware build quality left a lot to be desired and it was only 32 bit CPU so the memory would never be
able to be upgraded past 4 gigs so we passed.
But to hack a few small SOHO routers and then make the claim carrier grade gear is also just as bad without ever touching or using it? I think that is pretty sad.
Does one find a bug in some crappy apache module and then make the claim apache itself is also poor? No. So why here?
I do use Huawei sonet gear though. Great bang for the buck, reliable, and just works.
Actually, a back door is deliberately created to allow specific people to come into the system - like a known account name with a known password. Just because you know the back door is there doesn't mean you can use it if you don't know the user and password.
A vulnerability tends to be as a result of poor design or a software bug - and not usually placed deliberately.
That's a clear distinction...
Windows 10 is great - I used it to download Linux.
Jim Sting: Mister Potato Head! Mister Potato Head! Back doors are not secrets!
Malvin: Yeah, but Jim, you're giving away all our best tricks!
Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.
Well it's nothing compared to the slides. When research is presented in such a xenophobic, childish way, it makes it hard to take it seriously (and this cyber* stuff is potentially very serious) Slashdot, being a news organisation and not a hackers shold be held to a higher standard, though.
First, I don't think you are working from a good definition of "racist." If someone insinuated that Cisco had a backdoor deal with the NSA, I doubt people would be screaming "racist" or even do anything more than shrug and frown. It's sound strategy, and the Chinese government is very good at infosec and cyberwar - the reason why people are up in arms isn't because the Chinese are a different race, it's that the Chinese government has been caught repeatedly engaging in corporate espionage as well as old fashioned espionage, where the US generally only bothers with the latter.
Second, almost anyone who has a real infrastructure to protect knows that Huawei works arm-in-arm (or hand-in-pocket, more likely) with the 7th Bureau of the 3rd People's Liberation Army, the Chinese military infosec unit responsible for network penetration. The 7B3PLA has investments all through China's technology sector, to the point where individual chips on routers made elsewhere need to be vetted, as they might be compromised from the factory, and counterfeit devices are a real issue.
Again, not a race issue. China is a global power, and it's acting like one with a solid strategy. It's likewise a solid strategy to avoid cheap off-brand network equipment for your infrastructure. TANSTAAFL, you get what you pay for.
Well, aside from your crazy definition of what racism is ( I hate the syrian government, therefore I must be racist?), its also a stupid summary. The Chinese government already can do pretty much what ever the f*ck it wants to inside its own borders. I'm not sure they really care about any traffic from Africa or the Middle east, maybe the rest of Asia, but I'd imagine they'd already have good info through other means. If they were really trying to do bad stuff they wouldn't put vulnerabilities into an untrusted brand, they'd put them into cisco or juniper that would be used by higher valued targets.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Furthermore, when did hating a government mean you hated the people it governed?
Well.. maybe. Or Maybe not. But Definitely not sort of.
I wouldn't call this racist. Racist would be saying that this event is evidence that Chinese people are inherently secretive/exploitative/dubious in nature. If someone says that, then I'd be on your side. However, the line you quoted is no different from 99% of the first post comments here on stories about the US government doing something /. doesn't like. Unless you and the mods who have modded you up are prepared to reject all of those past comments as racist (or having some other population-based prejudice) as well, then your claim has no basis.
your thin skin doesn't make me a troll
I'd like to also mention that those epic first post screeds are usually rated +5.
your thin skin doesn't make me a troll
I don't think that the summary is racist at all. Making a conjecture that a Chinese IT company, owned by an Ex-Chinese military officer, is purposefully leaving vulnerabilities in it's products that the Chinese government can exploit is sensational, but not racist.
And hundreds of vulnerabilities in Cisco IOS were somehow different, of course.
But of course, their vulnerabilities were not related to 'Chinese government' and wouldn't make 'news for retards'.
Sigh.
You get what you pay for.... Honestly if they are cheaper than d-Link, something must be wrong.
It's just like buying your servers from Happy Fun server company. What did you expect you were getting for $49.95?
Do not look at laser with remaining good eye.
My gargantuan 3g USB-dongle mandated with my subscription from Telfort in the Netherlands is from Huwei. But I never use it, and instead have placed the SIM inside my Nokia N9 (which also tethers nicely). Still, I am claiming the Huwei tax here in the Netherlands
You can't be ahead of the curve, if you're stuck in a loop.
When you subscribe to Verizon FiOS, Verizon gives you a free ActionTec wifi router with custom firmware. No doubt it has similar backdoors.
Their competitor's hardware is truly a masterpiece of engineering, and if you're an engineer you may find it to be beautiful. I always thought they should ditch the custom VM, provide some kernel modules and ioctls for the special hardware functionality and do all their programming in C or C++, though. It's kind of hard going back to something like PLEX after programming with pretty much any other language from 1960 on.
The axe (heh heh) their competitor has to grind with Hauwei may very well be a legitimate one. There always were some shenanigans going on. Unfortunately I really don't have a lot of power over what phone switches get used anywhere, so there's not much I can do about it. I do think this possibly-unfair competition has driven more feature development than we might have seen had Hauwei not been playing their little game. So maybe in the end it's not all bad, even if it's not particularly good.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Well said. Thanks.
Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
Americans want "cheap" and don't give a fuck.
This country is getting what its public, ALL of us, deserve.
Inaction is consent.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
When did Chinese become a race?
I'd guess at least 10,000 years ago. The Chinese certainly think they are a "race". Google "ethnic Chinese" and argue with the 2 million hits.
Anyway, racism or just flamebait, it's an accusation without a shred of proof. Yes, we know that the Chinese govt isn't above a bit of techno-espionage, but still PROVE IT FIRST.
not a race issue"
Right. Well, I guess to Americans, "racism" means using the "N word" or the "J word" Prejudice against foreigners is just good sense.
The summary leaps from a statement that a vulnerability has been found to implying that a foreign power is using it for espionage. Without bothering to establish that ANY espionage has taken place at all, let alone who might have dome it. But feel free to "Kill them all and let God sort them out".
Well, fuck, I only got +3. I should have been more over the top.
I'm not sure they really care about any traffic from Africa or the Middle east, maybe the rest of Asia, but I'd imagine they'd already have good info through other means.
Au contraire, China does care about Africa and the Middle East. Very much so. One word:
Resources.
The ME still has lots of the black stuff. That's still very important. China uses a lot of black stuff, wants more, wants a long term supply (just like everyone else). Increasing one's ability to sniff out the various issues surrounding oil and politics in the ME is important to any major country, China included.
Africa is becoming a new area of opportunity for China. After the West has fucked over the continent for several centuries, the Chinese see a chance to 'help' while continuing to extract resources. The fact that they are more willing to overlook certain ethical constraints puts them at a definite advantage. For more info, return to your search engine of choice - lots of stuff out there.
Faster! Faster! Faster would be better!
The title of this article seems a little deceptive to me. Not that I have a particular fondness for some Chinese router company, but I think this should have been titled "Competitor: Huawei Routers Riddled With Vulnerabilities".
Cnet reports that German security expert Felix Lindner has...
Some expert. Now everyone knows who he is. Oh, wait, now I get it....
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
It's different because Cisco publicly announces their security advisories and publishes security bug information. Full disclosures:
http://www.cisco.com/en/US/products/products_security_advisories_listing.html
Other companies (such as Juniper) are a bit less public, but seem to offer more information than Huawei to their customers too:
http://s-tools1.juniper.net/support/security/report_vulnerability.html
I think the safe (and honest) assumption should be that anything coming out of a shipping container that can rub two chips together is a possible attack vector of the PRC. They are the ultimate and most effective sleeper agents ever created.
Perhaps there is something to be said about routing & switching performed by open source software based systems...
If they exist they would allow ANYBODY to snoop on users' traffic. What is this, SlashFox? How about "could potentially enable attackers, or PRESIDENT BARACK HUSSEIN OBAMA to snoop on users' traffic!." or "could potentially enable attackers, or homesexuals, to snoop on users' traffic".
As the story submitter I find your accusation of racism unfair. Chinese government access to Huawei equipment has been a concern for years, check for example this Wikipedia entry on Huawei.
This has nothing to do with racism. This has to do with the companies background and practices. Have you read this article, about a data stealing employee?
I'm not a complete idiot... Some parts are missing.
Be fair, there really is a difference between distrusting all ethnically Chinese people and distrusting the Chinese government.
Whether it's Huawei or some American company, as long as the source code is hidden there is no way to prove that a router does not have a trap door built in. My first thought for doing this would be through 'port knocking', which would be undetectible until actually used. No doubt, black hats have even more sneaky methods.
Right. Well, I guess to Americans, "racism" means using the "N word" or the "J word" Prejudice against foreigners is just good sense.
You are aware that China isn't a race, it's a country. And as a buyer of Chinese goods America buys many, so your racist comment is without merit, if anything it would be referred to as Nationalism (Nationalistic is often used to describe Chinese, here is result number 3 for 'how are foreigners treated in china'). Prejudice and ethnocentric view points are hardly unique to Americans. Prejudice of foreigners is alive and well outside of America and there are many more non-Americans than Americans. One can look nearly anywhere to see it from France to Korea. While America has its issues, it's referred to as the melting pot with good reason. This still applies because she admits over 1 million people a year with permanent resident status. This doesn't include illegal immigration. Asia, specifically China, Korea, Japan are tolerant of foreigners but the word xenophobic comes into play especially when you look at their demographics...
The summary leaps from a statement that a vulnerability has been found to implying that a foreign power is using it for espionage. Without bothering to establish that ANY espionage has taken place at all, let alone who might have dome it.
I'm not sure what rock you live under, but these devices do have back doors built into them. All of them do, even CISCO gear does, which these devices bear strong resemblance to. Screw foreign powers, wouldn't any owner be concerned with unauthorized use of their property? Let me guess, you give it a pass based on ethnicity? Wouldn't want to be racist after all! /sarcasm. You're in front of a computer connected to the internet with several search engines ready to provide information at your request. All that's required is a little effort on your part to educate yourself.
But feel free to "Kill them all and let God sort them out".
You mean like the Cultural Revolution?
Man blir trött av att gå och göra ingenting.
You should have worded your subject "You Can Only Really Know if Open Source Routers are Secure". For the sake of discussion, say I were to create the world's first 100% secure, completely unhackable router and not release its source code. It is secure, but you're assuming it isn't because you can't see that it is. At the same time you can't prove that it isn't. You could spend your entire life trying to find holes in it without ever knowing there was one. (You can't prove a negative)
Now with that said, If I were to scour the source of every open source router, I may or not find holes. Even if I didn't, does that mean that none exist? No. That just means that I was only able to validate the lack of holes within the confines of my own experience, short attention span, and ability to grasp the complexity. Sure, you have more eyes on things with Open Source solutions, but that doesn't make them immune to stupidity, lack of knowledge and complacency.
so now i'm wondering about a purchase i've been considering, gsm modules from rf solutions have huawei pdf's, really cheap stuff, would make putting together a smart phone easy. i'm slightly concerned about the quality and security of the modules now...