Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/10/2019
06:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Huawei Represents Massive Supply Chain Risk: Report

The Chinese technology giant's enormous product and service footprint gives it access to more data than almost any other single organization, Recorded Future says.

A new report from threat intelligence firm Recorded Future portrays Chinese technology giant Huawei as presenting a substantially bigger threat to US interests and organizations than currently perceived.

According to the firm, Huawei's enormous range of technologies and products and its global customer base has put the company in a position to access an unprecedented amount of information on organizations, governments, and people worldwide. Huawei's obligations to the Chinese government under various national security and related statutes puts that data at risk of interception and compromise, Recorded Future said.

"The position that Huawei occupies in China and its obligations under that government's laws and regulations cannot be minimized," warns Priscilla Moriuchi, director of strategic threat development at Recorded Future.

"Huawei, as a Chinese company, is not inherently malign," she acknowledges. "However, the people that compose Huawei will at some point likely be forced into making decisions that could compromise the integrity or corporate ambitions of their customers."

President Trump last month signed an executive order that effectively bans US government agencies from buying technologies that are owned by, controlled by, or subject to the laws of foreign adversaries.

The order cited concerns over the potential for foreign governments to force such vendors to use their technology to spy on US organizations and to conduct widespread espionage — via backdoors, for instance. The executive order also requires contractors that work with the federal government to jettison Huawei technologies from their infrastructure in a phased manner.  

The Trump administration's order did not explicitly name Huawei, or any other technology companies for that matter. But many see it as directed particularly at the Chinese technology vendor.

Over the past few years, US officials have openly expressed concern over what they perceive as Huawei's close ties to the Chinese government. The US has accused China of conducting widespread economic espionage for a long time. Last year, CNBC reported six US intelligence heads cautioning against the use of Huawei's phones in the US market because of such concerns. Recently, government officials and others have focused on the national security implications of Huawei's leadership in the 5G networking space. It has urged allies and governments around the world to stop using Huawei technology as well.

Huawei, for its part, has strongly denied accusations that it is working on behalf of the Chinese government or is supplying information to the government, as its critics have suggested. The company has described itself as a victim of a broader geopolitical battle between the US and Chinese governments. Huawei has suggested that at least some of the pushback from Western governments stems from its enormous success in the technology arena. The company is currently in the third spot behind Apple in the global smartphone market, and its technology is widely used across many parts of Asia.

"I would argue that we are beyond the point of needing specific evidence, and that we must address the question of Huawei risk comprehensively with the available data," says Moriuchi.

Broad and Growing Footprint
Huawei currently offers a broader range of technology products than almost any other company, including Western technology giants such as Microsoft and Apple. The company's portfolio includes broadband network components; cloud computing and storage technologies; infrastructure management software; network switches and routers; and mobile phones, laptops, and wearables. Many of these technologies are installed within organizations or are embedded in the networks of cloud service providers and other third parties, according to Recorded Future.

Huawei's technology is being used in so-called "safe city" surveillance programs in multiple cities around the world, and the company is aggressively expanding its presence in the core Internet routing space via undersea cables and fiber-optic technology.

Huawei's enormous footprint has given it access to more data than perhaps any single other organization. What makes that worrisome is that under Chinese laws passed since 2016, Huawei has a legal responsibility to provide access to and support the country's intelligence-gathering apparatus, Moriuchi says. "There is no legal mechanism in China for a company to challenge or contest a request by the intelligence and security services," she says.

Huawei has also benefited from government loans and received funding from China's military and intelligence agencies and over the years has benefited from government support and preferential treatment, Moriuchi claims.

For companies and individuals, the threat from Huawei can be distilled down to the risk to business and personal data, networks, intellectual property, and even long-term corporate viability. When deciding to use Huawei products, organizations need to figure out what their risk tolerance for monitoring, interference, or potentially sensitive data theft from China is. 

"If the risk threshold is low, we recommend that companies minimize the number of Huawei technologies and services within core or critical segments of their networks," Moriuchi advises.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-3931
PUBLISHED: 2020-07-08
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.