Hacker News Reader

Comment by brown9-2 | Hacker News Reader

A backdoor or 0day for a Huawei router would be of limited use to the NSA, because the control ports are behind firewalls. Hacking behind firewalls would likely give full access to the target network anyway, making any backdoors/0days in routers superfluous.

But embedding themselves inside the support infrastructure would give the NSA nearly unlimited access to much of the world. Huawei claims that a third of the Internet is running their devices. Almost all of it is under support contract. These means a Huawei support engineer, or a spy, can at any time reach out through cyberspace and take control of a third of the Internet hardware, located in data centers behind firewalls.

So the companies that use Huawei's products put the control ports behind their firewalls, but somehow are allowing unrestricted access through that firewall to/for Huawei's support mechanism?

Is that common?

View on HN

Extremely common.

It's the norm today that companies have firewall/VPN holes allowing support engineers from other companies to have access to their networks, to manage things as simple as the HVAC system, or things as complex as their entire routing infrastructure.

Throughout the world, most Huawei routers come with such support contracts.

> to manage things as simple as the HVAC system

Hello, Target breach. =)

I'm guessing what that means is something like this:

1. Huawei has support contracts

2. Huawei needs to be able to interact with their hardware to execute those support contracts

3. Companies don't want to expose routers

4. Huawei routers "phone home" (i.e. query Huawei) and in this fashion allow Huawei support to establish a connection

Firewalls can (and should) block outbound connections, as well. (Although trying to ultimately clamp down on this in any normal business environment where humans want to web browse is a battle you will ultimately lose if you are trying to completely stop all of it.)

Sure, but then Huawei can say, "well we can't support our hardware if you don't let us access it". Or maybe they would say, "Ok so would you like to pay for on-site support?"

The "phone home" model is one of the safer ones to my knowledge, if only because it allows a blanket "-A INPUT -j drop" rule. Outbound connections should be filtered, yes, but inbound is even more important.

I was skeptical of that too - however, another part of the article implied another scenario, leaving it unclear whether the writer confused them or refers to both. The second scenario is, company may control its own gear well enough, but relies on a service provider that uses Huawei devices, and the Huawei support people can access comms thru the latter. Which begs questions about encryption, so the implications are murky.

Reply on news.ycombinator.com