China's Huawei, ZTE should be kept from U.S. - draft Congress report. - Page 1
Forum section: electronics / general

author: firewalker
author_rank: Super Contributor
timestamp: October 08, 2012, 05:37:43 pm
content: Quotehttp://www.reuters.com/article/2012/10/08/usa-china-huawei-zte-idUSL1E8L800L20121008Alexander.

author: T4P
author_rank: Super Contributor
timestamp: October 08, 2012, 06:07:08 pm
content: WTF is wrong with the Congress?

author: firewalker
author_rank: Super Contributor
timestamp: October 08, 2012, 06:12:25 pm
content: Quote from: T4P on October 08, 2012, 06:07:08 pmCISCO, Apple, AT&T, .... ,.Alexander.

author: poptones
author_rank: Frequent Contributor
timestamp: October 08, 2012, 06:49:02 pm
content: I don't see how this has NOT been an issue until now. Even China is not so stupid, they've officially abandoned Windows long ago for fear it would allow US spying. Yet here we go, bouncing along like bunny frou frou, just waiting to be scooped and banged on the head...

author: PeterG
author_rank: Frequent Contributor
timestamp: October 08, 2012, 06:57:10 pm
content: I am thinking congress has realised China has the potential to cripple Americas electronic industry so they are playing the FUD game.Regards

author: poptones
author_rank: Frequent Contributor
timestamp: October 08, 2012, 07:04:07 pm
content: Apple sells hundreds of Millions of computers a year. How is this not a security issue?Sure would be nice to have those manufacturing jobs back home.

author: HardBoot
author_rank: Regular Contributor
timestamp: October 08, 2012, 07:07:17 pm
content: Huawei makes some great stuff, lots of anti-competition against them.TP-LINK is a good cheapy brand, surprised they aren't being targeted too.Basically all of the stuff uses Linux, free distros with poorly made frontends... security isn't too disastrous.

author: Monkeh
author_rank: Super Contributor
timestamp: October 08, 2012, 07:30:40 pm
content: Quote from: HardBoot on October 08, 2012, 07:07:17 pmThey do a lot of custom (and generallyillegal) modifications for which there is no security auditing.

author: HardBoot
author_rank: Regular Contributor
timestamp: October 08, 2012, 07:34:34 pm
content: Quote from: Monkeh on October 08, 2012, 07:30:40 pmWell I see a lot of stuff running as root, but it still requires the off-the-shelf open source software to have holes to be discovered and exploited.What do you mean by illegal modifications?

author: poptones
author_rank: Frequent Contributor
timestamp: October 08, 2012, 07:37:47 pm
content: Umm. does it really need to be said that linux cannot be assured secure if you're running a binary blob as a driver?

author: Monkeh
author_rank: Super Contributor
timestamp: October 08, 2012, 07:42:53 pm
content: Quote from: HardBoot on October 08, 2012, 07:34:34 pmI mean violating the GPL by building binaries into the kernel and modifying the kernel and other software without providing the source.Quote from: poptones on October 08, 2012, 07:37:47 pmApparently, yes.

author: Bored@Work
author_rank: Super Contributor
timestamp: October 08, 2012, 08:04:33 pm
content: Quote from: HardBoot on October 08, 2012, 07:07:17 pmFirst, because this is not about consumer equipment. Consumer equipment like cell phones or home routers is just peanuts. This is about infrastructure equipment.Second, because Huawei has an extremely bad reputation. When you have a bad reputation suddenly everything looks suspicious. E.g. the link to the PLA. No one would probably ask about that if they had an otherwise spotless reputation.I have friends working in the telecommunication industry. They all claim the well known case of Huawei copying Cisco routers, hardware, firmware, even copying the documentation 1:1, was just the tip of the iceberg. They all had stories about friendly Chinese interns dutifully doing their work and attentively listening. And then disappearing the minute their contract was up. Month later the design appeared copied in China.This is how Huawei gained their bad reputation, by copying. I don't think the US wants to protect US industries. There isn't much to protect. Non of the really big players is a pure US company. Looking at the runner-ups, Ericsson is Swedish. Alcatel-Lucent is a French/American mix (and the US government helping the French? I doubt it). Nokia Siemens Networks is Finnish/German. And these are the big players, not Motorola (split, parts now with Google), Nortel (Canadian and bankrupt), not even Cisco is playing in the Huawei league.

author: poptones
author_rank: Frequent Contributor
timestamp: October 08, 2012, 08:09:43 pm
content: Being able to root half the home routers in the US would be a LOT of peanuts.But what really cares me is all the weaponized shit running Windows.

author: Monkeh
author_rank: Super Contributor
timestamp: October 08, 2012, 08:14:29 pm
content: Quote from: poptones on October 08, 2012, 08:09:43 pmThat's what bothers me about BT using Hauwei for their infrastructure here in the UK. Who knows whether they can flip the off switch and cripple us.

author: HardBoot
author_rank: Regular Contributor
timestamp: October 08, 2012, 10:26:17 pm
content: My ISP and the datacentres I use use their own in-house firmware as much as possible for performance and cost reasons, only really simple things that are inherently not exploitable(like dummy switching) are running stock firmwares and still tweaked... no web interface, all controlled with offline serial.I'm sure a lot, maybe even the majority of telcos are embarrassingly insecure... but all it takes to scare them straight is good ol' getting hacked.Even though a lot of routers run root software... what's accessible without being logged in is limited, not much to break into. A lot are crap, but som aren't too easy to get into without having a physical unit to study to see how insecure it is.My router runs OpenWRT(other has Tomato) and has some common sense settings.I'm probably underestimating the stupidity of programmers... but it isn't that hard safely managing communication... just handle all possible input.You have different types of packet... TCP/UDP, they're examined and sent in whichever direction, no security problems there. THe problems are with all of the services, but those are easily sandboxed so even if the code is faulty nothing can happen beyond spamming junk out and the OS can call BS pretty easily and take the service down.

author: nukie
author_rank: Frequent Contributor
timestamp: October 09, 2012, 12:15:03 am
content: Just look at what Huawei did to Vodafone, for those of you who live in Aussieland.... disaster

author: TerminalJack505
author_rank: Super Contributor
timestamp: October 09, 2012, 12:38:24 am
content: It turned out to be a bad day for ZTE. In addition to the report from congress,Cisco dropped ZTE. Cisco claims ZTE sold American hardware to Iran in defiance of sanctions.

author: G7PSK
author_rank: Super Contributor
timestamp: October 09, 2012, 07:56:39 am
content: Huawei make equipment for BT here in the UK and not long ago questions were raised about security due to the founder and chairman of Huawei being a former head of intelligence in China.Not sure why they suddenly got worried as Huawei have been supplying equipment for some years to BT and other company's as well as a big chunk of the domestic market if they were planting bugs into the equipment there must be millions of them already out there, and I am sure that exchange equipment would be rigorously checked for such things by BT during installation.

author: poptones
author_rank: Frequent Contributor
timestamp: October 09, 2012, 08:31:30 am
content: how are they gonna check for backdoors if it's all proprietary?

author: G7PSK
author_rank: Super Contributor
timestamp: October 09, 2012, 05:26:51 pm
content: My understanding was that BT would give Huawei the design to build rather than just an off the peg.

author: Monkeh
author_rank: Super Contributor
timestamp: October 09, 2012, 05:30:54 pm
content: Quote from: G7PSK on October 09, 2012, 07:56:39 amUhm, he was a researcher in the PLA, not a head of intelligence.QuoteDuring installation, really? I'm sure the people installing them are fully qualified to decompile the code and run through it.

author: saturation
author_rank: Super Contributor
timestamp: October 09, 2012, 10:14:09 pm
content: Summary of international issues here:http://en.wikipedia.org/wiki/Huawei#Controversy_and_response_to_criticism

author: asbokid
author_rank: Regular Contributor
timestamp: October 10, 2012, 09:28:28 pm
content: Quote from: Monkeh on October 08, 2012, 07:42:53 pmIf we're talking about CPE here - Huawei modems and routers used in the home - whose binary driver blobs are they?!Answer.. the blobs are supplied by the SoC maker: Broadcom Corporation - At a guess, some 95% of Huawei's CPE kit uses SoC from Broadcom's MIPS-powered BCM63xx series. Broadcom is, of course, a US$18bn NASDAQ-quoted Yankee corporation...Ooops, there goes that silly conspiracy theory of Congress! Besides, it would take a very clever bugger to hide spyware in the DSP layer.cheers, a

author: poptones
author_rank: Frequent Contributor
timestamp: October 10, 2012, 11:14:04 pm
content: One of the most common network exploits now is through fracking printer drivers.If I have access to the data bus, I own you.

author: asbokid
author_rank: Regular Contributor
timestamp: October 10, 2012, 11:34:34 pm
content: No great worries with printer drivers and broadband CPE. The biggest security risk is probably default passwords. There are one or two network exploits for CPE. e.g. there must be quite a few old routers still running vulnerable versions of dnsmasq, for example. And then there's TR069 and CWMP - a purpose built backdoor into most routers. Intended for firmware upgrades and for the telco to get line statistics, etc. Great idea so long as the encryption key remains secure. For years now, British Telecom has used the same 2048 bit RSA public key in its routers. It must be securing literally millions of devices. God knows what would happen if the corresponding private key was cracked or fell into the wrong hands.cheers, a

author: poptones
author_rank: Frequent Contributor
timestamp: October 11, 2012, 12:59:55 am
content: No, you don't understand.Install a corrupted printer driver. Done.

author: asbokid
author_rank: Regular Contributor
timestamp: October 11, 2012, 01:44:33 am
content: Oo-err! Thanks for the heads-up. I'll spam the bastards by printing all the datasheets I can find!cheers, a