Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Security Expert: Huawei Routers Riddled With Vulnerabilities

Unknown Lamer posted about 2 years ago | from the more-like-riddled-with-features dept.

Security 126

sabri writes "Cnet reports that German security expert Felix Lindner has unearthed several vulnerabilities in Huawei's carrier grade routers. These vulnerabilities could potentially enable attackers, or the Chinese government, to snoop on users' traffic and/or perform a man-in-the-middle attack. While these routers are mostly in use in Asia, Africa and the Middle East, they are increasingly being used in other parts of the world as well, because of their dirt-cheap pricing. Disclaimer: I work for one of their competitors." Via the H, you can check out the presentation slides. Yesterday Huawei issued a statement 'We are aware of the media reports on security vulnerabilities in some small Huawei routers and are verifying these claims...'

cancel ×

126 comments

Sorry! There are no comments related to the filter you selected.

WHA !! CHINA COMPANY OWNS YOU ?? (-1)

Anonymous Coward | about 2 years ago | (#40854765)

How can this be ?? Chinese girls are boys, but still, how can this be ??

Re:WHA !! CHINA COMPANY OWNS YOU ?? (0)

Anonymous Coward | about 2 years ago | (#40854923)

It be because it is.

Bah (-1)

Anonymous Coward | about 2 years ago | (#40854769)

Dirty evil chinese commie bastards, can't trust em as far as you could throw em!

This doesn't surprise me... (1)

Anonymous Coward | about 2 years ago | (#40854837)

I've always hated Huawei because their products seem inferior. This just reinforces that. I'm not surprised at all.

Re:This doesn't surprise me... (1)

Xest (935314) | about 2 years ago | (#40855387)

I'll be honest, despite them being such a massive firm, and having heard about them many hundreds of times on Slashdot, I've never actually seen a peice of Huawei kit here in the UK.

Are they just not particularly prominent in the UK market? or are they one of those firms who let others rebrand their kit?

The reason I ask is because I don't want to inadvertantly use their kit - if it's been rebranded to something else I want to avoid it. If it doesn't get rebranded then I guess I'm okay, because encountering Huawei kit seems to be an uncommon thing here in the UK anyway, though if they do have a decent prescence in our market, I'd be intrigued to know where (e.g. do certain ISPs provide Huawei routers?, or do certain industry sectors use their other networking kit more than others?).

Re:This doesn't surprise me... (5, Interesting)

Anonymous Coward | about 2 years ago | (#40855547)

They do usually rebrand their stuff. Some "lower-end" mobile phones, probably ones that carry the operator's brand name and not the manufacturer's, are likely to be made by Huawei or similar companies (ZTE, as another example).

Another reason Huawei is so cheap is because they don't "innovate" like (most?) Western companies do. They kinda consider R&D to be a profit center and will not move an inch to develop something that is not _known_ to be profitable. I have first-hand experience with this. I work for Huawei. There!, I said it.

Most customer meetings we have involve going to ask for requirements that they can be sent back up the chain to HQ (R&D) to get started on the development. Seriously. Our Chinese bosses (can't call them managers) and counterparts (some of the "local" staff have a Chinese "mirror") are constantly asking to find the customer's Strategy for a particular product/service and what the business model is going to be....even from technical staff at the customer.

I recently ready this article http://www.brookings.edu/research/articles/2012/07/10-china-multinationals-shambaugh and it paints a pretty accurate picture of my everyday life working here.

As much as they "sell" the idea of being a communist country, they are still very much a feudal culture with a close-minded and I'm-never-ever-wrong-because-I'm-the-boss mentality. And it'll catch up to them...soon

When people mention something about the Chinese taking over the world, I worry too. Just for very different reasons.

(Posted as AC ((from work)) for obvious reasons)

Re:This doesn't surprise me... (3, Interesting)

Anonymous Coward | about 2 years ago | (#40855581)

Oh, and the R&D guys that I've met, look like they're fresh out of the University (or ...idk) and no one has bothered to create any formal programming practices or the like...which is why I totally believe the comment about security coding practices being from 15 years ago.

Re:This doesn't surprise me... (3, Interesting)

faedle (114018) | about 2 years ago | (#40856901)

It is catching up to them.

I work for a telecom company that has a significant investment in Huawei gear. Their equipment often has serious bugs, and upper management is starting to notice that the ability of the service and support teams to "do their jobs" is being hurt by Huawei's bugs, and we're seriously entertaining bids from other vendors.

The sad part is that their equipment is SO much cheaper than anything else on the market.. I don't know if we could afford to even convert a fraction of our gear to some other vendor. The economics of the business is such that we couldn't afford to provide the service at the prices we charge without using the cheapest option available.

Re:This doesn't surprise me... (1)

pnutjam (523990) | about 2 years ago | (#40857109)

This is one of those chicken and egg problems, you have priced yourself low, driving others out of the business and now realize you are too low, along comes better service. Either from you, or someone else.

Re:This doesn't surprise me... (4, Interesting)

JDG1980 (2438906) | about 2 years ago | (#40857023)

From the article you linked [brookings.edu] :

Chinese business culture values interpersonal over institutional relationships, and business decisions are often oriented towards short-term profit. There is also a lack of transparency and oversight, which has been linked to a high degree of corruption.

Right, because stuff like that would never happen in the United States...

Re:This doesn't surprise me... (1)

airdweller (1816958) | about 2 years ago | (#40857515)

It does happen in the US too, but on a much smaller scale.

Re:This doesn't surprise me... (1)

Anonymous Coward | about 2 years ago | (#40857063)

Hey, Joe, did you notice the bit at the top of the page about how Huawei gear allows snooping on users' traffic?

Guess what kind of gear we use here at Huawei.

Please step into my office.

Your boss

My own Huwei tax is paid-up. (3, Informative)

SpzToid (869795) | about 2 years ago | (#40855651)

My gargantuan 3g USB-dongle mandated with my subscription from Telfort in the Netherlands is from Huwei. But I never use it, and instead have placed the SIM inside my Nokia N9 (which also tethers nicely). Still, I am claiming the Huwei tax here in the Netherlands

Re:This doesn't surprise me... (1)

SpooForBrains (771537) | about 2 years ago | (#40856051)

Huawei make the 3 "MiFi", the original generation at least and probably the rest too. They also make 3G dongles.

Re:This doesn't surprise me... (0)

Anonymous Coward | about 2 years ago | (#40858167)

Actually, I believe that was Novatel...and then Huawei came out with a similar product...*cough* copy *cough*

Re:This doesn't surprise me... (1)

AlecC (512609) | about 2 years ago | (#40856291)

My Vodafone dongle and 3 MiFi are both relabelled Huawei products. I think there are a lot of them around, but rebranded by the phone companies.

Re:This doesn't surprise me... (1)

galaad2 (847861) | about 2 years ago | (#40856589)

many Vodafone-branded devices across the entire Europe are actually huawei devices, especially those usb 3G+ hsdpa/hsupa wireless modems that look like fattened usb drives.
If you have one look on its back and it's almost guaranteed to see the label that says it's made by huawei.
Also, the installation package for Vodafone Mobile Connect (their connectivity management software) has most of its drivers made by huawei.

Re:This doesn't surprise me... (0)

Anonymous Coward | about 2 years ago | (#40855901)

Yeah right. Like Cisco products have less backdoors than Microsoft's products...

Well... (4, Insightful)

AngryDeuce (2205124) | about 2 years ago | (#40854841)

You get what you pay for. Who would trust this craptastic bargain basement shit anyway? When something is being sold for a much lower price then competing products, there is a reason for it.

Re:Well... (2, Insightful)

1u3hr (530656) | about 2 years ago | (#40854897)

When something is being sold for a much lower price then competing products, there is a reason for it.

Yeah, they cloned the designs. Which is naughty, but doesn't mean they don't work exactly the same as the original version.

Re:Well... (4, Funny)

AngryDeuce (2205124) | about 2 years ago | (#40854963)

Yeah, exactly the same, except for all the deliberately inserted vulnerabilities. What a bargain!

Re:Well... (3, Insightful)

poity (465672) | about 2 years ago | (#40855227)

Well, they could just as likely be inadvertent vulnerabilities due to Huawei not diligently copying the newest firmware code from Cisco.

Re:Well... (1)

AngryDeuce (2205124) | about 2 years ago | (#40855951)

Whether due to incompetence or malice, it still screams Caveat Emptor, and most people should know better. Even before this particular story broke, how many /.'ers were considering buying network hardware from this company? Probably not many. Most reasonable people can see a deal that is too good to be true.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40856433)

Not diligently copying?

Wouldn't that cause some Cisco vulnerabilities to be missed?

Re:Well... (1)

zlives (2009072) | about 2 years ago | (#40858073)

why copy when they can hire laid off cisco programmers for cheap...

Re:Well... (1)

UnknowingFool (672806) | about 2 years ago | (#40855253)

They think they cloned the designs at some level. They may not have gotten all the details right. Remember capacitor plague [wikipedia.org] ? That was a case of industrial theft of a electrolytic formula however the formula was incomplete. It wasn't until about 2000 hours into operation that problems would occur.

Re:Well... (1, Insightful)

obarthelemy (160321) | about 2 years ago | (#40854903)

Yep. That's what Linux is so crappy compared to Windows. Oh, wait...

Re:Well... (1)

AngryDeuce (2205124) | about 2 years ago | (#40854955)

I highly doubt the motivations behind the low price of Linux as compared to the low price of these Chinese shit-tier routers are one and the same, which I'm betting you damn well know yourself, but if you want to play the 'feigned ignorance' game, you go for it buddy.

Would you buy electronics out of the back of a van? It could be legit, amirite?

Re:Well... (1)

obarthelemy (160321) | about 2 years ago | (#40858599)

You're confusing distribution channels, products, hardware, software...

Regarding the "more expensive is always better": no it isn't. There are oodles of examples where paying more is just being a sucker, not getting more quality/features/service. Yep, I'm thinking of Hi-Fi ethernet cables; of the no-name champagne that was ranked higher than almost all brands in a blind test, of linux vs windows.

To stay in the "router" market, don't forget Cisco treated their customers to a forced update that forced them to manage their routers via cisco's servers, and sign over rights to their traffic info. I'd rather have a few bugs in my firmware and no spying+cloud dependency, thank you. Especially at 1/10th the price.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40854997)

Does it make a difference if the device is wide open because nobody closed all the doors (east) or because someone opened a backdoor (west)? The most sensible requirement is that a router should be able to run OpenWRT. The hardware works, it just needs better software. If that's available, who cares that the vendor-supplied software is shit?

Re:Well... (1)

khallow (566160) | about 2 years ago | (#40855055)

Unless, of course, the hardware itself has built in vulnerabilities. Then better software isn't good enough.

Re:Well... (3, Insightful)

fuzzyfuzzyfungus (1223518) | about 2 years ago | (#40855155)

Does it make a difference if the device is wide open because nobody closed all the doors (east) or because someone opened a backdoor (west)?

In practice, it almost certainly does: Vulnerabilities are exploitable by anybody who knows about them and cares to do so. That is a fairly long list of the world's spook shops, spammers, questionably socialized teenagers, and so forth. Law enforcement backdoors(unless they are also badly implemented and vulnerable) are exploitable by the law enforcement of your given jurisdiction. Not wildly comforting; but it is a shorter list...

You would hardly call me a friend of CALEA and its analogs; but surveillance-under-color-of-law does have the advantage, from a security perspective, of essentially making the local feds users, rather than attackers, of the system. If they already get what they want, they have no incentive to weaken the security mechanisms in order to get what they want(and, indeed, if they want exclusivity, they have an interest in keeping their competitors out). It doesn't help the little people on the end of the wire all that much, of course.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40855811)

Those are not the kind of backdoors I meant. I had things like WPS-PIN in mind, which is designed to be broken. Remember how you could disable WPS in Linksys routers and they would accept WPS requests anyway? That kind of backdoor.

Re:Well... (1)

h4rr4r (612664) | about 2 years ago | (#40855021)

I strongly disagree. I can name many 6 figure software products that are worse than a free option in every way. I can name hardware that is similar.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40855077)

Go on then, name them.

Re:Well... (1)

h4rr4r (612664) | about 2 years ago | (#40855211)

Lets just say the call center world is full of them. CXM, Click, the list goes on and on. Generally the more it costs the less users, this means little testing gets done.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40855365)

CXM, Click, the list goes on and on.

Yet your list stopped at two examples. I'm not necessarily disagreeing with you, but I highly doubt Huawei is releasing these bargain basement routers because they want to give back to the world. If you want to believe that, that's your prerogative, but frankly, I don't fucking trust them. The motivations behind, say, the Raspberry Pi people and Huawei, are likely very different. Call that racist or Anti-Chinese if you want, but with all the industrial espionage and hacking originating from there, I would think that would be a consideration to anyone that's reasonably competent.

Re:Well... (1)

h4rr4r (612664) | about 2 years ago | (#40856385)

That is not what I am saying at all.
What i am saying is some cheap things are better than some expensive things.

My list is two, because that is enough to be more than $500k worth of shit.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40855367)

Who would trust this craptastic bargain basement shit anyway?

A government office for example. Here you have people making IT decisions who don't have a fucking clue.
Work for the government for a few months and you'll soon realize why our country is so fucked up.

Re:Well... (1)

CuriousGeorge113 (47122) | about 2 years ago | (#40855565)

Tell that to finance. Or a school board. Or any media "investigative reporter" looking for a ratings bump during sweeps week.

In any public sector, low price almost always wins, because it's safe. Not necessarily for the organization, but definitely for the IT or CIO's job. If shit hits the fan, they can almost always pass the blame and keep their job. Except when it comes to money and (perceived) overspending and waste.

Re:Well... (0)

Anonymous Coward | about 2 years ago | (#40855757)

What did you expect? You didn't really think Cisco was going to allow them to keep stealing their source time and time again?

Re:Well... (1)

mcgrew (92797) | about 2 years ago | (#40857107)

You get what you pay for.

...says the lemon salesman at the used car lot. No, that's backwards. A bottle of Alieve costs three times as much as the generic and it's the same drug. You're paying for pain relief and led to believe that Alieve is superior to the generic, when it may have come from the same factory.

You pay for what you get. You only get what you pay for if you're lucky. Item A costing more than item B is no gurantee that item A is superior to item B, and in fact the cheaper alternative may in fact be the better choice.

Determining whether or not you're getting what you paid for is difficult. In this case, it's pretty obvious that these cheap routers are in fact bad.

Oh, one more little correction that I hope you will appreciate: When something is being sold for a much lower price then [sic] competing products, there is a reason for it.

Than

Re:Well... (1)

coastwalker (307620) | about 2 years ago | (#40858473)

There are well established security testing methods such as FIPs certification. It cost money to implement defenses and it costs money to do the testing. That is often what you are paying for in more expensive products. You will also probably get hardware that works over a wider temperature range and a product that has been through accellerated life testing and meets the published specification on every single unit made. Take your pick, you can buy products cheaply that usually do the job without problems or you can pay more and get product that is guaranteed to do what it is specified to do and wont have any wrinkles like potential security vunerabilities. There are markets for both kinds of product, you need to pick the one that fits your use case.

Re:Well... (1)

JDG1980 (2438906) | about 2 years ago | (#40857151)

You get what you pay for. Who would trust this craptastic bargain basement shit anyway? When something is being sold for a much lower price then competing products, there is a reason for it.

That's not always the case; sometimes certain companies really do offer better price/performance ratio than others. One example I've seen is in the area of woodworking tools. Companies like Delta and Powermatic used to make stationary power tools in the USA; these were built like tanks, priced high but great quality. Then in the mid-1990s they got greedy and started outsourcing production to Taiwan and mainland China, but the prices remained the same. Today even the company names are owned by multinational conglomerates, but they still price as if they were doing things the old way. (There is one exception: Delta's top-end table saw is made in America.) Sometime after this happened, a new company called Grizzly started in the power tool business. They also produced their tools in Taiwan/China, but unlike the legacy players, they passed the cost savings on to customers. (It also helped that they sell exclusively online, rather than through dealers.) From everything I've heard and seen, Grizzly tools really do offer better price/performance than the traditional brands. They generally get good ratings and good recommendations on boards and forums. (And the CEO actually participates in at least one woodworking forum and sometimes personally intervenes if customers are having problems.) Many of the designs are copied from existing designs (the power tool field is far less patent-encumbered than IT, and many designs haven't changed in decades anyway). And the quality seems to be on par with what the other companies are putting out from the same or similar factories.

summary is racist (0, Flamebait)

1u3hr (530656) | about 2 years ago | (#40854859)

could potentially enable attackers, or the Chinese government, to snoop on users' traffic

If they exist they would allow ANYBODY to snoop on users' traffic. What is this, SlashFox? How about "could potentially enable attackers, or PRESIDENT BARACK HUSSEIN OBAMA to snoop on users' traffic!." or "could potentially enable attackers, or homesexuals, to snoop on users' traffic".

Re:summary is racist (3, Funny)

Anonymous Coward | about 2 years ago | (#40854887)

Nice try, Chinese government.

Re:summary is racist (1)

JohnnyMindcrime (2487092) | about 2 years ago | (#40854943)

Agreed. Someone in Slashdot needs to read up on the differences between "vulnerability" and "back door".

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855053)

Agreed. Someone in Slashdot needs to read up on the differences between "vulnerability" and "back door".

You're kidding right? A "vulnerability" is sometimes a well-hidden "back door". That's how I build them.

Re:summary is racist (3, Informative)

JohnnyMindcrime (2487092) | about 2 years ago | (#40855099)

Actually, a back door is deliberately created to allow specific people to come into the system - like a known account name with a known password. Just because you know the back door is there doesn't mean you can use it if you don't know the user and password.

A vulnerability tends to be as a result of poor design or a software bug - and not usually placed deliberately.

That's a clear distinction...

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855305)

However, what looks like an unintended security flaw is also the best backdoor, obviously. Because sooner or later someone is going to find it.

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40856333)

The people making the backdoors aren't stupid. They hide their backdoors in plain sight, because nobody's looking, and if somebody happens to look anyway, it's always an oversight, a lapse, an oopsie. If somebody should find additional user accounts, you're busted. If someone finds a bug that allows you access to any system you sold, you apologize, fix that one and nobody's the wiser. That's how it's done.

Re:summary is racist (1)

Sponge Bath (413667) | about 2 years ago | (#40855143)

Jim Sting: Mister Potato Head! Mister Potato Head! Back doors are not secrets!
Malvin: Yeah, but Jim, you're giving away all our best tricks!

Re:summary is racist (0)

h4rr4r (612664) | about 2 years ago | (#40855041)

When did Chinese become a race?
I would suggest it is instead biased against the Chinese as a nation not as a people.

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855331)

The proper term is xenuphobe, as described herein:
http://en.wikipedia.org/wiki/Xenu [wikipedia.org] (+ phobe to be precise).

man, they need to bring back those commercials... (0)

Anonymous Coward | about 2 years ago | (#40855511)

http://en.wikipedia.org/wiki/Xenu

You got your thetans in my peanutbutter!

Re:summary is racist (1)

Bill, Shooter of Bul (629286) | about 2 years ago | (#40855397)

Furthermore, when did hating a government mean you hated the people it governed?

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855515)

Furthermore, when did hating a government mean you hated the people it governed?

when the people support the government and any and all viewpoints are based that everyone else is inferior because they can steal, copy and not spend a dime on r&d while fueling the globalization market crisis.

So, f@#$ off taliban commie nazi flag waver. :)

And have a nice day.

Re:summary is racist (2)

1u3hr (530656) | about 2 years ago | (#40856375)

When did Chinese become a race?

I'd guess at least 10,000 years ago. The Chinese certainly think they are a "race". Google "ethnic Chinese" and argue with the 2 million hits.

Anyway, racism or just flamebait, it's an accusation without a shred of proof. Yes, we know that the Chinese govt isn't above a bit of techno-espionage, but still PROVE IT FIRST.

Re:summary is racist (-1)

Anonymous Coward | about 2 years ago | (#40855043)

The Chinese government are not attackers, the US government are. I'm not sure about homosexuals, I think it's optional.

Re:summary is racist (1, Funny)

fa2k (881632) | about 2 years ago | (#40855295)

Well it's nothing compared to the slides. When research is presented in such a xenophobic, childish way, it makes it hard to take it seriously (and this cyber* stuff is potentially very serious) Slashdot, being a news organisation and not a hackers shold be held to a higher standard, though.

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855341)

Since when is Slashdot a news organization?

Re:summary is racist (5, Insightful)

SoupIsGood Food (1179) | about 2 years ago | (#40855329)

First, I don't think you are working from a good definition of "racist." If someone insinuated that Cisco had a backdoor deal with the NSA, I doubt people would be screaming "racist" or even do anything more than shrug and frown. It's sound strategy, and the Chinese government is very good at infosec and cyberwar - the reason why people are up in arms isn't because the Chinese are a different race, it's that the Chinese government has been caught repeatedly engaging in corporate espionage as well as old fashioned espionage, where the US generally only bothers with the latter.

Second, almost anyone who has a real infrastructure to protect knows that Huawei works arm-in-arm (or hand-in-pocket, more likely) with the 7th Bureau of the 3rd People's Liberation Army, the Chinese military infosec unit responsible for network penetration. The 7B3PLA has investments all through China's technology sector, to the point where individual chips on routers made elsewhere need to be vetted, as they might be compromised from the factory, and counterfeit devices are a real issue.

Again, not a race issue. China is a global power, and it's acting like one with a solid strategy. It's likewise a solid strategy to avoid cheap off-brand network equipment for your infrastructure. TANSTAAFL, you get what you pay for.

Re:summary is racist (1)

drkstr1 (2072368) | about 2 years ago | (#40856045)

Well said. Thanks.

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40856361)

the Chinese government has been caught repeatedly engaging in corporate espionage as well as old fashioned espionage, where the US generally only bothers with the latter.

How is that not modded funny?

Re:summary is racist (1)

1u3hr (530656) | about 2 years ago | (#40856505)

not a race issue"

Right. Well, I guess to Americans, "racism" means using the "N word" or the "J word" Prejudice against foreigners is just good sense.

The summary leaps from a statement that a vulnerability has been found to implying that a foreign power is using it for espionage. Without bothering to establish that ANY espionage has taken place at all, let alone who might have dome it. But feel free to "Kill them all and let God sort them out".

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40857269)

Actually the are a few documented cases were the CIA was doing commercial espionage for the aircraft and autombile industries. Although you said 'generally' maybe the commericial espionage was accidential, as-in, the CIA was capturing foreign communications anyway and they found some useful things in there they could forward to some US companies, for no cost.

Re:summary is racist (1)

Bill, Shooter of Bul (629286) | about 2 years ago | (#40855389)

Well, aside from your crazy definition of what racism is ( I hate the syrian government, therefore I must be racist?), its also a stupid summary. The Chinese government already can do pretty much what ever the f*ck it wants to inside its own borders. I'm not sure they really care about any traffic from Africa or the Middle east, maybe the rest of Asia, but I'd imagine they'd already have good info through other means. If they were really trying to do bad stuff they wouldn't put vulnerabilities into an untrusted brand, they'd put them into cisco or juniper that would be used by higher valued targets.

Re:summary is racist (2)

ColdWetDog (752185) | about 2 years ago | (#40856617)

I'm not sure they really care about any traffic from Africa or the Middle east, maybe the rest of Asia, but I'd imagine they'd already have good info through other means.

Au contraire, China does care about Africa and the Middle East. Very much so. One word:

Resources.

The ME still has lots of the black stuff. That's still very important. China uses a lot of black stuff, wants more, wants a long term supply (just like everyone else). Increasing one's ability to sniff out the various issues surrounding oil and politics in the ME is important to any major country, China included.

Africa is becoming a new area of opportunity for China. After the West has fucked over the continent for several centuries, the Chinese see a chance to 'help' while continuing to extract resources. The fact that they are more willing to overlook certain ethical constraints puts them at a definite advantage. For more info, return to your search engine of choice - lots of stuff out there.

Re:summary is racist (2)

poity (465672) | about 2 years ago | (#40855411)

I wouldn't call this racist. Racist would be saying that this event is evidence that Chinese people are inherently secretive/exploitative/dubious in nature. If someone says that, then I'd be on your side. However, the line you quoted is no different from 99% of the first post comments here on stories about the US government doing something /. doesn't like. Unless you and the mods who have modded you up are prepared to reject all of those past comments as racist (or having some other population-based prejudice) as well, then your claim has no basis.

Re:summary is racist (1)

poity (465672) | about 2 years ago | (#40855439)

I'd like to also mention that those epic first post screeds are usually rated +5.

Re:summary is racist (1)

1u3hr (530656) | about 2 years ago | (#40856521)

Well, fuck, I only got +3. I should have been more over the top.

Re:summary is racist (1)

defender.tx (2699199) | about 2 years ago | (#40855469)

I don't think that the summary is racist at all. Making a conjecture that a Chinese IT company, owned by an Ex-Chinese military officer, is purposefully leaving vulnerabilities in it's products that the Chinese government can exploit is sensational, but not racist.

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855939)

Not racist. Prejudiced, Xenophobic, or just lame.

Re:summary is racist (0)

Anonymous Coward | about 2 years ago | (#40855995)

Isn't Huawei part owned by the Chinese government?

FTW (0)

rmdingler (1955220) | about 2 years ago | (#40854909)

So these Chinese Olympians are the rule rather than the exception? Crazytown!

And how is this different from any other vendor? (2)

pointyhat (2649443) | about 2 years ago | (#40854929)

Cisco, Juniper, HP, Nortel, Ericsson are all proprietary black boxes as well. Perhaps they all have vulnerabilities like this? We will never know but perhaps our governments do?

Unfortunately, it's a niche and there are no open source carrier grade router platforms :(

It is different, if you work in the field. (2)

Moskit (32486) | about 2 years ago | (#40857693)

It's different because Cisco publicly announces their security advisories and publishes security bug information. Full disclosures:
http://www.cisco.com/en/US/products/products_security_advisories_listing.html [cisco.com]

Other companies (such as Juniper) are a bit less public, but seem to offer more information than Huawei to their customers too:
http://s-tools1.juniper.net/support/security/report_vulnerability.html [juniper.net]

The CIA did it! (0)

Anonymous Coward | about 2 years ago | (#40854931)

The CIA did it in order to enable them to snoop on Chinese traffic!

I do not see any bug/hacks of carrier grade router (1)

Anonymous Coward | about 2 years ago | (#40855029)

I used a NE40 for a couple of weeks to determine if it was worth buying instead of Juniper for our network. I decided against it but I have to admit for the price it
did pretty much everything we would want it to do. The hardware build quality left a lot to be desired and it was only 32 bit CPU so the memory would never be
able to be upgraded past 4 gigs so we passed.

But to hack a few small SOHO routers and then make the claim carrier grade gear is also just as bad without ever touching or using it? I think that is pretty sad.
Does one find a bug in some crappy apache module and then make the claim apache itself is also poor? No. So why here?

I do use Huawei sonet gear though. Great bang for the buck, reliable, and just works.

Tank Man is not surprised (3)

cryfreedomlove (929828) | about 2 years ago | (#40855213)

Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank [wikipedia.org] than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.

Re:Tank Man is not surprised (3, Insightful)

sociocapitalist (2471722) | about 2 years ago | (#40856219)

Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank [wikipedia.org] than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.

It would be nice to think that by working for American companies you wouldn't be also be behind the controls of the tanks, but unfortunately that's not the case.

Re:Tank Man is not surprised (1)

cryfreedomlove (929828) | about 2 years ago | (#40858111)

Huawei is heavily recruiting software developers in the Silicon Valley right now. They contacted me. I did not seriously consider it. In this picture, I identify more with the man in front of the tank [wikipedia.org] than I do with the guys driving the tanks. To spend my life working for Huawei would figuratively put me behind the controls of the tanks.

It would be nice to think that by working for American companies you wouldn't be also be behind the controls of the tanks, but unfortunately that's not the case.

I'm against injustice, regardless of whether it is committed by Americans or Chinese or anyone else. You seem to be arguing that crushing children with tanks at Tiananmen Square was morally allowed because the USA government has been known to also have moral failures. That's an interesting world view on your part.

Get the slant on the wogs (1)

noshellswill (598066) | about 2 years ago | (#40855313)

You wanted wog products ... you got wog products. Time for a rigid, nationalist tariff solution that fyucks cosmopolitan globalist investors in the a**whole? Youbetcha!

Re:Get the slant on the wogs (1)

couchslug (175151) | about 2 years ago | (#40856347)

Americans want "cheap" and don't give a fuck.

This country is getting what its public, ALL of us, deserve.

Inaction is consent.

read the slides (0)

Anonymous Coward | about 2 years ago | (#40855451)

'We are aware of the media reports on security vulnerabilities in some small Huawei routers and are verifying these claims...'

The only systems that were tested were low end because they were not able to get there hands on Huawei's high end products...

Hahaha. "Security experts" these days... (3, Interesting)

X.25 (255792) | about 2 years ago | (#40855501)

And hundreds of vulnerabilities in Cisco IOS were somehow different, of course.

But of course, their vulnerabilities were not related to 'Chinese government' and wouldn't make 'news for retards'.

Sigh.

Re:Hahaha. "Security experts" these days... (2)

zlives (2009072) | about 2 years ago | (#40858155)

"Unless and until Huawei becomes a stand-alone widely held listed company with employees free to trade their shares and without a controlling shareholder, these suspicions and allegations will likely continue,"
http://www.itnews.com.au/News/175946,analysis-who-really-owns-huawei.aspx [itnews.com.au]

Are you all dense???? (0)

Anonymous Coward | about 2 years ago | (#40855551)

HUAWEI is SPONSORED by the GOVERNMENT. It is NOT a corporate entity, it is an EXTENSION of the government.

That said, hell, not a bad way to protect your citizens from corporate imperialism...

Neil saw it right, grand-kids are going to inhert SNOWCRASH.

This IS an instance where.... (3, Insightful)

Lumpy (12016) | about 2 years ago | (#40855571)

You get what you pay for.... Honestly if they are cheaper than d-Link, something must be wrong.

It's just like buying your servers from Happy Fun server company. What did you expect you were getting for $49.95?

Re:This IS an instance where.... (0)

Anonymous Coward | about 2 years ago | (#40856679)

Do not taunt Happy Fun server company!

Beware FiOS free routers (2)

THE_WELL_HUNG_OYSTER (2473494) | about 2 years ago | (#40855705)

When you subscribe to Verizon FiOS, Verizon gives you a free ActionTec wifi router with custom firmware. No doubt it has similar backdoors.

Oh Yeah? (1)

Greyfox (87712) | about 2 years ago | (#40855773)

And their competitors are not? [wikipedia.org] In fact, to hear one of their competitors talk about it, if Huawei hardware is riddled with holes, it's only because they copied all those holes (Along with everything else) from their competitor!

Their competitor's hardware [scribd.com] is truly a masterpiece of engineering, and if you're an engineer you may find it to be beautiful. I always thought they should ditch the custom VM, provide some kernel modules and ioctls for the special hardware functionality and do all their programming in C or C++, though. It's kind of hard going back to something like PLEX after programming with pretty much any other language from 1960 on.

The axe (heh heh) their competitor has to grind with Hauwei may very well be a legitimate one. There always were some shenanigans going on. Unfortunately I really don't have a lot of power over what phone switches get used anywhere, so there's not much I can do about it. I do think this possibly-unfair competition has driven more feature development than we might have seen had Hauwei not been playing their little game. So maybe in the end it's not all bad, even if it's not particularly good.

Deceptive title (1)

kelemvor4 (1980226) | about 2 years ago | (#40857037)

The title of this article seems a little deceptive to me. Not that I have a particular fondness for some Chinese router company, but I think this should have been titled "Competitor: Huawei Routers Riddled With Vulnerabilities".

Stereotypical (0)

Anonymous Coward | about 2 years ago | (#40857331)

Having interacted with Huawei folks over the years they are nice people and driven but holy shit are they sloppy.

I don't know what environmental pressures coincide to make them think lax QA and programming standards is acceptable behavior.. if they expect to be taken seriously they need to get their shit together.

Since day one.. (0)

Anonymous Coward | about 2 years ago | (#40857437)

I've said it anonymously on /. since day one but Huawei is a state company whose sole purpose is to spy on citizens / companies / other states worldwide.

Recurity (1)

LeadSongDog (1120683) | about 2 years ago | (#40857541)

Cnet reports that German security expert Felix Lindner has...

Some expert. Now everyone knows who he is. Oh, wait, now I get it....

Safe assumption (1)

ThatsNotPudding (1045640) | about 2 years ago | (#40858063)

I think the safe (and honest) assumption should be that anything coming out of a shipping container that can rub two chips together is a possible attack vector of the PRC. They are the ultimate and most effective sleeper agents ever created.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>