Vulnerabilities / Threats
10/16/2012
05:52 PM
Thomas Claburn
Thomas Claburn
Commentary
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

What Huawei, ZTE Must Do To Regain Trust

The U.S. is not the only country scrutinizing the security of Chinese-made telecom equipment from Huawei and ZTE. Without major changes, significant contracts are at risk.

The issue of purpose is a thorny one. Even as the U.S. government decries the risk of backdoors accessible to foreign powers, the FBI is asking online service providers like Facebook and Google to "build backdoors for government surveillance," as CNET put it.

Baker suggests that the FBI may not be after installed backdoors so much as a commitment to cooperate when the agency needs information for an investigation. And he notes that the phone system from the 1940s through the 1980s was in the hands of a limited number of companies and its backdoors were administered successfully. "You were free from wiretaps unless that company carried them out for the government," he said. "There wasn't a lot of misuse of that capability by others."

But what may have worked in the telecom system of yesteryear appears to be less tenable today. Backdoors are harder to conceal in a connected world, where penetration testing can be conducted from afar all day, every day. Google offers an example: In 2010, the company reported that it had detected "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google." What the company did not say, but was later revealed, was that Google created backdoor access into Gmail to assist U.S. government law enforcement and that Chinese hackers had exploited this vulnerability.

Lawful interception capability also facilitated perhaps the most successful known telecommunications hack, the compromise of the Vodafone Greece phone network, detected in early 2005. According to IEEE Spectrum, a 2003 telecom switch upgrade partially implemented an interception management system that hackers, still unknown, were subsequently able to exploit to tap about 100 phones belonging to Greek government officials.

While U.S. officials may have reason to mistrust Chinese companies with ties to the Chinese government, concerns about hardware security really should be much broader.

Woods, whose firm offers technology to scan for hardware vulnerabilities, argues that we need to look at hardware not only from China, but from the U.S. and Europe as well. "Everyone is pointing at China, but so far we have found a backdoor in a U.S.-designed chip," he said. "Could it also not be the case that U.S. manufacturers could have installed backdoors or Trojans in their chips to be used at a later date? Is there any reason they would not put in such functionality if it was known that, most likely, these devices would be used by a foreign power?"

There's an additional complication: Cybersecurity incidents remain difficult to assess. As Errata Security researcher Robert David Graham has pointed out, claims about a Russian attack on U.S. utilities and a 2007 blackout in Brazil blamed on hackers have been turned out not to be attacks at all. Graham also says the 2008 Russian cyberwar against Georgia was merely citizen-driven hacking, without the oversight of the Russian military.

Forget about whether or not to trust Huawei and ZTE. Trusting anyone about cybersecurity matters entails risk. There's a lot of misinformation out there. The only way to moderate that risk is better access to information that can be checked. We need more transparency about the source of cyberattack claims, more transparency about the source code we're using in our products, and greater access to hardware production facilities. Trust but verify. Use open source systems when you can.

Baker suggests that the woes of Huawei and ZTE may help Chinese technology companies open up in order to deal with Western businesses expectations and regulations. "I think they've kind of stepped in it for the next five years," he said. "Their name will be mud in government circles. Maybe if they engage in some trust-building, they will be able to come back. For now, I think they're out of the market."

Huawei is already working on its recovery. Woods says that in the U.K., Huawei has supplied GCHQ--the U.K. equivalent of the National Security Agency--with source code to demonstrate the integrity of the software portion of its products. "You can't offer up source for the hardware, but you can offer the designs of the hardware, which by themselves won't reveal much," he said.

It's a step in the right direction.

Despite DARPA's effort to assure the reliability of hardware through its IRIS testing program, Wood claims that the U.S. and U.K. intelligence communities aren't interested in the techniques his company has developed. "We have offered to both the U.K. and U.S. government data and technology that [are] capable to look at this problem in a way that was not possible before, but we were told by an intelligence agency in the U.K. that they are not interested in backdoors or Trojans and any attempts to get some interest from the U.S. government has fallen on deaf ears."


Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
10/22/2012 | 4:05:32 PM
re: What Huawei, ZTE Must Do To Regain Trust
Sounds like fodder to justify import/export negotiations or help american firms. Almost all the vendors (Chinese and Western alike) build in backdoors. Publicly the answer is for technical support of their product, but only the naive wouldn't suspect there is the possibility for it to be used for other purposes, repurposed for causes such as law enforcement (remember Govt requests for monitoring and backdoor access), or misused. Govts need to err on the side of caution and consider it as a fact that happens in a competitive, free enterprise economy not as a vague possibility and that China, with greater govt control of its industries, uses it to achieve their national objectives.
ANON1255554460131
50%
50%
ANON1255554460131,
User Rank: Apprentice
10/19/2012 | 7:56:37 PM
re: What Huawei, ZTE Must Do To Regain Trust
Western countries have been known to initiate Cyber attack of other countries' facilities. China is using a lion share of US companies hardware and software (HP, Windows, INTEL, AMD,etc). On security grounds China could ban western hardware and software products. How many western companies do not have veterans working for them? Also which IT company has not been involved in intellectual properties (pattern) disputes?
vuil
50%
50%
vuil,
User Rank: Apprentice
10/17/2012 | 10:54:20 PM
re: What Huawei, ZTE Must Do To Regain Trust
When reading this article one can't help feeling soft violins should be playing in the background. Here's Claburn asking how a company that has ransacked and stolen ideas and intellectual property from the major network equipment houses (and even found guilty in a Chinese court) and Claburn wonders how they can be rehabilitated.

Well what about a less politically correct article saying we want nothing to do with Huawei and ZTE otherwise we are simply rewarding bad behavior.

There is still strong evidence that China is using network technology to spy on all and sundry both inside and outside China. Indeed there is evidence that there have been instances when China has rerouted network traffic for who knows what purpose.

Consider the following article:

http://www.nationaldefensemaga...

Come on Thomas, stop being so politically correct, grow some balls and state the reality as it is. You cannot trust these Chinese network companies.

Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

CVE-2014-6080
Published: 2014-12-18
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.