Vodafone admits it found security flaws in Huawei’s equipment in 2011

* The so-called ‘backdoors’ were discovered by Vodafone in
network infrastructure and consumer routers between 2009 and
2011

Vodafone Italy discovered “hidden backdoors” in Huawei equipment
that would have allowed the Chinese company to access users’ home
networks as well as Vodafone’s Italian fixed-line network, reports
Bloomberg. The vulnerabilities were discovered between 2009 and
2011 in Huawei’s home internet routers, as well as its equipment
used in parts of Vodafone’s network infrastructure. There was no
evidence of data being compromised.

Bloomberg reports that both the router and network
vulnerabilities continued to exist beyond 2012, and also existed in
the company’s networks in the UK, Germany, Spain, and Portugal.
Sources say that Vodafone continued to use the equipment because it
was cheaper than the competition and the cost to remove it was
prohibitive.

In a statement given to Bloomberg, Vodafone acknowledged the
vulnerabilities but contested the timeline, saying they were
resolved in 2011 and 2012. Huawei says it was informed of the
vulnerabilities in 2011 and 2012, and that they were fixed at the
time.

The revelations come as Huawei’s role in future 5G networks is
under intense scrutiny worldwide over fears that its equipment
could be exploited to aid in China’s intelligence efforts. Multiple
countries are currently scrutinising Huawei’s security practices,
as governments decide which parts of their 5G networks to allocate
to the Chinese giant. The US is moving to ban the use of Huawei
equipment, and is lobbying its allies to do the same. Meanwhile,
the UK has reportedly made a preliminary decision to allow the use
of Huawei’s equipment in non-core parts of its networks, but is
under pressure from US officials to ban it completely.

Along with issues affecting its networking equipment, Vodafone
Italy also identified issues with Huawei’s home internet routers,
which Vodafone believed would give Huawei backdoor access to both
local machines and wide-area networks. Huawei was reportedly
reluctant to disable the Telnet feature that was creating the
vulnerability, claiming it relied on it to configure the devices
remotely.

Huawei characterized the vulnerabilities as “mistakes” rather
than deliberate inclusions in the equipment. “These were technical
mistakes in our equipment, which were identified and corrected,”
the company told ZDNet, “The accepted definition of ‘backdoors’ is
deliberately built-in vulnerabilities that can be exploited — these
were not such. They were mistakes which were put right.”

A computer security professor quoted in the report, Stefano
Zanero, said that there’s no obvious way to know if a vulnerability
is an accidental bug or an intentional backdoor. However, he added
that “the vulnerabilities described in the Vodafone reports from
2009 and 2011 have all the characteristics of backdoors:
deniability, access and a tendency to be placed again in subsequent
versions of the code.”

In January this year, Vodafone paused the use of Huawei’s
equipment in its core infrastructure across Europe, citing the
ongoing debates around the security of the equipment. More
recently, Vodafone has warned that a total ban could impact the
rollout of its 5G networks, and argued that there was no evidence
that Huawei’s equipment posed a security risk. The revelations
about these historical vulnerabilities, and Huawei’s approach to
patching them, continues to raise questions about how safe its
equipment is to use.

Last month, a UK cybersecurity watchdog raised concerns over the
Chinese company’s “basic engineering competence and cyber security
hygiene.” The same day, The Register reported lapses with how
Huawei had patched a vulnerability in its routers in 2013 which
later allowed them to be used as part of a botnet.

Subscribe ToNairalaw News!