I told you not to trust Huawei

March 27th, 2019

Back in Januari 2019 I had already warned not to use equipment from Huawei if security and privacy are important to you. I warned my friends and colleagues who wanted to buy Huawei phones not to do so, and here on my blog I wrote:

If you’re using (networking, computing, and communications) equipment from Huawei, it would be wise for you to assume that the Chinese government can easily gain access to your information via Huawei.

Well now we have the first clear — smoking gun — piece of evidence that this is true. Here’s from ZDNet:

Microsoft has now detailed how it found a severe local privilege escalation flaw in the Huawei PCManager driver software for its MateBook line of Windows 10 laptops. Thanks to Microsoft’s work, the Chinese tech giant patched the flaw in January.

As Microsoft researchers explain, third-party kernel drivers are becoming more attractive to attackers as a side-door to attacking the kernel without having to overcome its protections using an expensive zero-day kernel exploit in Windows.

The flaw in Huawei’s software was detected by new kernel sensors that were implemented in the Windows 10 October 2018 Update, aka version 1809.

The sensors are part of Microsoft’s response to the WannaCry malware outbreak of 2017, which caused havoc in the UK’s National Health Service and infected about 200,000 Windows PCs around the world. The malware was attributed to North Korean hackers.

Specifically, the sensors are designed to catch malware like DoublePulsar, a backdoor implant created by US National Security Agency hackers that was leaked by The Shadow Brokers in early 2017. DoublePulsar runs in kernel mode and was the vehicle for delivering WannaCry, copying the malware from the kernel to user-space.

…

Huawei’s PCManager triggered Defender ATP alerts on multiple Windows 10 devices, prompting Microsoft to launch an investigation.

“Hunting led us to the kernel code that triggered the alert. One would expect that a device management software would perform mostly hardware-related tasks, with the supplied device drivers being the communication layer with the OEM-specific hardware,” explains Amit Rapaport, a researcher on the Microsoft Defender ATP team.

…

The investigation led the researcher to the executable MateBookService.exe. Due to a flaw in Huawei’s ‘watchdog’ mechanism for HwOs2Ec10x64.sys, an attacker is able to create a malicious instance of MateBookService.exe to gain elevated privileges. Microsoft: Windows 10 devices open to ‘full compromise’ from Huawei PC driver

They’re calling this a “flaw” in Huawei’s driver software, but it’s also likely that this is a feature that was deliberately placed inside the software to give people who know about it a back door into the computer systems that it runs on. Such back doors can be disguised as bugs or other kinds of programming errors in the software, so that when they get discovered the company can claim: “Oops, sorry, we fucked up, honest mistake — here’s a fix.” In the mean time, when, for example, the Chinese government wants to target someone, they can obtain a list of “flaws” from these companies to use against their target.

Microsoft was able to detect this particular “flaw,” but there’s no easy way of telling what other so called “flaws” exist in the software unless you have access to the source code and do a thorough security audit on it. It’s also important to keep in mind that such “flaws” can also be built directly into the hardware.

In Suriname, where I live, the major ISP called Telesur uses a lot of communications equipment from Huawei, and I often tell people to safely assume that the entire ISP and networking (Internet) infrastructure is completely 0wn3d by Huawei. It would not surprise me in the least if China is able to read and monitor all communications from Suriname via Telesur, probably even in real-time.

The way things are going now, it’s probably going to become increasingly more important to use open source hardware and software, where you can control, inspect and audit every component on the system before you can trust and use it.

Additional Notes

Here’s from an article from CNBC, “Huawei staff share deep links with Chinese military, new study claims” (July 8th 2019):

A new analysis of CVs of Huawei staff appeared to reveal deeper links between the technology giant and China’s military and intelligence bodies than had been previously acknowledged by the firm.

The paper, which looks at employment records of Huawei employees, concluded that “key mid-level technical personnel employed by Huawei have strong backgrounds in work closely associated with intelligence gathering and military activities.” Some employees can be linked “to specific instances of hacking or industrial espionage conducted against Western firms,” it claimed.

…

The study, conducted by Christopher Balding, an associate professor at Fulbright University Vietnam, and London-based conservative think tank Henry Jackson Society, looked through CVs of Huawei employees that were leaked online from unsecured databases and websites run by recruitment firms.

…

Another CV describes an individual who worked at Huawei but was a representative of a government entity responsible for espionage and counter intelligence. That individual “engaged in behavior that describes planting information capture technology or software on Huawei products,” according to the study.

…

“We are not arguing that hiring ex-military personnel (means) your organization is an espionage front. I simply do not say anything of the sort but that is what they are trying to conflate. I am saying, in Huawei personnel words on their CVs, they held dual positions for Chinese intelligence gathering and electronic warfare units while working for Huawei either taking orders from or coordinating with the Chinese state. That is what is profoundly worrisome,” Balding told CNBC.

Added on July 11th, 2019 at 4:21 pm
Finite State, a cybersecurity research and development company, released a security assessment on Huawei’s products in June 2019 and their findings aren’t very positive to say the least. You can download the whole assessment as a PDF (and I highly recommend reading all of it), but here are some quotes that I found particularly important:
The results of the analysis show that Huawei devices quantitatively pose a high risk to their users. In virtually all categories we examined, Huawei devices were found to be less secure than those from other vendors making similar devices.

1. Backdoor Access Vulnerabilities

Out of all the firmware images analyzed, 55% had at least one potential backdoor. These backdoor access vulnerabilities allow an attacker with knowledge of the firmware and/or with a corresponding cryptographic key to log into the device.
- 29% of all devices tested had at least one default username and password stored in the firmware, enabling access to the device if administrators don’t change these credentials.
- We identified 76 instances of firmware where the device was, by default, configured such that a root user with a hard-coded password could log in over the SSH protocol, providing for default backdoor access.
- 8 different firmware images were found to have pre-computed authorized_keys hard coded into the firmware, enabling backdoor access to the holder of the private key.
- 424 different firmware images contained hardcoded private SSH keys, which can enable a man-in-the-middle to manipulate and/or decrypt traffic going to the device.
2. Pattern of Security Flaws

Huawei devices were shown to have a high number of known security vulnerabilities. Despite the fact that many of these vulnerabilities have been public knowledge for years, Huawei continues to make firmware updates without addressing them. These vulnerabilities increase the likelihood that attackers can compromise these devices.

…

3. Highly Insecure Software Development Practices

Despite claims of prioritizing security, we quantitatively demonstrate that Huawei engineers systematically made poor security decisions in building the devices we tested. This weak security engineering significantly increases the potential for serious vulnerabilities.

On dozens of occasions, Huawei engineers disguised known unsafe functions (such as memcpy) as the “safe” version (memcpy_s) by creating wrapper functions with the “safe” name but none of the safety checks. This leads to thousands of vulnerable conditions in their code.

…

The Chinese National Intelligence Law of 2016 requires all companies “to support, provide assistance, and cooperate in national intelligence work.”

…

This requirement is consistent across several laws on the protection of China’s state security. For instance, Article 7 of the National Intelligence Law (国家情报法) 17 declares:

Any organisation and citizen shall, in accordance with the law, support, provide assistance, and cooperate in national intelligence work, and guard the secrecy of any national intelligence work that they are aware of [emphasis added]. The state shall protect individuals and organisations that support, cooperate with, and collaborate in national intelligence work. Similarly, Article 22 of the 2014 Counter-Espionage Law (反间谍法) states that during the course of a counter-espionage investigation, “relevant organizations and individuals” must “truthfully provide” information and “must not refuse.” The implementing regulations, released in November 2017, clarified the law’s provisions:

“When state security organs carry out the tasks of counter-espionage work in accordance with the law, and citizens and organizations that are obliged to provide facilities or other assistance according to the law refuse to do so, this constitutes an intention to obstruct the state security organs from carrying out the tasks of counter-espionage work according to law.”
Added on July 12th, 2019 at 5:18 pm
Here’s from The Wall Street Journal, “Huawei Technicians Helped African Governments Spy on Political Opponents” (August 15th 2019):

Employees embedded with cybersecurity forces in Uganda and Zambia intercepted encrypted communications and used cell data to track opponents, according to a Wall Street Journal investigation

In Kampala, Uganda, last year, a group of six intelligence officers struggled to contain a threat to the 33-year regime of President Yoweri Museveni, according to Ugandan senior security officials.

…

According to these officials, the team, based on the third floor of the capital’s police headquarters, spent days trying to penetrate Mr. Wine’s WhatsApp and Skype communications using spyware developed by an Israeli company, but failed. Then they asked for help from the staff working in their offices from Huawei, Uganda’s top digital supplier.

“The Huawei technicians worked for two days and helped us puncture through,” said one senior officer at the surveillance unit. The Huawei engineers, identified by name in internal police documents reviewed by the Journal, used the Israeli-made spyware to penetrate Mr. Wine’s WhatsApp chat group, named Firebase crew after his band. Authorities scuppered his plans to organize street rallies and arrested the politician and dozens of his supporters.

The incident in Uganda and another in Zambia, as detailed in a Wall Street Journal investigation, show how Huawei employees have used the company’s technology and other companies’ products to support the domestic spying of those governments.

…

In Zambia, according to senior security officials there, Huawei technicians helped the government access the phones and Facebook pages of a team of opposition bloggers running a pro-opposition news site, which had repeatedly criticized President Edgar Lungu. The senior security officials identified by name two Huawei experts based in a cyber-surveillance unit in the offices of Zambia’s telecom regulator who pinpointed the bloggers’ locations and were in constant contact with police units deployed to arrest them in the northwestern city of Solwezi.

The ruling Patriotic Front posted on its Facebook page in April that police officers working with “Chinese experts at Huawei have managed to track” and arrest the bloggers. The party’s spokesman confirmed to the Journal that the case was handled by the Cybercrime Crack Squad, the unit at the telecom regulator.

…

“The big question has been whether Chinese companies are just doing this for the money, or whether they’re pushing a specific kind of surveillance agenda,” Mr. Feldstein said, after being briefed on findings by the Journal. “This would suggest it’s the latter.”

…

The Journal’s investigation included classified police documents and parliamentary committee documents, and interviews with more than a dozen senior security officials working with Huawei in African countries, and with diplomats, cyber-defense officials and opposition activists who say they have had their communications compromised.

…

Zambia’s ruling party spokesman, Antonio Mwanza, said Huawei technicians, based inside the Zambia Information & Communications Technology Authority, or Zicta, regulator, were helping the government combat opposition news sites.

“Whenever we want to track down perpetrators of fake news, we ask Zicta, which is the lead agency. They work with Huawei to ensure that people don’t use our telecommunications space to spread fake news,” he said.

Ugandan officials said that Huawei representatives have stopped attending technical briefings since the Journal submitted questions to the Chinese company.

…

In one of the rooms at Uganda’s police headquarters, Huawei has its red logo affixed to the wall. “They teach us to use spyware against security threats and political enemies,” said one official at the unit.

…

A senior police commander relayed a presidential order to access Mr. Wine’s encrypted written and spoken communications, including those through WhatsApp and Skype, to a six-man cyber team based at police headquarters, according to the security officials. They spent days trying to penetrate the communications using the Pegasus spyware but failed.

They asked for help from Huawei technicians—who then cracked Mr. Wine’s encrypted communications using Pegasus within two days, the security officials said.

…

“We were shocked. They knew everything about the event and the speakers, who we hadn’t announced,” Mr. Wine said.

One of the security officials showed the Journal screenshots of Mr. Wine’s WhatsApp chats with the Firebase crew where participants were exchanging details on the planned events. The official said the operation would have been impossible without the skills of Huawei’s technicians.

…

The Huawei staff accessed the bloggers’ Facebook pages, where they found their phone numbers, and then used spyware from another company to look into and locate the devices.

On April 18, a team of cyber officials, police intelligence and Zicta experts huddled in Mr. Chanda’s office, on the ground floor of the presidential mansion. Two Huawei technicians opened their laptops to display screens showing live trace routes of several mobile phones linked to the targeted bloggers’ Facebook pages, on maps that also charted Huawei phone antennas, Zambian intelligence officials said.

The below video on YouTube titled “Huawei Staff Help Governments to Spy on People: WSJ Investigation”, has more.

Added on August 16th, 2019 at 6:06 pm
Here’s from The Wall Street Journal, “U.S. Officials Say Huawei Can Covertly Access Telecom Networks” (February 11^th 2020):

U.S. officials say Huawei Technologies Co. can covertly access mobile-phone networks around the world through “back doors” designed for use by law enforcement, as Washington tries to persuade allies to exclude the Chinese company from their networks.

Intelligence shows Huawei has had this secret capability for more than a decade, U.S. officials said. Huawei rejected the allegations.

The U.S. kept the intelligence highly classified until late last year, when American officials provided details to allies including the U.K. and Germany, according to officials from the three countries. That was a tactical turnabout by the U.S., which in the past had argued that it didn’t need to produce hard evidence of the threat it says Huawei poses to nations’ security.

…

When telecom-equipment makers build and sell hardware such as switching gear, base stations and antennae to carriers—who assemble the networks that enable mobile communication and computing—they are required by law to build into their hardware ways for authorities to access the networks for lawful purposes.

They are also required to build equipment in such a way that the manufacturer can’t get access without the consent of the network operator.

..

U.S. officials say Huawei has built equipment that secretly preserves the manufacturer’s ability to access networks through these interfaces without the carriers’ knowledge. The officials didn’t provide details of where they believe Huawei is able access networks. Other manufacturers don’t have the same ability, they said.

“We have evidence that Huawei has the capability secretly to access sensitive and personal information in systems it maintains and sells around the world,” said national security adviser Robert O’Brien.

“Huawei does not disclose this covert access to its local customers, or the host nation national-security agencies,” another senior U.S. official said.

…

Some German officials came away from the briefing by Mr. Pottinger convinced by the U.S. intelligence, according to a senior official familiar with the meeting. A confidential memo written by the German Foreign Office and seen by The Wall Street Journal states that Mr. Pottinger provided “smoking gun” evidence that Huawei equipment posed a spying risk. Mr. Pottinger didn’t respond to requests for comment.

We should also not forget that, similarly, the CIA also had access to communications of governments in over 120 countries for decades because they sold compromised encryption hardware through a Swiss company called Crypto AG which they secretly owned. The USA has enough experience with the same practices they are blaming Huawei of.

Added on February 12th, 2020 at 12:34 pm
Here’s from The Economic Times, “China uses Huawei cameras to spy on African Union headquarters” (December 27^th 2020):

NEW DELHI: A sensational report has emerged that alleged Chinese hackers had been obtaining security camera footage from inside the African Union (AU) headquarters building in Ethiopia which is an indication of Beijing’s objectives in the resource rich continent.

“Beijing’s opportunities for eavesdropping in Africa are vast. Chinese companies—many of which are state-owned, all of which are legally obliged to cooperate with the Chinese Communist Party on intelligence matters—have built at least 186 government buildings in Africa, including presidential residences, ministries of foreign affairs, and parliament buildings. Huawei has built more than 70 percent of the continent’s 4G networks and at least fourteen intra-governmental ICT networks, including a data center in Zambia that houses the entirety of the government’s records,” according to a report titled ‘How China Has Been Using Huawei-Made Cameras to Spy on the African Union Headquarters’ published in the leading US magazine The National Interest.

“The report—now confirmed by two other media outlets—that broke the original story of the Chinese government’s AU spying demonstrates what Beijing can do with a structure one of its company builds. The AU’s compromised ICT system was also provided by Huawei, whose equipment is often swiss cheesed with security vulnerabilities that make them easily exploitable. Given Huawei’s links to China’s Ministry of State Security, it beggars belief that Beijing lacks anything less than an excellent idea of how to access those backdoors,” according to The National Interest.

Beijing has many reasons to take advantage of the spying opportunities its companies’ activities in Africa provides. It can eavesdrop on the sensitive conversations they have with their non-African counterparts, and the Chinese government might be able to gather useful economic information it can pass to its many companies operating on the continent, the report alleged.

Many of their countries face a massive infrastructure gap, and Beijing is often happy to open its wallet for infrastructure projects. Affordable Chinese products, especially tech such as smartphones, are popular on the continent as well, according to The National Interest report.

“Yet the Chinese government spends a lot of time and energy trying to influence African leaders to support Beijing’s agenda at a level beyond what simple concern for their countries’ national interests would prompt. These charm campaigns include everything from bribery to throwing up flashy infrastructure projects during election times to lavishing “no-strings-attached” aid on rulers to feed their patronage networks.”

The information that Beijing appears to be hoovering up daily is of obvious use for those kinds of influence operations. It could offer insights into an official’s habits, personality, and proclivities that would help Beijing effectively cajole or coerce him or her, the report noted.

Added on August 16th, 2021 at 7:43 pm
Here’s from The Wallstreet Journal, “Huawei Accused in Suit of Installing Data ‘Back Door’ in Pakistan Project” (August 14^th 2021):

A long-running dispute between Huawei Technologies Co. and a small U.S.-based contractor has escalated to U.S. federal court, with the contractor alleging Huawei stole its technology and pressured it to build a “back door” into a sensitive law-enforcement project in Pakistan.

The contractor, Buena Park, Calif.-based Business Efficiency Solutions LLC, or BES, says in a lawsuit filed Wednesday in California district court that Huawei required it to set up a system in China that gives Huawei access to sensitive information about citizens and government officials from a safe-cities surveillance project in Pakistan’s second-largest city of Lahore.

…

In comments to The Wall Street Journal last September, Huawei acknowledged setting up a separate version of the Lahore system in China, but said it was only a test version that was “physically isolated from the customer’s live network.” This made it “impossible for Huawei to extract data from the customer’s live network.”
Pakistan’s foreign ministry didn’t respond to requests for comment.
U.S. officials have long alleged Huawei gear could enable Chinese espionage in the countries that install it. Huawei has repeatedly said its gear is safe and that it would never spy on behalf of any government.

…

Huawei is a leader in safe-cities projects—citywide surveillance systems marketed to governments as crime-fighting tools that often make use of facial-recognition cameras and other high-tech capabilities. The projects have drawn scrutiny from some governments and rights groups, who say they are used to export China’s surveillance practices. Huawei says its projects improve public safety and says it has built safe-cities systems in hundreds of cities around the world.

Added on August 16th, 2021 at 7:47 pm

Pingbacks

The Secrets of Silicon Valley: What Big Tech Doesn’t Want You to Know — Karel Donk (11/07/2019)
China’s New Cybersecurity Program: NO Place to Hide — Karel Donk (14/10/2019)
WhatsApp is completely fucked; stop using it — Karel Donk (01/11/2019)
Response to “Cybercrime in Suriname Increasingly More Aggressive” — Karel Donk (01/02/2020)
China’s “New IP” sounds like Orwell’s “New Speak” — Karel Donk (06/04/2020)
Spyware and surveillance on Apple and Xiaomi devices — Karel Donk (24/09/2021)

Comments

There are 4 responses. Follow any responses to this post through its comments RSS feed. You can leave a response, or trackback from your own site.

Leo October 15th, 2019 at 12:50 am

About 15 years ago i was on contract as database administrator at EPO, the European Patent Office. At that time it was rumored that large amounts of data were stolen by ftp every night (!). Members of the staff were able to close the breach but it opened up miraculously again and again. No one knew how it came about (). Off course there were lots of speculations, China being one and Russia off course. And all of this was very hush hush.
Btw i am connected to internet by fiber using a modem of Huwaei and it uses ‘special’ firmware of my internet provider. I have no say over its settings apart from userid and signon (and some minor settings dhcp etc.). Similar things happen all over the country. Modems are delivered with customized firmware. Most settings are unavailable to the end-user. And this is a trend that has settled in. All major chinese brands of router/modems offer minimal settings and on top one gets an android app to ‘control’ the unit. So now they have two ways in.
Thanks Karel for the wake-up call.

Reply
- Karel Donk October 15th, 2019 at 8:10 am
  
  Yes it’s the same situation here for me. The ISP is working with Huawei and the end-user has no access to the ADSL modem in their own home. Settings can be remotely changed by the ISP without the user’s knowledge. A few months ago the DNS settings on my modem got changed (DNS hijacking/poisoning attack) and nobody knows how that happened. You cannot trust the DNS settings from the router or the ISP anymore; configure your own settings on the device and preferably use DNS over HTTPS/TLS that is encrypted.
  
  Reply
  - Leo October 15th, 2019 at 9:04 am
    
    The Huwaei just functions as gateway. I stopped the wifi and have a separate router with different ip-range that does the work. Encrypted DNS, i would love to get that working too. Btw my router runs latest of OpenWRT.
    
    Reply
    - Karel Donk October 15th, 2019 at 9:11 am
      
      Yeah encrypted DNS is a requirement as the ISP (or anyone else) can modify the DNS packets in transit.

Popular Posts

Recent Posts

I told you not to trust Huawei

Additional Notes

Meta

Pingbacks

Comments

Leave a Reply Cancel reply

Recent Posts

Subscribe to blog via Email

Popular Posts

Recent Posts

Leave a Reply Cancel reply

Related

Recent Posts

Subscribe to blog via Email