Hacker News Reader

Comment by nimbius | Hacker News Reader

is there any hard evidence that huawei is a legitimate security concern? Checking the wiki it seems like this is the commerce department trying to piss in the cheerios of a company that doesnt subscribe to the jackboot regimes of US foreign and copyright policy. theyve sold to iran, and have been accused of industrial espionage, but Symantec sold to iran and violated the GPL numerous times without so much as a scolding.

View on HN

> is there any hard evidence that huawei is a legitimate security concern?

Yes, quite a bit [1]. Here’s an apolitical example:

“In July 2012, Felix Lindner and Gregor Kopf gave a conference at Defcon to announce that they uncovered several critical vulnerabilities in Huawei routers (models AR18 and AR29)which could be used to get remote access to the device. The researchers said that Huawei ‘doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates’, and as a result, the vulnerabilities have not been publicly disclosed.”

In summary, the best case is Huawei is incompetent.

[1] https://en.m.wikipedia.org/wiki/Huawei#Controversies

It's one thing Huawei's products have severe vulnerabilities (as every other IT companies do), and another thing the company is actively engaging in espionage.

If this is the best hard evidence the US can bring forward, then the whole allegation sounds entirely political-driven.

If you can't tell, does it matter? If you're hoping for espionage to be obvious and blatant, I think you must be underestimating people's creativity.

Then we shouldn't deal with Cisco, Juniper, and pretty much every other network equipment manufacturer.

What kind of logic is that?

Trust is not binary.

I fail to see how this ties into your original point.

It's this kind of logic: it depends on whether you believe the US is as big of a security or IP-theft threat to you as China is. Your premise relies on the US == China. If that isn't the case, your premise collapses in one form or another.

Taiwan, Japan and South Korea aren't afraid of the US. They are afraid of China.

Finland, Romania, Poland, Ukraine and Estonia aren't afraid the US will invade and annex their territory. They are afraid of Russia's territorial ambitions in Eastern Europe.

For example, how do you think Australia feels about it right now?

"China’s peak security agency has directed a surge in cyber attacks on Australian companies over the past year, breaching an agreement struck between Premier Li Keqiang and former Prime Minister Malcolm Turnbull to not steal each other’s commercial secrets."

https://www.smh.com.au/business/companies/china-uses-the-clo...

"China reportedly steps up efforts to steal Australian company secrets"

https://www.cnbc.com/2018/11/21/cybersecurity-china-reported...

All I and others are asking for is some hard evidence. Either the company is engaged in unsavory behavior or it is not. You can't be ambiguous about this and expect people to play along.

Given how easy it should be for a capable government like the US to find something like this (especially given how common huawei gear is) and how "friendly" the US has been with China, I would expect to have seen at least some evidence surface by now. In fact, I would take the lack of evidence as a testimony to the innocence of huawei and the security of their hardware.

In saner times, the US government would put forward evidence and experts in an open hearing.

https://en.m.wikipedia.org/wiki/USS_Maine_(ACR-1)#Investigat...

If you think that demonstrates a legitimate security concern then every telecom manufacturer is a security concern. Spend some time comparing the known security issues with Huawei routers to Cisco's routers for example.

To be fair, their main competitor, Cisco, has had a significant number of hardcoded password backdoors found in their products. While their reporting and patching story is better, their security track record is still awful. It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco. The real difference would be if they were actively aiding espionage, which has been talked about a lot but never backed up with evidence.

https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

> It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco

Given “Cisco [has previosuly] revealed parts of [an] independent expert's report produced for [a] case which proved that Huawei had stolen Cisco code and directly copied it into their products,” that wouldn’t be surprising.

At the end of the day, you have a company with strong links (down to its founder) to the military of an adversarial dictatorship and which has been proven to have violated international sanctions with Iran, North Korea, Syria and Venezuela. This isn’t a “beyond reasonable doubt” criminal case. It’s a reasonable weighing of odds determination.

[1] https://en.m.wikipedia.org/wiki/Huawei

Then again, at the end of the day, you have companies with strong links to an adversarial government and which has been proven to have conducted economic espionage for the benefit of domestic companies, regularly violated (and violates) human rights, overthrown elected governments, invaded countries under false pretenses, and sentence people to death without a fair trial. If that's your line of logic, then there's more than enough shit to go around. Both sides are shitty.

The point being made is that industry-level security is not real evidence of malicious behavior on huawei's part. If you want people to avoid huawei, present proof.

> At the end of the day, you have a company with strong links (down to its founder) to the military

This sort of pure propaganda just undermines your case. The founder of Huawei was never more than a low level engineer in the military, was forbidden from joining the CCP for many years [1].

[1] https://en.wikipedia.org/wiki/Ren_Zhengfei

> was forbidden from joining the CCP for many years

He was banned and then “selected as a delegate from PLA to attend the National Science Conference” all before founding Huawei.

https://en.m.wikipedia.org/wiki/Ren_Zhengfei

Also not wrong. But the US, while not a dictatorship, and with its own share of problematic foreign policy, has been caught with its hand in the security cookie jar.

DUAL_EC_DRBG was included in BSAFE and Juniper products. So even if we assume the worst of Huawei, it's really a matter of which back door you want in your networking equipment. My hope is that these constant accusations make Huawei drive big improvements in reproducible builds, source-available software, and verifiable hardware. But I'm not holding my breath.

> is there any hard evidence that huawei is a legitimate security concern?

As someone with a lot of huawei in their infrastructure, this is what I really want to know as well.

The US government has lost a lot of credibility over the last few decades with its lopsided foreign policies that completely tip towards self-serving and agenda-pushing rather than decency and public good. There is nothing indicating that this particular issue is any different.

Unless the US government shows hard evidence that the company is harming us, we're not ditching them.

Innocent until proven guilty applies to entities you don't like too.

The difference is when the US government does something nasty, it's relatively transparent and accountable. It is not the case for the China government.

From where I'm sitting, both are not transparent and accountable.

Both Chinese and Americans can protest about the US government's scandals on an internet forum hosted on the US, not the other way around though.

Do you actually have any firsthand experience with Chinese internet culture? There's plenty of discontent and protestation about government policy, it's everywhere.

... in other words, information about the nastiness is leaked

No, there's absolutely no evidence that Huawei equipment is a legitmate security concern. In fact it's just the opposite. Huawei equipment has been extensively and continuously studied by the best security researchers in the world. Britain, alone, spent roughly $25 million dollars going over all Huawei equipment with a fine tooth comb and their "big conclusion" was that they can only offer "limited assurances" of Huawei equipment [1]. USA and France and Germany and Brazil have also extensively analyzed Huawei equipment and come up with nothing. Ironically, as the discussion in India and Japan and the Phillipines now show, the Western obsession with Huawei and has only made the case for Huawei's equipment much, much stronger.

[1] https://www.reuters.com/article/us-huawei-security-britain-e...

There is none in recent years. Huawei even offered to open its complete source code to the US government for inspection but got turned down.

There is evidence that the US spy agency hacked in Huawei HQ for years and still the US cannot produce evidence of Huawei wrongdoing. But then again it's possible the US don't want to disclose it's intel source.

> jackboot regimes of US foreign and copyright policy

protecting people's IP is now a "jackboot regime"?

'Protecting people's IP' is an extremely charitable view of US copyright and IP policy.

Reply on news.ycombinator.com