Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/10/2019
06:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Huawei Represents Massive Supply Chain Risk: Report

The Chinese technology giant's enormous product and service footprint gives it access to more data than almost any other single organization, Recorded Future says.

A new report from threat intelligence firm Recorded Future portrays Chinese technology giant Huawei as presenting a substantially bigger threat to US interests and organizations than currently perceived.

According to the firm, Huawei's enormous range of technologies and products and its global customer base has put the company in a position to access an unprecedented amount of information on organizations, governments, and people worldwide. Huawei's obligations to the Chinese government under various national security and related statutes puts that data at risk of interception and compromise, Recorded Future said.

"The position that Huawei occupies in China and its obligations under that government's laws and regulations cannot be minimized," warns Priscilla Moriuchi, director of strategic threat development at Recorded Future.

"Huawei, as a Chinese company, is not inherently malign," she acknowledges. "However, the people that compose Huawei will at some point likely be forced into making decisions that could compromise the integrity or corporate ambitions of their customers."

President Trump last month signed an executive order that effectively bans US government agencies from buying technologies that are owned by, controlled by, or subject to the laws of foreign adversaries.

The order cited concerns over the potential for foreign governments to force such vendors to use their technology to spy on US organizations and to conduct widespread espionage — via backdoors, for instance. The executive order also requires contractors that work with the federal government to jettison Huawei technologies from their infrastructure in a phased manner.  

The Trump administration's order did not explicitly name Huawei, or any other technology companies for that matter. But many see it as directed particularly at the Chinese technology vendor.

Over the past few years, US officials have openly expressed concern over what they perceive as Huawei's close ties to the Chinese government. The US has accused China of conducting widespread economic espionage for a long time. Last year, CNBC reported six US intelligence heads cautioning against the use of Huawei's phones in the US market because of such concerns. Recently, government officials and others have focused on the national security implications of Huawei's leadership in the 5G networking space. It has urged allies and governments around the world to stop using Huawei technology as well.

Huawei, for its part, has strongly denied accusations that it is working on behalf of the Chinese government or is supplying information to the government, as its critics have suggested. The company has described itself as a victim of a broader geopolitical battle between the US and Chinese governments. Huawei has suggested that at least some of the pushback from Western governments stems from its enormous success in the technology arena. The company is currently in the third spot behind Apple in the global smartphone market, and its technology is widely used across many parts of Asia.

"I would argue that we are beyond the point of needing specific evidence, and that we must address the question of Huawei risk comprehensively with the available data," says Moriuchi.

Broad and Growing Footprint
Huawei currently offers a broader range of technology products than almost any other company, including Western technology giants such as Microsoft and Apple. The company's portfolio includes broadband network components; cloud computing and storage technologies; infrastructure management software; network switches and routers; and mobile phones, laptops, and wearables. Many of these technologies are installed within organizations or are embedded in the networks of cloud service providers and other third parties, according to Recorded Future.

Huawei's technology is being used in so-called "safe city" surveillance programs in multiple cities around the world, and the company is aggressively expanding its presence in the core Internet routing space via undersea cables and fiber-optic technology.

Huawei's enormous footprint has given it access to more data than perhaps any single other organization. What makes that worrisome is that under Chinese laws passed since 2016, Huawei has a legal responsibility to provide access to and support the country's intelligence-gathering apparatus, Moriuchi says. "There is no legal mechanism in China for a company to challenge or contest a request by the intelligence and security services," she says.

Huawei has also benefited from government loans and received funding from China's military and intelligence agencies and over the years has benefited from government support and preferential treatment, Moriuchi claims.

For companies and individuals, the threat from Huawei can be distilled down to the risk to business and personal data, networks, intellectual property, and even long-term corporate viability. When deciding to use Huawei products, organizations need to figure out what their risk tolerance for monitoring, interference, or potentially sensitive data theft from China is. 

"If the risk threshold is low, we recommend that companies minimize the number of Huawei technologies and services within core or critical segments of their networks," Moriuchi advises.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.