9

There has been a lot of news lately, and in the last few years, about Huawei being a security risk. Can someone explain what the basis is for the risk, other than speculation? Is there not a way to examine Huawei devices to see if there is indeed a chip, bootloader, backdoor, etc that could be exploited? What potential dangers exist in Huawei devices made in China, but not in other devices made in China, like those from Apple?

  • 1
    I think this is an interesting question and it would be appropriate here on SE, if you rephrased it to something like "are there really any security issues with Huawai that would justify what Trump said"? I'd be interested in knowing the opinion of security experts, NOT politicians or journalists. – reed Nov 24 '18 at 15:06
  • 1
    @reed: it is more a question of control. US fears that China controls Huawai and that's why it does not trust it. It also feels that Russia has control over Kaspersky and therefore similar distrust. This also goes the other way: US hardware and software is not fully trusted outside of US because one fears that the US has some control over it. Mutual distrust, some of it probably right and other maybe exaggerated to sell more of the own stuff inside the country. – Steffen Ullrich Nov 24 '18 at 15:23
  • 1
    Steffen, your description is exactly the type of commentary i'm frustrated with (and I say that with no malice!). It makes sense that the US's geopolitical enemies would use those avenues to conduct espionage, but where is the actual evidence? I mean, we have the devices in hand, is there a way we can physically examine them and say "ah ha! here, see!"? Can we quantify the very justified but generic "distrust" into something concrete? – BogBody Nov 24 '18 at 15:45
  • 1
    @BogBody the US is not in the habit of providing evidence for its allegations. That's probably because most of those are groundless and only made over geopolitical interests. And they don't have to be proven to yield gains. Huawei is growing fast and poses a real danger to large US money makers, but it is not like they can ban it over those concerns, that would look anti-competitive and bad, hence the espionage concerns and allegations, which make Huawei look bad instead, even if those allegations happen to be pure lies, but they are technically true and valid for EVERY device on the market... – dtech Nov 24 '18 at 15:55
  • 1
    @BogBody: we can at least quantify some distrust others have about products from US, i.e. Dual_EC_DRBG in products from RSA security, backdoors in Juniper VPN systems, backdoors in products from Cisco ... It is just logically to assume that others will try the same. – Steffen Ullrich Nov 24 '18 at 16:02
12

This article from the MIT Technology Review says that the U.K. has been vetting Huawei gear before deployment. It provides for only a limited level of assurance. The risks are loss of privacy, espionage, and sabotage.

I left the electronics/computer industry years ago but I think the following views are still applicable to the state of the art.

If espionage is intended, the manufacturer can make a device's code hard to access and inspect. A flash memory device might be part of a system-on-chip or system-in-package that obviates the need to present memory lines on the surfaces of the package. This would make code very inconvenient to access. In the extreme you may resort to using a scanning electron microscope (SEM). Courbon et al used a SEM to read a 210 nm flash memory. (The article is not dated but the most recent reference is from 2015 so the paper is at least as recent.) If you can access the code, you may then find that it was obfuscated. Obfuscated code is created when the programmer uses a program to turn the original code into a Rube Goldberg machine. Whether this is effective in hiding backdoors is debatable.

A custom chip can be a mystery. A chip "normal" in every way except identification looks like a mystery. A manufacturer can simply print phony or confusing identification on one or more of the devices on a board. A device can be made to look standard when it is in fact not. If any well funded entity were to invest in hiding or disguising functionality, it would take a huge amount of research to determine the "true circuit" of any single design . Until you know the true circuit, any inspection of the code provides no real assurance.

If you believe you need to go to much trouble to determine the true circuit and inspect code for a backdoor you may be better off just designing and building your own telecommunications equipment. More realistically you would install intrusive oversight in design, manufacturing, support, and updates and perhaps take over corporate governance through the nationalization of a maker.

If you are not going to be intrusive you are implicitly accepting a certain amount of risk and you are perhaps relying on commercial pressures to keep the manufacturer honest. That reliance might lead to disappointment.

If updates are disabled, you might conclude that a particular design is not a security risk after a certain amount of effort. You would not know if the effort made is insufficient and that a larger effort is needed. It may not be practical or even safe to disable updates. As soon as the code is updated you do not have any assurance. You may not be aware of the event of an update if the manufacturer tries to be stealthy.

  • Wish I could upvote this, but I don't have enough reputation. This is the answer i was looking for, thank you! – BogBody Dec 9 '18 at 0:54
  • @BogBody I want to add that users can choose to encrypt data. In that case the residual risk might be limited to sabotage or denial of service. – H2ONaCl Dec 11 '18 at 16:20
5

There is a lot of speculation based on intelligence that has not been explained. That's not nothing, but it also isn't something.

Can the phones be inspected? Yes, but only based on function. The problem is not a backdoor or a bootloader, and there would be no need to add a suspicious chip because malicious functionality can be baked in. Any regular calls home would also be detected.

The problem is with "sleeper" functions. Imagine the phone has a "dump all data to home" function that was not enabled until an update was applied by the manufacturer. The update itself need not be malicious, just configured in such a way to turn the sleeper function on. Then the phone contents are uploaded. It might be detected, but by that time, the damage is done.

Security depends a lot on trust, and if a vendor cannot be trusted, then it almost doesn't matter if it is possible to inspect the product; there are too many ways that the vendor can break whatever trust was granted.

  • 1
    I believe "sleeper" functions in hardware can actually be a threat to start worrying about. They are extremely hard to discover by researchers, and if nobody is using them maliciously the authors can always find some excuses (bug, feature yet to implement, etc.) and so scandals are less likely. Plus I'm sure lots of governments would consider them an awesome cyber-weapon to invest in. A "secret command" to massively brick devices is going to be useful during the highly-technological third world war. – reed Nov 24 '18 at 15:32
  • Ahh, okay. I wasn't aware (and none of the articles i've read have addressed) that these "sleeper" functions are undetectable. Could you walk me through a hypothetical undetectable "sleeper" function? Where would it exist within the phone or laptop? I guess I'm still a bit confused, because, for example, a Huawei laptop can have a fresh copy of Win10 reinstalled on it, yet it still remains a security risk, right? What parts of the laptop make it vulnerable? Where would the vulnerability be hiding, waiting for the wakeup call? – BogBody Nov 24 '18 at 15:50
  • 1
    @BogBody: one common way to hide such functionality is by reacting only to some magic network packets or packet sequence. A simple search will find many examples for this. Apart from that such backdoors can also be hidden as a bug which can be "unfortunately" give a remote user access to this system. Such bugs get regularly known in software, phones, routers, firewalls... But, only the ones who know these bugs can use these and with access to the source code it is more likely to find (or introduce) such bugs. – Steffen Ullrich Nov 24 '18 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.