Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

> is there any hard evidence that huawei is a legitimate security concern?

Yes, quite a bit [1]. Here’s an apolitical example:

“In July 2012, Felix Lindner and Gregor Kopf gave a conference at Defcon to announce that they uncovered several critical vulnerabilities in Huawei routers (models AR18 and AR29)which could be used to get remote access to the device. The researchers said that Huawei ‘doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates’, and as a result, the vulnerabilities have not been publicly disclosed.”

In summary, the best case is Huawei is incompetent.

[1] https://en.m.wikipedia.org/wiki/Huawei#Controversies

View on HN

To be fair, their main competitor, Cisco, has had a significant number of hardcoded password backdoors found in their products. While their reporting and patching story is better, their security track record is still awful. It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco. The real difference would be if they were actively aiding espionage, which has been talked about a lot but never backed up with evidence.

https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

> It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco

Given “Cisco [has previosuly] revealed parts of [an] independent expert's report produced for [a] case which proved that Huawei had stolen Cisco code and directly copied it into their products,” that wouldn’t be surprising.

At the end of the day, you have a company with strong links (down to its founder) to the military of an adversarial dictatorship and which has been proven to have violated international sanctions with Iran, North Korea, Syria and Venezuela. This isn’t a “beyond reasonable doubt” criminal case. It’s a reasonable weighing of odds determination.

[1] https://en.m.wikipedia.org/wiki/Huawei

Also not wrong. But the US, while not a dictatorship, and with its own share of problematic foreign policy, has been caught with its hand in the security cookie jar.

DUAL_EC_DRBG was included in BSAFE and Juniper products. So even if we assume the worst of Huawei, it's really a matter of which back door you want in your networking equipment. My hope is that these constant accusations make Huawei drive big improvements in reproducible builds, source-available software, and verifiable hardware. But I'm not holding my breath.

Then again, at the end of the day, you have companies with strong links to an adversarial government and which has been proven to have conducted economic espionage for the benefit of domestic companies, regularly violated (and violates) human rights, overthrown elected governments, invaded countries under false pretenses, and sentence people to death without a fair trial. If that's your line of logic, then there's more than enough shit to go around. Both sides are shitty.

The point being made is that industry-level security is not real evidence of malicious behavior on huawei's part. If you want people to avoid huawei, present proof.

> At the end of the day, you have a company with strong links (down to its founder) to the military

This sort of pure propaganda just undermines your case. The founder of Huawei was never more than a low level engineer in the military, was forbidden from joining the CCP for many years [1].

[1] https://en.wikipedia.org/wiki/Ren_Zhengfei

> was forbidden from joining the CCP for many years

He was banned and then “selected as a delegate from PLA to attend the National Science Conference” all before founding Huawei.

https://en.m.wikipedia.org/wiki/Ren_Zhengfei

It's one thing Huawei's products have severe vulnerabilities (as every other IT companies do), and another thing the company is actively engaging in espionage.

If this is the best hard evidence the US can bring forward, then the whole allegation sounds entirely political-driven.

If you can't tell, does it matter? If you're hoping for espionage to be obvious and blatant, I think you must be underestimating people's creativity.

Then we shouldn't deal with Cisco, Juniper, and pretty much every other network equipment manufacturer.

What kind of logic is that?

Trust is not binary.

I fail to see how this ties into your original point.

It's this kind of logic: it depends on whether you believe the US is as big of a security or IP-theft threat to you as China is. Your premise relies on the US == China. If that isn't the case, your premise collapses in one form or another.

Taiwan, Japan and South Korea aren't afraid of the US. They are afraid of China.

Finland, Romania, Poland, Ukraine and Estonia aren't afraid the US will invade and annex their territory. They are afraid of Russia's territorial ambitions in Eastern Europe.

For example, how do you think Australia feels about it right now?

"China’s peak security agency has directed a surge in cyber attacks on Australian companies over the past year, breaching an agreement struck between Premier Li Keqiang and former Prime Minister Malcolm Turnbull to not steal each other’s commercial secrets."

https://www.smh.com.au/business/companies/china-uses-the-clo...

"China reportedly steps up efforts to steal Australian company secrets"

https://www.cnbc.com/2018/11/21/cybersecurity-china-reported...

All I and others are asking for is some hard evidence. Either the company is engaged in unsavory behavior or it is not. You can't be ambiguous about this and expect people to play along.

Given how easy it should be for a capable government like the US to find something like this (especially given how common huawei gear is) and how "friendly" the US has been with China, I would expect to have seen at least some evidence surface by now. In fact, I would take the lack of evidence as a testimony to the innocence of huawei and the security of their hardware.

In saner times, the US government would put forward evidence and experts in an open hearing.

https://en.m.wikipedia.org/wiki/USS_Maine_(ACR-1)#Investigat...

If you think that demonstrates a legitimate security concern then every telecom manufacturer is a security concern. Spend some time comparing the known security issues with Huawei routers to Cisco's routers for example.

Reply on news.ycombinator.com