Automated scanners looking for vulnerabilities in Huawei firmware(breakingdefense.com)
breakingdefense.com
Automated scanners looking for vulnerabilities in Huawei firmware
https://breakingdefense.com/2019/07/hunting-huaweis-hidden-back-doors/
32 comments
Running some kind of automated analysis on the firmware and reporting vulnerabilities is a long way away from ”Huawei’s hidden back doors found”.
While that's true, the correct way of creating deniable backdoors is to simply write insecure code. The best way to detect something like that is essentially what this article tries to do: a comparative analysis of vulnerability frequency. It doesn't do a great analysis, but it is the correct approach to thinking about the problem.
Why would deniable backdoors be visible in vulnerability frequency? In principle, you only need a single back-door. Perhaps you need to chain some vulnerabilities and build in some redundancy.
According the article, this had 100 vulns, which was signficantly worse than comparable vendors. If we assume that to mean comparable vendors have 50 vulnerabilities, we would have to believe they included 50 vulnerabilities intentionally.
According the article, this had 100 vulns, which was signficantly worse than comparable vendors. If we assume that to mean comparable vendors have 50 vulnerabilities, we would have to believe they included 50 vulnerabilities intentionally.
If I were inserting vulns as backdoors, i'd want several in case some of them got discovered.
This entire thing reminds me a little bit of the Linux Backdooring Attempt of 2003. A tiny dropped symbol that didn't look like a backdoor and just sloppy at first, but actually...
even better if the insecure code takes advantage of absolutely plausible coding mistakes/language quirks. see e.g. underhanded C contest for very subtle and deniable ways to provide nefarious functionality.
http://underhanded-c.org/_page_id_22.html
http://underhanded-c.org/_page_id_22.html
You do have a point.
If I was an assigned Chinese official supervising Huawei (like every Chinese business with 50+ employees), would I say, "go write one backdoor?" Nope, I would say, "be sloppy and maybe a few will go undetected."
If I was an assigned Chinese official supervising Huawei (like every Chinese business with 50+ employees), would I say, "go write one backdoor?" Nope, I would say, "be sloppy and maybe a few will go undetected."
[deleted]
That’s conspiracy theory logic. The fact that it doesn’t look like a backdoor is evidence that it’s a backdoor? It is impossible to disprove something like that.
What of this:
Dahua at first ignored ReFirm’s inquiries, then claimed the vulnerability was a simple error that had been fixed in the latest update. But when ReFirm looked through the updated firmware, they still found the same backdoor — just relocated in a different place in the code. (Huawei had done the same thing).
Dahua at first ignored ReFirm’s inquiries, then claimed the vulnerability was a simple error that had been fixed in the latest update. But when ReFirm looked through the updated firmware, they still found the same backdoor — just relocated in a different place in the code. (Huawei had done the same thing).
I'm not saying that it is evidence that it is a backdoor. I'm saying that it is indistinguishable, because that's how you would do things if it were a backdoor as well.
The correct way to try to discriminate is to look at how frequent they are, and maybe how they're patched.
The correct way to try to discriminate is to look at how frequent they are, and maybe how they're patched.
No, the logic is not "it doesn't look like a backdoor" but "backdoors and vulnerabilities look very much alike". And given the story of vulnerability being shuffled from place to place instead of removed, the probability of it being deliberate raises. Surely, it can be just gross incompetence, but you don't want grossly incompetent vendor any more than you want a spying one.
Perhaps. But at the same time, if I was a Chinese gov't official tasked with getting a backdoor past America's radar, what would be my strategies?
Writing sloppy code with the hope that a few bugs will be undetected seems like a decent strategy to me.
Writing sloppy code with the hope that a few bugs will be undetected seems like a decent strategy to me.
The second winner of the 2005 Underhanded C Contest has stuck with me for years, because it's a thing of beauty hidden under an innocent-looking bug.
http://www.underhanded-c.org/_page_id_14.html
http://www.underhanded-c.org/_page_id_14.html
If I was told to put a backdoor in my product and make it plausibly deniable, it probably would look like a vulnerability in a very obscure, rarely used and non-documented function.
Yes, there's no real way to know. But then again, is "our products are full of security vulnerabilities" that better than "our products are full of backdoors"? I think being hacked by a random criminal from Moldova is not much better than being watched by a Chinese Army officer from Beijing. You probably want to avoid both.
Yes, there's no real way to know. But then again, is "our products are full of security vulnerabilities" that better than "our products are full of backdoors"? I think being hacked by a random criminal from Moldova is not much better than being watched by a Chinese Army officer from Beijing. You probably want to avoid both.
I agree. I actually spoke with the ReFirm guy ~2 years ago when they first found the Dahua vulns. I don’t see any new data or proof in this report. Also, as I recall the vuln was in a binary called ‘sofia’ or ‘sonia’ that was a modified version of what was possibly the Huawei POc code that shops with the SoC’s. It was unclear if it was really a ‘Huawei’ vuln or a Dahua one.
Might have some minor details wrong, working off memory, would have to check my notes...
Might have some minor details wrong, working off memory, would have to check my notes...
Not sure what you expect a Huawei backdrop would look like? “PRC Agents click here”?
Any decent backdoor is going to look exactly like sloppy code that someone “forgot” to fix.
Any decent backdoor is going to look exactly like sloppy code that someone “forgot” to fix.
"found the average device had 102 vulnerabilities, at least a quarter of them severe enough to let a hacker get full access easily. That’s much more than comparable Western products"
Why not compare against comparable Eastern products? Were the Western products more expensive?
The article reeks of hatchet job to me.
I did a quick search to try and find the referenced Huawei backdoor they discovered had been "moved", but I couldn't find anything... Can anyone else find something about it?
Edit: I think it is obvious the Chinese government would have backdoors, but I also think they won't be obvious (the Chinese NSA are not stupid). These security issue are just bad code, not strategic.
Why not compare against comparable Eastern products? Were the Western products more expensive?
The article reeks of hatchet job to me.
I did a quick search to try and find the referenced Huawei backdoor they discovered had been "moved", but I couldn't find anything... Can anyone else find something about it?
Edit: I think it is obvious the Chinese government would have backdoors, but I also think they won't be obvious (the Chinese NSA are not stupid). These security issue are just bad code, not strategic.
This article quickly turned into a puff piece for ReFirm
> Dahua at first ignored ReFirm’s inquiries, then claimed the vulnerability was a simple error that had been fixed in the latest update. But when ReFirm looked through the updated firmware, they still found the same backdoor — just relocated in a different place in the code. (Huawei had done the same thing).
Regardless of which vendor we're talking about I fear that this simple admission of human error is going to repel any improvement justified by technological means. It is extremely easy, and entirely believable, to continuously blame human error, "junior devs", management, etc in the face of any discovered vulnerabilities.
The value of automated detection is to hopefully fuel a real boycott and/or government ban. I'm not specifically calling out Huawei here because I think it's entirely reasonable for other countries to do the same thing to U.S. companies. Hitting offenders in the only place it hurts, the bank account, is probably the only way inhibit this behavior.
Regardless of which vendor we're talking about I fear that this simple admission of human error is going to repel any improvement justified by technological means. It is extremely easy, and entirely believable, to continuously blame human error, "junior devs", management, etc in the face of any discovered vulnerabilities.
The value of automated detection is to hopefully fuel a real boycott and/or government ban. I'm not specifically calling out Huawei here because I think it's entirely reasonable for other countries to do the same thing to U.S. companies. Hitting offenders in the only place it hurts, the bank account, is probably the only way inhibit this behavior.
Well, not intentional (except for that camera company), but should we be using Huawei when that expert described it as "some of the worst [most exploitable] equipment I have ever worked with."?
We might as well make sure that it's relatively secure regardless of politics.
We might as well make sure that it's relatively secure regardless of politics.
Ah yes, a network device vendor with serious vulnerabilities, that's new...
This is how they describe their security system:
https://finitestate.io/product/
Would love more details on how it works
Would love more details on how it works
So the theory is that chinese vendors put existing exploits into their firmware deliberately? That seems rather hard to believe. Would it not be much simpler to create a few new holes?
What do you mean by 'existing exploits'? It seems like they are accusing them of writing insecure code on purpose, which is exactly how i'd go about inserting a backdoor if I were going to do it.
That is correct because plausible deniability is very important.
However writing insecure code is also the defacto standard across industry, definitely including in the US.
If we accept this as proof, then Microsoft, Google, Facebook, etc, (all the way down like the turtles, until we hit every one man company) are all government controlled corporations deliberately installing sneaky back doors through security vulnerabilities in code, which cleverly simply look like incompetent programming.
However writing insecure code is also the defacto standard across industry, definitely including in the US.
If we accept this as proof, then Microsoft, Google, Facebook, etc, (all the way down like the turtles, until we hit every one man company) are all government controlled corporations deliberately installing sneaky back doors through security vulnerabilities in code, which cleverly simply look like incompetent programming.
That's right, but I think the article is asserting that:
a) The vulnerability density is much higher in Huawei's code.
b) When vulns were reported to them, they simply moved them to another location, rather than actually patch them.
Those are the things that I consider to be (weak) evidence that they are backdoors.
a) The vulnerability density is much higher in Huawei's code.
b) When vulns were reported to them, they simply moved them to another location, rather than actually patch them.
Those are the things that I consider to be (weak) evidence that they are backdoors.
Notably not in this article: any Huawei backdoors.
"Backdoor" implies malice. What this article is about is "vulnerabilities," also known as "bugs." The moral panic continues unabated.
"Backdoor" implies malice. What this article is about is "vulnerabilities," also known as "bugs." The moral panic continues unabated.
"But when ReFirm looked through the updated firmware, they still found the same backdoor — just relocated in a different place in the code. (Huawei had done the same thing)."
I'm not sure what event they are referring to for Huawei.
Edit: I followed the first reference I found, and ended up at: https://www.pcworld.idg.com.au/article/543641/netgear_patch_... perhaps because owned by Huawei or person referenced Huawei when they meant Netgear?
I'm not sure what event they are referring to for Huawei.
Edit: I followed the first reference I found, and ended up at: https://www.pcworld.idg.com.au/article/543641/netgear_patch_... perhaps because owned by Huawei or person referenced Huawei when they meant Netgear?
Also it's laughable that they imply vulnerabilities are less common in "American" made software.
Again, I totally could believe that Huawei, or any other Chinese tech company, would do this if told to by the Chinese government (again, because U.S. companies almost certainly do it when told to by the U.S. government). But, that's not even what the article (as opposed to the headline) is alleging.