British Spies Find Big Software Problems With Huawei

The British  spy agency GCHQ operate a secretive Huawei Cyber Security Evaluation Centre (HCSEC) known as The Cell located near Oxford. The Cell is operated by GCHQ with expert civilian personnel but in an unusual arrangement is actually funded by Huawei. Now, according to a recently published  Oversight Report, The Cell has found found severe problems with Huawei software, which it did not  first disclose to the Chines telecom giant.

Vulnerabilities are usually a result of software design failures which could allow hackers to conduct a cyber attack. Now, cyber security analysts at HCSEC who have investigated the Huawei equipment that is presently used  in the UK's telecommunications networks have discovered a "nationally significant" vulnerability.

There is current concern that Beijing could purposefully design some kind of deniable flaw in Huawei's equipment which it would know how to purposely use, but so far there is no proof that the Chinese Government were involved. The report says that the UK's National Cyber Security Centre (NCSC), a part of GCHQ, "does not believe that the defects identified are as a result of Chinese state interference", and adds that there is so far no evidence the vulnerabilities were exploited.

Instead, the agency reported that "poor software engineering and cyber security processes lead to security and quality issues, including vulnerabilities", and that "the increasing number and severity of vulnerabilities discovered" is of particular concern.

"If an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, they may be able to affect the operation of a UK network, in some cases causing it to cease operating correctly....Other impacts could include being able to access user traffic or reconfiguration of the network elements." the report says.

After the major vulnerability was first assessed by the UK's security services it was then reported to Huawei, in line with the HCSEC's normal vulnerability disclosure process. The Report says that the number of reported bugs and issues rose “significantly” over the past year, including the discovery of a vulnerability of “national significance” in 2019, although it’s not thought to have been exploited before being rectified.

While it is not being suggested that these issues were deliberately engineered by Huawei,  the HCSEC findings reflect negatively on its general competence in cybersecurity.

Code reviewers from the British National Cyber Security Centre (NCSC) found “evidence that Huawei continues to fail to follow its own internal secure coding guidelines. This is despite some minor improvements over previous years.” Additionally, the researchers said it had found more vulnerabilities during 2019 than it had in previous years.  The report adds that HCSEC "continues to reveal serious and systematic defects in Huawei's software engineering and cyber security competence", and warns that despite fixing specific issues when directed to do so, the agency has "no confidence that Huawei will effectively maintain components within its products".

Huawei said the report highlighted the company's "commitment to a process that guarantees openness and transparency, and demonstrates HCSEC has been an effective way to mitigate cyber security risks in the UK". 

Although similar vulnerabilities for rival companies which provide networking equipment, whether radio antennas or core switches and gateways, are often discovered, Huawei argues they do not get the same level of scrutiny.

US  restrictions on Huawei, that are said to be based on security grounds, although the company argued that it has been unfairly hit by the Trump administration's trade war, will prohibit US technology companies from providing components, such as computer chips, to the company.

As a result of these restrictions, the British government has ordered that all Huawei equipment must be stripped out of the UK's telecommunication networks by 2027, following NCSC's recommendation that it could no longer guarantee the security of Huawei's equipment if it was to adopt chips from less trusted manufacturers.

The revelation comes at a sensitive time for Huawei after the UK government decided to ban telecom operators from using its gear in their fifth-generation mobile networks. This was followed by the recent announcement  that British Telecom has dropped Huawei in favour of the Finnish company Nokia as its favoured supplier of 5G network infrastructure. 

The UK government is now understood to be reviewing Huawei’s role in supplying fixed-broadband infrastructure and the HCSEC Oversight Board said it “can only provide limited technical assurance in the security risk management of Huawei equipment in UK networks.”

NCSC:      Huawei:      Techround:        iPhoneInCanada:    Infosecurity Magazine:   Sky:      Huawei

You Might Also Read: 

France Begins Suspending Huawei:

 

« WEBINAR: Scale And Automate Your Edge Security
International Police Sting Operation Disrupts The Dark Web »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Quantivate

Quantivate

Quantivate is a provider of web-based Governance, Risk, and Compliance (GRC) software and service solutions.

7Safe

7Safe

7Safe has been delivering hands-on digital security training courses since 2001 and offer e a portfolio of university and industry-accredited courses.

SparkCognition

SparkCognition

SparkCognition’s AI-powered solutions enhance cybersecurity, identify and prevent equipment failures before they happen, and provide prescriptive intelligence for maintaining your most critical assets

Versa Networks

Versa Networks

Versa is a software-defined networking vendor providing an end-to-end solution that both simplifies and secures the WAN/branch office network.

Learning Tree International

Learning Tree International

Learning Tree's comprehensive cyber security training curriculum includes specialised IT security training and general cyber security courses for all levels of your organisation including the C-suite.

VXRL

VXRL

VXRL is a Hong Kong-based cybersecurity company. We provide consulting services, penetration testing, and corporate training.

Securden

Securden

Securden provide an all-in-one Platform for Next-Gen Privileged Access Governance, helping you to prevent identity thefts, malware propagation, cyber attacks, and insider exploitation.

Activu

Activu

Activu makes any information visible, collaborative, and proactive for people tasked with monitoring critical operations including network security.

Nigerian Communications Commission (NCC)

Nigerian Communications Commission (NCC)

NCC has established a CSIRT for the telecommunication industry to provide services and support for the prevention and management of potential cyber security related emergencies.

Trustmarque

Trustmarque

Trustmarque delivers customer-centric IT solutions that enable better outcomes. We combine the technology, expertise and services to release value at every stage of the IT lifecycle.

Hook Security

Hook Security

Setting a new standard in security awareness. Hook Security is a people-first company that uses psychological security training to help companies create security-aware culture.

Darknone Global

Darknone Global

Darknone is a consortium of elite hackers and security leaders united by an unbridled passion for augmenting the security of the digital realm.

Paramount Defenses

Paramount Defenses

Paramount Defenses have unrivaled capability in two of the most critical areas in cyber security today – Active Directory Security and Privileged Access.

Kolide

Kolide

Kolide ensures that if a device isn't secure, it can't access your apps.

Grypho5

Grypho5

Grypho5 offers managed packages to protect where threat actors strike most. We defend your infrastructure dynamically, leaving you to focus on other priorities.

Core42

Core42

Core42 provides a full-spectrum of AI enablement solutions covering cloud, data, cybersecurity and digital services designed for customer success.