Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/10/2019
06:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Huawei Represents Massive Supply Chain Risk: Report

The Chinese technology giant's enormous product and service footprint gives it access to more data than almost any other single organization, Recorded Future says.

A new report from threat intelligence firm Recorded Future portrays Chinese technology giant Huawei as presenting a substantially bigger threat to US interests and organizations than currently perceived.

According to the firm, Huawei's enormous range of technologies and products and its global customer base has put the company in a position to access an unprecedented amount of information on organizations, governments, and people worldwide. Huawei's obligations to the Chinese government under various national security and related statutes puts that data at risk of interception and compromise, Recorded Future said.

"The position that Huawei occupies in China and its obligations under that government's laws and regulations cannot be minimized," warns Priscilla Moriuchi, director of strategic threat development at Recorded Future.

"Huawei, as a Chinese company, is not inherently malign," she acknowledges. "However, the people that compose Huawei will at some point likely be forced into making decisions that could compromise the integrity or corporate ambitions of their customers."

President Trump last month signed an executive order that effectively bans US government agencies from buying technologies that are owned by, controlled by, or subject to the laws of foreign adversaries.

The order cited concerns over the potential for foreign governments to force such vendors to use their technology to spy on US organizations and to conduct widespread espionage — via backdoors, for instance. The executive order also requires contractors that work with the federal government to jettison Huawei technologies from their infrastructure in a phased manner.  

The Trump administration's order did not explicitly name Huawei, or any other technology companies for that matter. But many see it as directed particularly at the Chinese technology vendor.

Over the past few years, US officials have openly expressed concern over what they perceive as Huawei's close ties to the Chinese government. The US has accused China of conducting widespread economic espionage for a long time. Last year, CNBC reported six US intelligence heads cautioning against the use of Huawei's phones in the US market because of such concerns. Recently, government officials and others have focused on the national security implications of Huawei's leadership in the 5G networking space. It has urged allies and governments around the world to stop using Huawei technology as well.

Huawei, for its part, has strongly denied accusations that it is working on behalf of the Chinese government or is supplying information to the government, as its critics have suggested. The company has described itself as a victim of a broader geopolitical battle between the US and Chinese governments. Huawei has suggested that at least some of the pushback from Western governments stems from its enormous success in the technology arena. The company is currently in the third spot behind Apple in the global smartphone market, and its technology is widely used across many parts of Asia.

"I would argue that we are beyond the point of needing specific evidence, and that we must address the question of Huawei risk comprehensively with the available data," says Moriuchi.

Broad and Growing Footprint
Huawei currently offers a broader range of technology products than almost any other company, including Western technology giants such as Microsoft and Apple. The company's portfolio includes broadband network components; cloud computing and storage technologies; infrastructure management software; network switches and routers; and mobile phones, laptops, and wearables. Many of these technologies are installed within organizations or are embedded in the networks of cloud service providers and other third parties, according to Recorded Future.

Huawei's technology is being used in so-called "safe city" surveillance programs in multiple cities around the world, and the company is aggressively expanding its presence in the core Internet routing space via undersea cables and fiber-optic technology.

Huawei's enormous footprint has given it access to more data than perhaps any single other organization. What makes that worrisome is that under Chinese laws passed since 2016, Huawei has a legal responsibility to provide access to and support the country's intelligence-gathering apparatus, Moriuchi says. "There is no legal mechanism in China for a company to challenge or contest a request by the intelligence and security services," she says.

Huawei has also benefited from government loans and received funding from China's military and intelligence agencies and over the years has benefited from government support and preferential treatment, Moriuchi claims.

For companies and individuals, the threat from Huawei can be distilled down to the risk to business and personal data, networks, intellectual property, and even long-term corporate viability. When deciding to use Huawei products, organizations need to figure out what their risk tolerance for monitoring, interference, or potentially sensitive data theft from China is. 

"If the risk threshold is low, we recommend that companies minimize the number of Huawei technologies and services within core or critical segments of their networks," Moriuchi advises.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.