British Spies Find Big Software Problems With Huawei

The British  spy agency GCHQ operate a secretive Huawei Cyber Security Evaluation Centre (HCSEC) known as The Cell located near Oxford. The Cell is operated by GCHQ with expert civilian personnel but in an unusual arrangement is actually funded by Huawei. Now, according to a recently published  Oversight Report, The Cell has found found severe problems with Huawei software, which it did not  first disclose to the Chines telecom giant.

Vulnerabilities are usually a result of software design failures which could allow hackers to conduct a cyber attack. Now, cyber security analysts at HCSEC who have investigated the Huawei equipment that is presently used  in the UK's telecommunications networks have discovered a "nationally significant" vulnerability.

There is current concern that Beijing could purposefully design some kind of deniable flaw in Huawei's equipment which it would know how to purposely use, but so far there is no proof that the Chinese Government were involved. The report says that the UK's National Cyber Security Centre (NCSC), a part of GCHQ, "does not believe that the defects identified are as a result of Chinese state interference", and adds that there is so far no evidence the vulnerabilities were exploited.

Instead, the agency reported that "poor software engineering and cyber security processes lead to security and quality issues, including vulnerabilities", and that "the increasing number and severity of vulnerabilities discovered" is of particular concern.

"If an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, they may be able to affect the operation of a UK network, in some cases causing it to cease operating correctly....Other impacts could include being able to access user traffic or reconfiguration of the network elements." the report says.

After the major vulnerability was first assessed by the UK's security services it was then reported to Huawei, in line with the HCSEC's normal vulnerability disclosure process. The Report says that the number of reported bugs and issues rose “significantly” over the past year, including the discovery of a vulnerability of “national significance” in 2019, although it’s not thought to have been exploited before being rectified.

While it is not being suggested that these issues were deliberately engineered by Huawei,  the HCSEC findings reflect negatively on its general competence in cybersecurity.

Code reviewers from the British National Cyber Security Centre (NCSC) found “evidence that Huawei continues to fail to follow its own internal secure coding guidelines. This is despite some minor improvements over previous years.” Additionally, the researchers said it had found more vulnerabilities during 2019 than it had in previous years.  The report adds that HCSEC "continues to reveal serious and systematic defects in Huawei's software engineering and cyber security competence", and warns that despite fixing specific issues when directed to do so, the agency has "no confidence that Huawei will effectively maintain components within its products".

Huawei said the report highlighted the company's "commitment to a process that guarantees openness and transparency, and demonstrates HCSEC has been an effective way to mitigate cyber security risks in the UK". 

Although similar vulnerabilities for rival companies which provide networking equipment, whether radio antennas or core switches and gateways, are often discovered, Huawei argues they do not get the same level of scrutiny.

US  restrictions on Huawei, that are said to be based on security grounds, although the company argued that it has been unfairly hit by the Trump administration's trade war, will prohibit US technology companies from providing components, such as computer chips, to the company.

As a result of these restrictions, the British government has ordered that all Huawei equipment must be stripped out of the UK's telecommunication networks by 2027, following NCSC's recommendation that it could no longer guarantee the security of Huawei's equipment if it was to adopt chips from less trusted manufacturers.

The revelation comes at a sensitive time for Huawei after the UK government decided to ban telecom operators from using its gear in their fifth-generation mobile networks. This was followed by the recent announcement  that British Telecom has dropped Huawei in favour of the Finnish company Nokia as its favoured supplier of 5G network infrastructure. 

The UK government is now understood to be reviewing Huawei’s role in supplying fixed-broadband infrastructure and the HCSEC Oversight Board said it “can only provide limited technical assurance in the security risk management of Huawei equipment in UK networks.”

NCSC:      Huawei:      Techround:        iPhoneInCanada:    Infosecurity Magazine:   Sky:      Huawei

You Might Also Read: 

France Begins Suspending Huawei:

 

« WEBINAR: Scale And Automate Your Edge Security
International Police Sting Operation Disrupts The Dark Web »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

IASME Consortium

IASME Consortium

IASME is one of five companies appointed as Accreditation Bodies for assessing and certifying against the UK Government's Cyber Essentials Scheme.

Proact IT Group

Proact IT Group

Proact is Europe's leading independent data centre and Cloud services enabler. We deliver flexible, accessible and secure IT solutions and services.

Flexential

Flexential

Flexential helps organizations optimize their journey of IT transformation while simultaneously balancing cost, scalability, compliance and security.

XLAB

XLAB

XLAB is an R&D company with a strong research background in the fields of distributed systems, cloud computing, security and dependability of systems.

HCC Embedded

HCC Embedded

HCC’s mission is to ensure that data stored or communicated by an embedded IoT application is secure, safe and reliable.

GoCyber

GoCyber

GoCyber is a new, highly innovative cyber security training app that uses action based learning to significantly improve the online behaviour of all employees in less than a month.

Alpine Cyber Solutions

Alpine Cyber Solutions

Alpine Cyber is a Managed IT Service Provider focused on cybersecurity and cloud services.

Quantifind

Quantifind

Quantifind enables financial crimes/fraud analysts and investigators to make better decisions, faster, with intelligent automation.

Salt Cybersecurity

Salt Cybersecurity

Salt Cybersecurity offer a four-pronged approach to information security that includes Custom Security Policy, Vulnerability Assessment, Threat Detection, and Security Awareness Training.

riskmethods

riskmethods

riskmethods helps you proactively identify, assess and mitigate supply chain risk. You need to master supply chain risk management—we can help.

Kontex

Kontex

Kontex is a Cyber Security consultancy creating resilient solutions. From Strategy, Advisory and Implementation to Management and everything in between.

Comparitech

Comparitech

Comparitech strives to promote cyber security and privacy for all. We are committed to providing detailed information to help our readers become more cyber secure and cyber aware.

Surefire Cyber

Surefire Cyber

Surefire Cyber delivers swift, strong response to cyber incidents such as ransomware, email compromise, malware, data theft, and other threats with end-to-end response capabilities.

Emtec

Emtec

Emtec’s cyber security team provides advisory, assessment, & managed security services that help you build the cyber security policies, toolsets & best practices to elevate your cyber security posture

Total Secure Technology

Total Secure Technology

Total Secure Technology provides trusted Managed IT Security and Managed IT Services for organizations looking to increase their cybersecurity defensive posture.

AI Safety Institute (AISI)

AI Safety Institute (AISI)

The AI Safety Institute’s mission is to minimise surprise to the UK and humanity from rapid and unexpected advances in AI.