Huawei risk can be managed, say UK cyber-security chiefs

https://www.bbc.co.uk/news/business-47274643

by gadders • 7 years ago

35 56 7 years ago

bbc.co.uk

amelius• 7 years ago

Did they also consider DOS attacks of various kinds?

gadders• 7 years ago

Yeah. I mean one attack is eavesdropping on conversations, but almost as bad a threat would be to just remotely disable the equipment.

creato2• 7 years ago

Aren't most of the alternatives to Huawei EU companies? e.g. Ericsson, Nokia? If they are acknowledging there is a risk, why not buy from them instead?

setquk• 7 years ago

Probably costs more and after the recent cell network outage here, caused by a certificate failure, I think they prioritise availability over absolute security. Huawei seem to produce some half decent stuff aside from the security issue.

kingosticks2• 7 years ago

It's also a message to those EU companies they need to remain price competitive. You can surely get a better deal if you have Nokia and historically-cheap Huawei battling for your order.

entity3456• 7 years ago

There is always a risk from buying technology from suppliers you have no full control over.

This is Brexit. The UK is trying not to depend on the EU too much either and are actively trying to diversify.

notzuck• 7 years ago

Are you claiming security policy is being driven by a need to pull back from the EU? Who do you know at GCHQ?

Dahoon3• 7 years ago

Two things I have seen mentioned from industry people: Huawei is a lot better in R&D (use more money than Apple) and getting some feature you want deployed is easier and faster. Secondly Huawei is not only cheaper but also higher quality.

I know this doesn't fit with the witch hunt on Chinese companies the US is running but there you have it.

justinjlynn3• 7 years ago

Not only that, they also heavily benefit from the R&D done at other companies. Add in generous subsidies from their parent government and you have a very attractive commercial offering, certainly.

Indeed, this kind of money is rarely invested without a known, outsized, expected return and, in this, I seriously doubt Huawei and their owners are lacking in intelligence. I mean, who do we think they are - Winnie-the-Pooh?

coldtea• 7 years ago

Two things I have seen mentioned from industry people: Huawei is a lot better in R&D (use more money than Apple) and getting some feature you want deployed is easier and faster. Secondly Huawei is not only cheaper but also higher quality.

So much for China being inferior copycats then...

arethuza2• 7 years ago

"Managed" by who exactly?

thornjm• 7 years ago

Some context for those unfamiliar; Huawei and the UK government setup the “Huawei Cyber Security Evaluation Centre” to review Huawei device inner workings and updates before deploying in the UK.

Despite this, it sounds like the UK is still removing Huawei devices from the most critical areas of their networks.

entity3456• 7 years ago

The UK is in the midst of Brexit and is trying to increase trade with China. In addition, the Chinese seem the only ones able or willing to supply nuclear plants to the country...

They cannot afford to fall for the US-led hysteria.

alt_f4• 7 years ago

how does one manage a closed source binary with a backdoor in it in one's network equipment

arethuza2• 7 years ago

Probably by deploying another closed binary from a US supplier to "monitor" it.

unmole5• 7 years ago

CSEC has access to the code that is runs on Huawei's kit. Huawei is required to have reproducable builds to show that the code running in the network is the exactly same as what was vetted by CSEC.

roca5• 7 years ago

Which provides exactly no protection against hardware backdoors.

HCSEC had 30 staff in 2015. Are they claiming to have done a line-by-line audit of all Huawei's code by now?

skilled• 7 years ago

Looking forward to seeing Huawei OS being announced, and the backlash that is going to trigger across the whole world.

unmole5• 7 years ago

Huawei already has an OS for IoT applications: https://en.wikipedia.org/wiki/LiteOS

ShorsHammer• 7 years ago

Source code here: https://github.com/LiteOS/LiteOS

fredley• 7 years ago

This is interesting. What this says to me is that the UK is essentially saying to China "Yeah we'll play your game". They're expecting some sort of attack, but they reckon that they've got the capability (at GCHQ or wherever) to counter that, and possibly turn the tables by feeding back counterintelligence.

It could potentially be a good book in 1-200 years' time once all this is declassified.

unmole5• 7 years ago

Or, could it be possible that they audited the code and found no backdoors or security issues? Now that would be crazy! /s

giancarlostoro• 7 years ago

On that note, backdoors would either be hidden in proprietary apps, or delivered through OTA updates. Maybe a mix of both. I'd be interested in a diff of stock binaries vs recompiled "source" binaries to see if they differ significantly enough.

krona• 7 years ago

Not really. The public reports detail the altogether deficient way the hardware and software is being developed and manufactured. Hauwei know what they are and have failed to improve (much) over the past few years.

pjc50• 7 years ago

Years ago someone was telling me about the GCHQ facility at Martlesham Heath that was reverse-engineering all the incoming kit for use by BT. I think that pre-dated the Huawei Cyber Security Evaluation Centre in Banbury. HCSEC is a bit odd, it seems to be a joint venture between the fox and hens to guard the henhouse.

entity3456• 7 years ago

Everyone expects attacks from everyone else... And conducts attacks on everyone else.

tarcyanm• 7 years ago

The way I heard it is that the U.S. could not domestically provide an off the shelf end-to-end 5G solution. In addition, Huawei had at some point declined to install NSA backdoors. This was essentially the backdrop that led to Huawei being tarred and feathered.

doktrin3• 7 years ago

The way I heard it
In addition, Huawei had at some point declined to install NSA backdoors

I think a statement like this needs some corroboration beyond word of mouth

amaccuish• 7 years ago

I think a statement like this needs some corroboration beyond word of mouth

I'd like to see that same standard applied to the initial allegations against Huawei. Still no proof that they've done anything wrong.

bildung2• 7 years ago

Not GP, but I, too find it suspicious that e.g. Cisco, I direct competitor to Huawei, gets caught with yet another new backdoor almost monthly[1], and apparently the US administration has no qualms with buying Cisco hardware or with Cisco continuing to sell unsecure hardware worldwide.

[1] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

unmole5• 7 years ago

In the words of British Telecom's Chief Architect, "There is only one true 5G supplier right now and that is Huawei -- the others need to catch up."

https://www.lightreading.com/mobile/5g/bts-mcrae-huawei-is-t...

Huawei risk can be managed, say UK cyber-security chiefs

Related Stories