British Spies Find Big Software Problems With Huawei

The British  spy agency GCHQ operate a secretive Huawei Cyber Security Evaluation Centre (HCSEC) known as The Cell located near Oxford. The Cell is operated by GCHQ with expert civilian personnel but in an unusual arrangement is actually funded by Huawei. Now, according to a recently published  Oversight Report, The Cell has found found severe problems with Huawei software, which it did not  first disclose to the Chines telecom giant.

Vulnerabilities are usually a result of software design failures which could allow hackers to conduct a cyber attack. Now, cyber security analysts at HCSEC who have investigated the Huawei equipment that is presently used  in the UK's telecommunications networks have discovered a "nationally significant" vulnerability.

There is current concern that Beijing could purposefully design some kind of deniable flaw in Huawei's equipment which it would know how to purposely use, but so far there is no proof that the Chinese Government were involved. The report says that the UK's National Cyber Security Centre (NCSC), a part of GCHQ, "does not believe that the defects identified are as a result of Chinese state interference", and adds that there is so far no evidence the vulnerabilities were exploited.

Instead, the agency reported that "poor software engineering and cyber security processes lead to security and quality issues, including vulnerabilities", and that "the increasing number and severity of vulnerabilities discovered" is of particular concern.

"If an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, they may be able to affect the operation of a UK network, in some cases causing it to cease operating correctly....Other impacts could include being able to access user traffic or reconfiguration of the network elements." the report says.

After the major vulnerability was first assessed by the UK's security services it was then reported to Huawei, in line with the HCSEC's normal vulnerability disclosure process. The Report says that the number of reported bugs and issues rose “significantly” over the past year, including the discovery of a vulnerability of “national significance” in 2019, although it’s not thought to have been exploited before being rectified.

While it is not being suggested that these issues were deliberately engineered by Huawei,  the HCSEC findings reflect negatively on its general competence in cybersecurity.

Code reviewers from the British National Cyber Security Centre (NCSC) found “evidence that Huawei continues to fail to follow its own internal secure coding guidelines. This is despite some minor improvements over previous years.” Additionally, the researchers said it had found more vulnerabilities during 2019 than it had in previous years.  The report adds that HCSEC "continues to reveal serious and systematic defects in Huawei's software engineering and cyber security competence", and warns that despite fixing specific issues when directed to do so, the agency has "no confidence that Huawei will effectively maintain components within its products".

Huawei said the report highlighted the company's "commitment to a process that guarantees openness and transparency, and demonstrates HCSEC has been an effective way to mitigate cyber security risks in the UK". 

Although similar vulnerabilities for rival companies which provide networking equipment, whether radio antennas or core switches and gateways, are often discovered, Huawei argues they do not get the same level of scrutiny.

US  restrictions on Huawei, that are said to be based on security grounds, although the company argued that it has been unfairly hit by the Trump administration's trade war, will prohibit US technology companies from providing components, such as computer chips, to the company.

As a result of these restrictions, the British government has ordered that all Huawei equipment must be stripped out of the UK's telecommunication networks by 2027, following NCSC's recommendation that it could no longer guarantee the security of Huawei's equipment if it was to adopt chips from less trusted manufacturers.

The revelation comes at a sensitive time for Huawei after the UK government decided to ban telecom operators from using its gear in their fifth-generation mobile networks. This was followed by the recent announcement  that British Telecom has dropped Huawei in favour of the Finnish company Nokia as its favoured supplier of 5G network infrastructure. 

The UK government is now understood to be reviewing Huawei’s role in supplying fixed-broadband infrastructure and the HCSEC Oversight Board said it “can only provide limited technical assurance in the security risk management of Huawei equipment in UK networks.”

NCSC:      Huawei:      Techround:        iPhoneInCanada:    Infosecurity Magazine:   Sky:      Huawei

You Might Also Read: 

France Begins Suspending Huawei:

 

« WEBINAR: Scale And Automate Your Edge Security
International Police Sting Operation Disrupts The Dark Web »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Bishop Fox

Bishop Fox

Bishop Fox is a leading authority in offensive security, providing solutions ranging from continuous penetration testing and attack surface management to product and application security assessments.

PhishLabs

PhishLabs

PhishLabs provides 24/7 services that help organizations protect against the cyberattacks targeting their employees, their customers and their brands.

Entersekt

Entersekt

Entersekt is an innovator in push-based authentication and app security.

Herbert Smith Freehills

Herbert Smith Freehills

Herbert Smith Freehills is a leading professional services including data protection and privacy.

BIND 4.0

BIND 4.0

Bind 4.0 is an acceleration program geared toward tech startups with solutions applied to Advanced Manufacturing, Smart Energy, Health Tech or Food Tech fields.

SpecterOps

SpecterOps

SpecterOps has unique insight into the cyber adversary mindset and brings the highest caliber, most experienced resources to assess your organizations defenses.

ITSEC Asia

ITSEC Asia

ITSEC Asia works to effectively reduce exposure to information security threats and improve the effectiveness of its clients' information security management systems.

Rocky Mountain Cybersecurity

Rocky Mountain Cybersecurity

Rocky Mountain Cybersecurity's mission is to provide value by dramatically improving the cybersecurity posture of our clients and business partners.

Emtec

Emtec

Emtec’s cyber security team provides advisory, assessment, & managed security services that help you build the cyber security policies, toolsets & best practices to elevate your cyber security posture

Nicoll Curtin

Nicoll Curtin

Nicoll Curtin is a global company with over 20 years of experience in connecting outstanding talent with industry leading companies within Technology, Change and Cyber Security.

Cyber Capital Partners

Cyber Capital Partners

Cyber Capital Partners build strategic and financial partnerships with small and mid-sized cybersecurity companies in highly regulated markets.

Sev1Tech

Sev1Tech

Sev1Tech is a leading provider of IT modernization, cloud, cybersecurity, engineering, fielding, training, and program support services.

Gleam Cloud Security Solutions (GCSS)

Gleam Cloud Security Solutions (GCSS)

GCSS Security is an information security firm providing cyber security protection with a highly skilled and experienced team focused on technology that creates best-in-class customer experiences.

Trium Cyber

Trium Cyber

Trium Cyber - Expert Cyber Underwriting and Claims Management. Based in the US and UK. Backed by Lloyd’s of London.

Linx Security

Linx Security

The Linx Identity Security platform enables identity, security, and IT ops teams to finally control the whole identity lifecycle.

Archipelo

Archipelo

At Archipelo, we empower organizations with Developer Security - to increase software security and compliance throughout the development lifecycle.