Security Expert: Huawei Routers Riddled With Vulnerabilities 126
sabri writes "Cnet reports that German security expert Felix Lindner has unearthed several vulnerabilities in Huawei's carrier grade routers. These vulnerabilities could potentially enable attackers, or the Chinese government, to snoop on users' traffic and/or perform a man-in-the-middle attack. While these routers are mostly in use in Asia, Africa and the Middle East, they are increasingly being used in other parts of the world as well, because of their dirt-cheap pricing. Disclaimer: I work for one of their competitors."
Via the H, you can check out the presentation slides. Yesterday Huawei issued a statement 'We are aware of the media reports on security vulnerabilities in some small Huawei routers and are verifying these claims...'
This doesn't surprise me... (Score:1)
I've always hated Huawei because their products seem inferior. This just reinforces that. I'm not surprised at all.
Re: (Score:2)
I'll be honest, despite them being such a massive firm, and having heard about them many hundreds of times on Slashdot, I've never actually seen a peice of Huawei kit here in the UK.
Are they just not particularly prominent in the UK market? or are they one of those firms who let others rebrand their kit?
The reason I ask is because I don't want to inadvertantly use their kit - if it's been rebranded to something else I want to avoid it. If it doesn't get rebranded then I guess I'm okay, because encountering
Re:This doesn't surprise me... (Score:5, Interesting)
They do usually rebrand their stuff. Some "lower-end" mobile phones, probably ones that carry the operator's brand name and not the manufacturer's, are likely to be made by Huawei or similar companies (ZTE, as another example).
Another reason Huawei is so cheap is because they don't "innovate" like (most?) Western companies do. They kinda consider R&D to be a profit center and will not move an inch to develop something that is not _known_ to be profitable. I have first-hand experience with this. I work for Huawei. There!, I said it.
Most customer meetings we have involve going to ask for requirements that they can be sent back up the chain to HQ (R&D) to get started on the development. Seriously. Our Chinese bosses (can't call them managers) and counterparts (some of the "local" staff have a Chinese "mirror") are constantly asking to find the customer's Strategy for a particular product/service and what the business model is going to be....even from technical staff at the customer.
I recently ready this article http://www.brookings.edu/research/articles/2012/07/10-china-multinationals-shambaugh and it paints a pretty accurate picture of my everyday life working here.
As much as they "sell" the idea of being a communist country, they are still very much a feudal culture with a close-minded and I'm-never-ever-wrong-because-I'm-the-boss mentality. And it'll catch up to them...soon
When people mention something about the Chinese taking over the world, I worry too. Just for very different reasons.
(Posted as AC ((from work)) for obvious reasons)
Re: (Score:3, Interesting)
Oh, and the R&D guys that I've met, look like they're fresh out of the University (or ...idk) and no one has bothered to create any formal programming practices or the like...which is why I totally believe the comment about security coding practices being from 15 years ago.
Re:This doesn't surprise me... (Score:4, Interesting)
It is catching up to them.
I work for a telecom company that has a significant investment in Huawei gear. Their equipment often has serious bugs, and upper management is starting to notice that the ability of the service and support teams to "do their jobs" is being hurt by Huawei's bugs, and we're seriously entertaining bids from other vendors.
The sad part is that their equipment is SO much cheaper than anything else on the market.. I don't know if we could afford to even convert a fraction of our gear to some other vendor. The economics of the business is such that we couldn't afford to provide the service at the prices we charge without using the cheapest option available.
Re: (Score:2)
Re: (Score:3)
I'm Canadian and your post absolutely SCREAMS Wind Mobile (you don't have to answer if you don't want to).
I think Globalive uses Huawei gear in most or all of the other countries they have a presence in as well...
Re:This doesn't surprise me... (Score:5, Interesting)
From the article you linked [brookings.edu]:
Right, because stuff like that would never happen in the United States...
Re: (Score:1)
It does happen in the US too, but on a much smaller scale.
Re: (Score:1)
Guess what kind of gear we use here at Huawei.
Please step into my office.
Your boss
My own Huwei tax is paid-up. (Score:4, Informative)
My gargantuan 3g USB-dongle mandated with my subscription from Telfort in the Netherlands is from Huwei. But I never use it, and instead have placed the SIM inside my Nokia N9 (which also tethers nicely). Still, I am claiming the Huwei tax here in the Netherlands
Re: (Score:1)
Re: (Score:2)
Huawei make the 3 "MiFi", the original generation at least and probably the rest too. They also make 3G dongles.
Re: (Score:1)
My Vodafone dongle and 3 MiFi are both relabelled Huawei products. I think there are a lot of them around, but rebranded by the phone companies.
Re: (Score:2)
many Vodafone-branded devices across the entire Europe are actually huawei devices, especially those usb 3G+ hsdpa/hsupa wireless modems that look like fattened usb drives.
If you have one look on its back and it's almost guaranteed to see the label that says it's made by huawei.
Also, the installation package for Vodafone Mobile Connect (their connectivity management software) has most of its drivers made by huawei.
Re: (Score:2)
As far as I'm aware, the company has no (own brand) retail products in the UK.
Re: (Score:2)
I've bought non-rebranded (don't recall if they have hauwei's brand printed on them or if they are just plain white with no brand marking) hauwei mobile broadband sticks in the UK (I wanted them unlocked so I could freely switch carriers and I also wanted an external antenna which meant I needed specific models, many of the newer ones lack the external antenna connector) in the UK. It was from a computer gear supplier though not retail.
Re: (Score:2)
I'll be honest, despite them being such a massive firm, and having heard about them many hundreds of times on Slashdot, I've never actually seen a peice of Huawei kit here in the UK.
I would have a look in the back cover of any 3G USB modem. In 6 different companies through a multitude of carriers I have never seen a carrier branded 3G stick that wasn't manufactured by Huawei.
Re: (Score:2)
I'll be honest, despite them being such a massive firm, and having heard about them many hundreds of times on Slashdot, I've never actually seen a peice of Huawei kit here in the UK.
Afaict most mobile broadband sticks sold in the UK are made by them.
Re: (Score:3)
Well... (Score:5, Insightful)
Re: (Score:3, Insightful)
When something is being sold for a much lower price then competing products, there is a reason for it.
Yeah, they cloned the designs. Which is naughty, but doesn't mean they don't work exactly the same as the original version.
Re:Well... (Score:5, Funny)
Re:Well... (Score:4, Insightful)
Well, they could just as likely be inadvertent vulnerabilities due to Huawei not diligently copying the newest firmware code from Cisco.
Re: (Score:2)
Re: (Score:2)
why copy when they can hire laid off cisco programmers for cheap...
Re: (Score:2)
Re: (Score:2, Insightful)
Yep. That's what Linux is so crappy compared to Windows. Oh, wait...
Re: (Score:2)
I highly doubt the motivations behind the low price of Linux as compared to the low price of these Chinese shit-tier routers are one and the same, which I'm betting you damn well know yourself, but if you want to play the 'feigned ignorance' game, you go for it buddy.
Would you buy electronics out of the back of a van? It could be legit, amirite?
Re: (Score:2)
You're confusing distribution channels, products, hardware, software...
Regarding the "more expensive is always better": no it isn't. There are oodles of examples where paying more is just being a sucker, not getting more quality/features/service. Yep, I'm thinking of Hi-Fi ethernet cables; of the no-name champagne that was ranked higher than almost all brands in a blind test, of linux vs windows.
To stay in the "router" market, don't forget Cisco treated their customers to a forced update that forced them to
Re: (Score:1)
Re: (Score:2)
Re:Well... (Score:4, Insightful)
Does it make a difference if the device is wide open because nobody closed all the doors (east) or because someone opened a backdoor (west)?
In practice, it almost certainly does: Vulnerabilities are exploitable by anybody who knows about them and cares to do so. That is a fairly long list of the world's spook shops, spammers, questionably socialized teenagers, and so forth. Law enforcement backdoors(unless they are also badly implemented and vulnerable) are exploitable by the law enforcement of your given jurisdiction. Not wildly comforting; but it is a shorter list...
You would hardly call me a friend of CALEA and its analogs; but surveillance-under-color-of-law does have the advantage, from a security perspective, of essentially making the local feds users, rather than attackers, of the system. If they already get what they want, they have no incentive to weaken the security mechanisms in order to get what they want(and, indeed, if they want exclusivity, they have an interest in keeping their competitors out). It doesn't help the little people on the end of the wire all that much, of course.
Re: (Score:2)
I strongly disagree. I can name many 6 figure software products that are worse than a free option in every way. I can name hardware that is similar.
Re: (Score:2)
Lets just say the call center world is full of them. CXM, Click, the list goes on and on. Generally the more it costs the less users, this means little testing gets done.
Re: (Score:2)
That is not what I am saying at all.
What i am saying is some cheap things are better than some expensive things.
My list is two, because that is enough to be more than $500k worth of shit.
Re: (Score:2)
Tell that to finance. Or a school board. Or any media "investigative reporter" looking for a ratings bump during sweeps week.
In any public sector, low price almost always wins, because it's safe. Not necessarily for the organization, but definitely for the IT or CIO's job. If shit hits the fan, they can almost always pass the blame and keep their job. Except when it comes to money and (perceived) overspending and waste.
Re: (Score:2)
You get what you pay for.
You pay for what you get. You only get what you pay for if you're lucky. Item A costing more than item B is no gurantee that item A is superior to item B, and in fact the cheaper alternative may in
Re: (Score:2)
There are well established security testing methods such as FIPs certification. It cost money to implement defenses and it costs money to do the testing. That is often what you are paying for in more expensive products. You will also probably get hardware that works over a wider temperature range and a product that has been through accellerated life testing and meets the published specification on every single unit made. Take your pick, you can buy products cheaply that usually do the job without problems
Re: (Score:2)
You get what you pay for. Who would trust this craptastic bargain basement shit anyway? When something is being sold for a much lower price then competing products, there is a reason for it.
That's not always the case; sometimes certain companies really do offer better price/performance ratio than others. One example I've seen is in the area of woodworking tools. Companies like Delta and Powermatic used to make stationary power tools in the USA; these were built like tanks, priced high but great quality. T
Re: (Score:3, Funny)
Nice try, Chinese government.
Re: (Score:2)
Agreed. Someone in Slashdot needs to read up on the differences between "vulnerability" and "back door".
Re:summary is racist (Score:4, Informative)
Actually, a back door is deliberately created to allow specific people to come into the system - like a known account name with a known password. Just because you know the back door is there doesn't mean you can use it if you don't know the user and password.
A vulnerability tends to be as a result of poor design or a software bug - and not usually placed deliberately.
That's a clear distinction...
Re: (Score:2)
Jim Sting: Mister Potato Head! Mister Potato Head! Back doors are not secrets!
Malvin: Yeah, but Jim, you're giving away all our best tricks!
Re: (Score:1)
When did Chinese become a race?
I would suggest it is instead biased against the Chinese as a nation not as a people.
Re: (Score:2)
Re: (Score:3)
When did Chinese become a race?
I'd guess at least 10,000 years ago. The Chinese certainly think they are a "race". Google "ethnic Chinese" and argue with the 2 million hits.
Anyway, racism or just flamebait, it's an accusation without a shred of proof. Yes, we know that the Chinese govt isn't above a bit of techno-espionage, but still PROVE IT FIRST.
Re: (Score:1, Funny)
Well it's nothing compared to the slides. When research is presented in such a xenophobic, childish way, it makes it hard to take it seriously (and this cyber* stuff is potentially very serious) Slashdot, being a news organisation and not a hackers shold be held to a higher standard, though.
Re:summary is racist (Score:5, Insightful)
First, I don't think you are working from a good definition of "racist." If someone insinuated that Cisco had a backdoor deal with the NSA, I doubt people would be screaming "racist" or even do anything more than shrug and frown. It's sound strategy, and the Chinese government is very good at infosec and cyberwar - the reason why people are up in arms isn't because the Chinese are a different race, it's that the Chinese government has been caught repeatedly engaging in corporate espionage as well as old fashioned espionage, where the US generally only bothers with the latter.
Second, almost anyone who has a real infrastructure to protect knows that Huawei works arm-in-arm (or hand-in-pocket, more likely) with the 7th Bureau of the 3rd People's Liberation Army, the Chinese military infosec unit responsible for network penetration. The 7B3PLA has investments all through China's technology sector, to the point where individual chips on routers made elsewhere need to be vetted, as they might be compromised from the factory, and counterfeit devices are a real issue.
Again, not a race issue. China is a global power, and it's acting like one with a solid strategy. It's likewise a solid strategy to avoid cheap off-brand network equipment for your infrastructure. TANSTAAFL, you get what you pay for.
Re: (Score:2)
Re: (Score:2)
not a race issue"
Right. Well, I guess to Americans, "racism" means using the "N word" or the "J word" Prejudice against foreigners is just good sense.
The summary leaps from a statement that a vulnerability has been found to implying that a foreign power is using it for espionage. Without bothering to establish that ANY espionage has taken place at all, let alone who might have dome it. But feel free to "Kill them all and let God sort them out".
Re: (Score:2)
Be fair, there really is a difference between distrusting all ethnically Chinese people and distrusting the Chinese government.
Re: (Score:3)
Right. Well, I guess to Americans, "racism" means using the "N word" or the "J word" Prejudice against foreigners is just good sense.
You are aware that China isn't a race, it's a country. And as a buyer of Chinese goods America buys many, so your racist comment is without merit, if anything it would be referred to as Nationalism (Nationalistic is often used to describe Chinese, here is result number 3 for 'how are foreigners treated in china [blackandwhiteprogram.com]'). Prejudice and ethnocentric view points are hardly unique to Americans. Prejudice of foreigners is alive and well outside of America and there are many more non-Americans than Americans. One can lo
Re: (Score:2)
Re: (Score:3)
I'm not sure they really care about any traffic from Africa or the Middle east, maybe the rest of Asia, but I'd imagine they'd already have good info through other means.
Au contraire, China does care about Africa and the Middle East. Very much so. One word:
Resources.
The ME still has lots of the black stuff. That's still very important. China uses a lot of black stuff, wants more, wants a long term supply (just like everyone else). Increasing one's ability to sniff out the various issues surrounding oil and politics in the ME is important to any major country, China included.
Africa is becoming a new area of opportunity for China. After the West has fucked over the conti
Re: (Score:3)
I wouldn't call this racist. Racist would be saying that this event is evidence that Chinese people are inherently secretive/exploitative/dubious in nature. If someone says that, then I'd be on your side. However, the line you quoted is no different from 99% of the first post comments here on stories about the US government doing something /. doesn't like. Unless you and the mods who have modded you up are prepared to reject all of those past comments as racist (or having some other population-based prejudi
Re: (Score:2)
I'd like to also mention that those epic first post screeds are usually rated +5.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
If they exist they would allow ANYBODY to snoop on users' traffic. What is this, SlashFox? How about "could potentially enable attackers, or PRESIDENT BARACK HUSSEIN OBAMA to snoop on users' traffic!." or "could potentially enable attackers, or homesexuals, to snoop on users' traffic".
As the story submitter I find your accusation of racism unfair. Chinese government access to Huawei equipment has been a concern for years, check for example this Wikipedia entry [wikipedia.org] on Huawei.
This has nothing to do with racism. This has to do with the companies background and practices. Have you read this article, about a data stealing employee [reuters.com]?
And how is this different from any other vendor? (Score:2)
Cisco, Juniper, HP, Nortel, Ericsson are all proprietary black boxes as well. Perhaps they all have vulnerabilities like this? We will never know but perhaps our governments do?
Unfortunately, it's a niche and there are no open source carrier grade router platforms :(
It is different, if you work in the field. (Score:3)
It's different because Cisco publicly announces their security advisories and publishes security bug information. Full disclosures:
http://www.cisco.com/en/US/products/products_security_advisories_listing.html [cisco.com]
Other companies (such as Juniper) are a bit less public, but seem to offer more information than Huawei to their customers too:
http://s-tools1.juniper.net/support/security/report_vulnerability.html [juniper.net]
I do not see any bug/hacks of carrier grade router (Score:1)
I used a NE40 for a couple of weeks to determine if it was worth buying instead of Juniper for our network. I decided against it but I have to admit for the price it
did pretty much everything we would want it to do. The hardware build quality left a lot to be desired and it was only 32 bit CPU so the memory would never be
able to be upgraded past 4 gigs so we passed.
But to hack a few small SOHO routers and then make the claim carrier grade gear is also just as bad without ever touching or using it? I think t
Tank Man is not surprised (Score:4)
Re:Tank Man is not surprised (Score:4, Insightful)
Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank [wikipedia.org] than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.
It would be nice to think that by working for American companies you wouldn't be also be behind the controls of the tanks, but unfortunately that's not the case.
Re: (Score:2)
Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank [wikipedia.org] than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.
It would be nice to think that by working for American companies you wouldn't be also be behind the controls of the tanks, but unfortunately that's not the case.
I'm against injustice, regardless of whether it is committed by Americans or Chinese or anyone else. You seem to be arguing that crushing children with tanks at Tiananmen Square was morally allowed because the USA government has been known to also have moral failures. That's an interesting world view on your part.
Re: (Score:1)
Re: (Score:3)
Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank [wikipedia.org] than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.
It would be nice to think that by working for American companies you wouldn't be also be behind the controls of the tanks, but unfortunately that's not the case.
I'm against injustice, regardless of whether it is committed by Americans or Chinese or anyone else. You seem to be arguing that crushing children with tanks at Tiananmen Square was morally allowed because the USA government has been known to also have moral failures. That's an interesting world view on your part.
I can't even begin to imagine how you could come to such a conclusion based on what I said. In fact it's so far off from what I said, and what I think, that I have trouble figuring out what to say to you without being offensive.
I'll rather try and clarify what I said in other terms. The original poster was saying that he wouldn't work for Huawei because to do so would, in effect, be moral support for the Chinese government who was / is responsible for human rights violations. So far I think you had the s
Hahaha. "Security experts" these days... (Score:4, Interesting)
And hundreds of vulnerabilities in Cisco IOS were somehow different, of course.
But of course, their vulnerabilities were not related to 'Chinese government' and wouldn't make 'news for retards'.
Sigh.
Re: (Score:3)
"Unless and until Huawei becomes a stand-alone widely held listed company with employees free to trade their shares and without a controlling shareholder, these suspicions and allegations will likely continue,"
http://www.itnews.com.au/News/175946,analysis-who-really-owns-huawei.aspx [itnews.com.au]
This IS an instance where.... (Score:4, Insightful)
You get what you pay for.... Honestly if they are cheaper than d-Link, something must be wrong.
It's just like buying your servers from Happy Fun server company. What did you expect you were getting for $49.95?
Beware FiOS free routers (Score:2)
Oh Yeah? (Score:2)
Their competitor's hardware [scribd.com] is truly a masterpiece of engineering, and if you're an engineer you may find it to be beautiful. I always thought they should ditch the custom VM, provide some kernel modules and ioctls for the special hardware functionality and do all their programming
Deceptive title (Score:2)
Recurity (Score:1)
Cnet reports that German security expert Felix Lindner has...
Some expert. Now everyone knows who he is. Oh, wait, now I get it....
Safe assumption (Score:2)
Open Source Software Defined Networking (Score:2)
Perhaps there is something to be said about routing & switching performed by open source software based systems...
Only Open Source routers have hope of being secure (Score:2)
Whether it's Huawei or some American company, as long as the source code is hidden there is no way to prove that a router does not have a trap door built in. My first thought for doing this would be through 'port knocking', which would be undetectible until actually used. No doubt, black hats have even more sneaky methods.
Re: (Score:1)
You should have worded your subject "You Can Only Really Know if Open Source Routers are Secure". For the sake of discussion, say I were to create the world's first 100% secure, completely unhackable router and not release its source code. It is secure, but you're assuming it isn't because you can't see that it is. At the same time you can't prove that it isn't. You could spend your entire life trying to find holes in it without ever knowing there was one. (You can't prove a negative)
Now with that said,
gsm (Score:1)
Re: (Score:2)
Americans want "cheap" and don't give a fuck.
This country is getting what its public, ALL of us, deserve.
Inaction is consent.