Slashdot Mirror
Huawei Offers 'Complete and Unrestricted' Source Code Access
An anonymous reader writes "The BBC reports that 'Huawei has offered to give Australia unrestricted access to its software source code and equipment, as it looks to ease fears that it is a security threat. Questions have been raised about the Chinese telecom firm's ties to the military, something it has denied. Australia has previously blocked Huawei's plans to bid for work on its national broadband network. Huawei said it needed to dispel myths and misinformation.' But is this sufficient? Will they be able to obscure any backdoors written into their equipment?"
Does the Australian Govt have anyone that can actually properly security audit this? I am sure they are not going to want to spend the money to hire someone who can. Also, who is to say the binary blob firmware doesn't have a back door. Its not like the Australians are going to compile it and install it themselves.
...seeing as how it's their source code being released.
Much like I assume a lot of other /. readers, my trust in the equipment I use to do what it's supposed to do comes from my access and ability to read the source code. There have been minor dust-ups in the open source world about allegations that other governments than China inserted back doors in widely used software, and we still see those allegations surfacing from time to time, but never with anything solid to back them up. I believe searches on the obvious keywords will turn up stories linked from here, as well as links to source code repositories of very high quality indeed.
So my advice for Huwaei is, let the world see your source code, and please set up a mechanism for reviewing your own code and patches.
-- That grumpy BSD guy - http://bsdly.blogspot.com/
Sorry, but there is absolutely no company in the world that has this thing called "character".
Is Australia planning on building their own code from that source?
Because how would they know that what they were running was actually the source code they were provided?
And would Australia even be interested in jumping through that extra hoop considering that there are other vendor options available where Australia feels this isn't necessary? The price difference between Huawei and other vendors would have to be fairly sizable to warrant that.
Or, even more insidious, I've heard of the possibility to include backdoors via the compiler rather than via the source code.
http://en.wikipedia.org/wiki/Backdoor_(computing)
Quote from that article:
It is also possible to create a backdoor without modifying the source code of a program, or even modifying it after compilation. This can be done by rewriting the compiler so that it recognizes code during compilation that triggers inclusion of a backdoor in the compiled output. When the compromised compiler finds such code, it compiles it as normal, but also inserts a backdoor (perhaps a password recognition routine). So, when the user provides that input, he gains access to some (likely undocumented) aspect of program operation. This attack was first outlined by Ken Thompson in his famous paper Reflections on Trusting Trust (see below).
If Huawei's code requires anything more than generic gcc, Australia may not be able to verify 100% security, regardless... unless they're given the source code to the compiler as well.
Long story short, this just seems like a huge hassle that Australia is probably going to avoid anyway.
Just my 2 cents...
When American telecom companies won contracts to supply soviet satellite, I think it was Poland, with telecom equipment, The CIA or NSA or both managed to get back doors into the equipment to both monitor calls and in the event of hostilities, to shut the phone system down completely. If American companies let their Government subvert their technology in foreign countries, China would be foolish not to.
Hardly obscure. The only thing needed is to make it so the code used to build the firmware isn't the code you provided for everyone else to look at. I can think of a dozen ways to do that, starting with the obvious "patch file not in version control and not provided to anyone, applied manually between checkout and compile". If you're doing that, the back-doors don't have to be obscure at all because they won't be present in anything anyone can see.
The only way to truly tell is to build your own binaries from the supplied code and then diff the vendor-supplied firmware against your build. That of course suffers from problems with a large number of benign differences due to embedded source-code paths, timestamps due to the build being done at a different time, slight variations in the exact version of third-party libraries and so on.
-signed Admiral Thomas Dalton Ackbar
Is their h/w and s/w being audited for back doors and spyware?
No need to audit US sourced equipment. Thanks to CALEA we are 100% certain its been bugged.
Have gnu, will travel.
OK, lets assume that the routers are rooted. So what? Isn't everything over the Internet presumed to be insecure anyway? At worst, China would get some SSL packets from my bank, or some HTTPS packets between me and an email server. Or see that I'm on Slashdot more that I should be. Yawn.
And, if they did send a copy of every packet to China, do you think the carriers wouldn't notice that traffic pattern? It's an absurd accusation, with no basis in fact. And, if true, would be quickly found if it were ever used. All to compromise an unspecific portion of a residential broadband network.
It's more likely that Huawei was behind the assassination of Kennedy and 9/11 than they are inserting router backdoors in an attempt to remotely control Australia. If you've been to WA, you don't need to sniff their traffic to know what they are doing. 99% porn, 1% skype to family.
Learn to love Alaska
I'll believe it when I see it. Many, if not most, of their products run on VxWorks, a proprietary closed-source real-time operating system. All it takes is for someone to find a way to access the t-shell and you own the box. I believe this was recently shown to be trivial to do with access to the web interface (no login needed). Once you are in the t-shell you own the box. In VxWorks the t-shell is like root on steroids. You can call any function, access at any global variables or any memory location that you choose.
VxWorks historically has not been a secure operating system, leaving security entirely up to the applications developer.
VxWorks is not like a traditional operating system where you load programs off of a filesystem and execute them, with a clear separation between the OS and applications. Instead, everything is linked together into a single binary blob. Now it's possible it has changed significantly since I last used it, but I doubt it.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
Backdoors cleverly disguised as obscure implementation bugs are very hard to find, and if you find them, you do not know whether they are bugs or obscure implementation errors. Typically, making sure no backdoors are in a piece of complex software is more effort and more difficult than reimplementing it with trustworthy and competent people.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Source code access is never enough to guarantee that something is free backdoors? How adds it to the hardware? How can I verify the devices coming in (from China in this case) has the right binaries installed? and don't forget about hardware backdoors. It is like trusting a PC manufacturer with a preloaded Linux installation because I have the source code of it on a DVD to review. If you can't trust the manufacturer there is no source that can help
Oh, another offended Anonymous Coward. How cute.
http://cm.bell-labs.com/who/ken/trust.html
If you haven't read it, or even if you haven't read it recently, you really should.
What the BBC is reporting is not quite what was offered. The ABC quotes Mr Lord as:
"Huawei is willing to offer complete and unrestricted access to our software source code and our equipment in such an environment," he said. "And in the interests of national security, we believe all other vendors should be subject to the same high standard of transparency."
The reference to "such an environment" is an industry funded organisation dedicated to vetting this stuff.
The exercise is nothing more than a PR spin. Huawei knows full well that the other players will neither want to fund a centre that effectively lets a competitor back into the race nor subject their own code to such scrutiny and risk rejection. He is the local face of Huawei so he has to say these things, but they will not change anything.
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
Wow, you're just really naive. Really, really naive.
Even without decrypting the information all the way back in WWII, traffic analysis allowed some major victories on the battlefield. With this technique, being automated and in near real time, one could infer a lot about an adversary without actually decrypting one single thing.
Maybe you're not concerned with privacy, but that's why you're not working in this field!
Who needs a back door when you have a range of security vulnerabilities to choose from.
Here's the slide deck from the talk on Huawei talk at Defcon 20 this year. At the end of the talk the presenter addressed the topic of backdoors by saying (my paraphrase) given the state of the code, who knows if a given hole is a backdoor or unintential security vulnerability.
The deck is worth a read if only for the fortune cookie slides, which contain actual quotes from the object code:
http://phenoelit.org/stuff/Huawei_DEFCON_XX.pdf
Min
On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
Is there anything new Slashdot can offer, other than this same old China bashing orgy?
If you think that equipments from Huawei is dangerous, what makes you think that Cisco equipment don't come with backdoors?
Which equipment the Stuxnet virus targeted?
Equipment from China or those from the Western countries?
It's easy to bash China - as China has become the poster boy for bashing orgy - from Presidential debate to this one in Slashdot - but I do expect MORE from those who come to Slashdot.
Unlike the tweedledee and tweedeldum on the presidential debate, you guys do have brains.
It's time you use your brain to think, rather than letting others doing the thinking for you.
If Huawei (and all equipments from all Chinese companies) are suspicious, what makes you think that equipments from Germany or Japan or Britain or Korea or Canada or USA aren't?
Muchas Gracias, Señor Edward Snowden !
Sure, they'd take it all down. And then what? Invade Australia? That'll start WWIII, same as if they launched a bomb at every network POP. We should be scanning them all to make sure there aren't hidden bombs in every Huawei router, and even if they come back clean, open them all up and make sure. What would happen if the code had every battery in every Huawei phone outside China blow up at the same time? And every Huawei home router shorted , taking our the electric grid? Then they got up, walked to other routers, and assembled themselves into a large robot that calls itself Megatron-san (yes, I know we are talking Chinese and san is Japanese).
Learn to love Alaska
That may be true, but based on past events, like when counterfeit Cisco routers were produced in China and sold world wide, even to US military institutions, the fear is very real. Besides the attempt to maximize profit by selling falsely produced patented and copyrighted digital equipment, there is the nefarious aspect that these systems could have any sort of direct back-door, data rewriting, or side channel attacks built-in.
The question comes down to this: Do you purchase digital computing products constructed in a Communist country that is actively engaged with you in digital warfare? This is the cyber equivalent to smallpox blankets.
If Huawei (and all equipments from all Chinese companies) are suspicious, what makes you think that equipments from Germany or Japan or Britain or Korea or Canada or USA aren't?
If I'm running a business in Australia, each of the listed non-Chinese countries is a minor concern. All have strong intellectual property protection. They mostly don't have a reputation for cloning foreign products. China is a different matter entirely.
If I'm running a business in any of the listed countries, China or otherwise, obviously my own country is preferred. They'd kick in my door if they wanted something; it's easier and more fun than hacking. I'd like protection from the others.
If I'm running a business in Iran, I probably want Korea or Japan. China is trying to pry into my finances for trade negotiation, and everybody else just hates Iran.