Hacker News Reader

Comment by loudmax | Hacker News Reader

I think the Economist had a good take: https://www.economist.com/leaders/2020/01/25/huawei-is-a-cyb...

There is a real risk in using Huawei equipment, but the risk can be mitigated.

If the Chinese government tells Huawei to insert a backdoor, Huawei will certainly comply. But state actors don't necessarily need backdoors to exploit equipment. They're going to look for bugs, which they're just as likely to find in competitor's equipment as anything else. So the real solution is not to exclude Huawei because they're Chinese, but to make sure engineers fully understand the system from the hardware on up. This means insisting on open source systems and then conducting thorough audits.

View on HN

The risk cannot be truly mitigated even though we keep pretending it can be. The British should know better than to allow this in, but they try to kick the can down the road just like we've done over and over again. Audits won't cover everything and code is updatable anyway. The Americans are right on this one: Chinese networking gear shouldn't be trusted. I know G5 is a red herring (plenty of 4G equipment came from / comes from China), but network attacks are real and the attack surface area is exploding as everything gets put online.

Ultimately this is a problem with the technical literacy of our politicians and a matter of underpaying people that work for the technical agencies responsible for national security like GCHQ.

Agree and disagree with you and your parent commentor.

> They're going to look for bugs, which they're just as likely to find in competitor's equipment as anything else.

> [T]he real solution is not to exclude Huawei because they're Chinese, but to make sure engineers fully understand the system from the hardware on up.

> [T]his is a problem with the technical literacy of our politicians [...]

In my simple view [1], we're all thinking from an engineering "global optimum" mindset, as happens often here, but none of these solutions are realistic. Neither now nor going forward.

If you look at it from a political POV, the question should be: "how did Huawei find itself in a position like this?"

The approach, hence, should be a combination of a renewed massive investment in tech (similarly to military spending) on the one hand, and strong state support on the other hand. That sounds crazy and even "socialist" to a US audience, but on the other hand wouldn't be the first time this has been done. A follow up question would be about what's holding us back. I'll leave that to think about.

Similar reasoning for general infrastructure projects, I feel.

[1]: I'm not putting this out as gospel, so feel free to offer counters.

I'm not thinking from a global optimum mindset. I'm reading the actual DNI reports, I've talked with actual people in cyberwarfare (a major, even) and I've talked with people in both the OSINT community and the SIGINT / COMINT community. I have a family member that works on blackers all day long for the government of Canada and I've gone to conferences on both attack (Infiltrate) and defence.

China has a competitive advantage on creating tech at lower cost. America is awash in investment dollars, but has burdens that the Chinese do not have (IP, compliance, competition with other market participants like Google / Apple for the same talent) and it isn't realistic to keep our hopes on America or other western countries always matching the lowest cost. Some things need to be prioritized strictly because they're national security interests. Our media companies shouldn't be owned by state backed foreign interests, our defence companies shouldn't be, and our networking gear shouldn't be riddled with gear from a country like China that mass incarcerates people based on religion or ideology.

I'm not saying things will be perfect if we keep China out of our 5G space—far from it—but the internet is essentially a nervous system for machines and if we allow their gear all over our networks it's going to be utilised against us. In an ideal world even a country like Canada would have their own networking gear providers, so that if a country like the USA slides into despotism we wouldn't have to worry about getting strong armed, but we're far from that ideal scenario and I'm only hoping for less of a bad bargain than we're likely to find ourselves in 20 years from now.

Imagine this: If networking gear was compromised in the networks involved in stock trading, someone could literally crash the stock market! An order is just a packet travelling from one system to another, the vast majority happening via dark pools and algorithms.

[Removed]

This comment breaks the site guidelines. If you'd please read https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

Ok,will do.

> This means insisting on open source systems and then conducting thorough audits.

That would be nice, and in any case I'm a big believer in protecting your information at the protocol level instead of trusting this or that foreign government.

But once you've put that much effort into vetting it, aren't you pretty close to being able to roll your own on commodity hardware?

None of that matters if they can bring down a nation's network or use metadata (IMEI) to track users, that's very harmful enough!

This is missing the point.

All Comms kit has back doors in it. Its about choosing whom you allow to put them in.

Cisco was riddled with backdoors, and if you were interesting, the five eyes would specially intercept your kit and put extra bits in before it was delivered to you.

The issue here is geopolitical. Who has control of your friend's internet.

Now there are few ways to look at this:

1) this is the present government's master plan to use this as a bargaining chip in negotiations

2) The kit is going to be at the edge, which if the network is designed properly, will mitigate attempts to snoop or spoof

3) GCHQ et al, can't plan for shit.

4) The government and civil service can't plan for shit, don't understand how tech can influence geo politics

5) Trump is trying to get allies to buy shitty expensive kit from the USA.

Out of all of these 4 is my favourite hypothesis, but there are bound to be more factors. Yes, Huawei have sponsored a lab to prove that their kit is secure. But of course they would, they are not going to ship gimped kit to be tested.

Also, As Huawei kit already operates vast parts of openreach's network (the company that runs the vast majority of landlines and fibre) the point is kind of moot. The decision to allow this is why marconi bit the bucket, killing the last bit on comms design the UK had. (like every other pioneering electronics/computing company in the UK.)

Another subtle post I see...

Existing Huawei equipment should be removed. Sunken cost fallacy is well...a fallacy.

You mentioned Trump to ellicit political emotions but oppositiin to Huawei by US started during Obama's era and had bipartisan support.

GCHQ and the UK can indeed plan "for shit" as you put it, possibly more than you CCP fellas.

Whether they use this a bargaining chip or not does not change China's hostilities.

And last but far from least!!!!! It does not matter if their equipment is on the edge, do you want HN readers to suspend all knowledge of networking? Even if their equipment is purely layer2 and will only see encrypted traffic:

1) this still lets them be poisitoned to exploit and track arbitrary devices. 2) this still let's be in a position where they can abuse trust with the core or exploit the core. 3) this still lets them be in a position where they can cripple UK's communication infrastructure (DOS),which if they're smart,that's the primary vulnerability they will exploit in case of an invasion/war/pre-kinetic-war

> Existing Huawei equipment should be removed. Sunken cost fallacy is well...a fallacy.

I've not called for it to be removed, I pointed out that Openreach's decision (backed up by government) killed the only domestic player. Hence my comments on not being able to plan. Also, being in my current position I work closely with policy maker and those who advise. The level of dysfunction, piss poor office politics and general incompetence, is all too depressing

> Whether they use this a bargaining chip or not does not change China's hostilities.

This is orthogonal to what a bargaining chip is for. Its not about hostilities, its about who is in control. As now small player, shopping loyalties is the last great choice Britain has. (EU/US/other) Think Israel in the 50s/60s. They played a blinder.

> 1) this still lets them be poisitoned to exploit and track arbitrary devices.

yes and no. They still require access. If we ignore that the entire backhaul touches huawei kit, nominally the control plane is going to be separated from the data plane, whilst they could in theory collect this data, they'd still need to get it out.

> 2) this still let's be in a position where they can abuse trust with the core or exploit the core.

if the control plane is on the same network then yes. But as you well know control planes needs to be isolated to stop all sorts of failure types.

> 3) this still lets them be in a position where they can cripple UK's communication infrastructure (DOS),which if they're smart,that's the primary vulnerability they will exploit in case of an invasion/war/pre-kinetic-war

THe same goes for all the backdoors in present kit. Just because a country "owns" a manufacturer it doesn't mean that they own the backdoors.

But all of this supposes that every telecom use the same kit. Unlike landline, which is monopolised by openreach, there are still four mobile networks. of course its possible to launch a DOS on all of them using technical means, but its far simpler, cheaper and quicker to bribe a few NOC operators.

I personally don't think we should be using huawei kit, marconi shouldn't have been killed. but politics is politics.

Maybe UK would rather be spied upon by Chinese Gov. than by US Gov. I know I would.

Why would you want that?

The USA is our long time ally. Yes, I can roll things off the top of my head where they’ve stitched us up but I can also do the same for areas where mutual cooperation with the US has greatly helped us.

That’s everything from military cooperation during the Cold War to the original Human Genome project.

I can’t easily do that with China. I can point to the constant cyber attacks coming from China or their closed markets but I can’t think of many ways China cooperates with us.

Perhaps I’ve missed some examples and someone could enlighten me where China has acted in the UK’s interest?

5) Trump is trying to get allies to buy shitty expensive kit from the USA.

This is the only point I'm not sure I agree with. The US lost a major chunk of our Telecoms hardware capability when Lucent imploded in 2006 and took Bell Labs and all its engineers with it. Alcatel bought it, then Nokia bought it. So there's not much telecoms gear the US can provide to the EU/UK, that EU companies can't. Not much reason for the EU/UK to go with US suppliers here.

Fascinating, so China will be the #1 supporter of open source software?

All their code must be open sourced, in order to win foreign contracts. And all it took was a little trade war.

Not open source, just available for review by government agencies. The UK's Huawei Cyber Security Evaluation Centre has had access to Huawei's source for a while now, and has been complaining about bugs for about as long. https://www.gov.uk/government/publications/huawei-cyber-secu...

Hardware open sourced and audited ? Are you joking ? They can be changed by a fix and it is networked.

Also vulnerability is another vector. You concentrate on what you know but not others left open is very hard to know.

This is actually even more interesting. Now, China can get buy-in from the UK. The two are basically married now.

Huawei can require that the UK certifies the source code, and to even do the actual compilation step itself, and to sign the final executable programs and configuration files. At which point, the binaries are created, and the UK will have a cryptographic signature of the file.

Thus the binary is now cryptographically secured, that even China, with their mysterious black magic, cannot break the mathematical and thermodynamic laws of nature. /s

The UK team then approves this binary, and allows Huawei to begin mass installation on the hardware via firmware flashing. Then Huawei will initiate mass production, and begin shipping out the hardware to worldwide customers. Then the UK can post-certify that the same source code that they compiled and published, is the exact same code that is in the hardware.

The same process can be done for continuing code updates.

Huawei can mandate that the UK provides a team to do the final compilation and verification step, and this team must promise (by penalty of law) to remove themselves from any conflict of interest, meaning they cannot work on similar technologies in the future, to compete against Huawei. It’s like a non-compete agreement. And they also cannot disclose any Huawei trade secrets, or algorithmic details of Huawei’s 5G hardware. Their responsibility is to just ensure security, and do penetration testing for security weaknesses. And China can even mandate that the UK team relocate to China, to view the source code onsite.

And they can even run this for all hardware blueprints too. And monitor the code that also goes into the other chips on the SoC motherboard.

Then Huawei and China can claim that the code was validated by the UK itself, and here’s the genuine certification ID. And that it’s free of any known defects or spyware code.

I’d agree with you, but then you hand-waved past forcing Hauwei to open source their IP.

Reply on news.ycombinator.com