Huawei website ████ ██████ security flaws ██████ customer info and biz operations at risk: ███████ patched Huawei has gagged infosec researchers from discussing now-patched critical vulnerabilities in the Chinese giant's web systems that could have been exploited to steal customer information and derail the manufacturer's operations. A security research team at Italian outfit Swascan told The Register on Monday that, within the …
Could do better.
I can understand them wanting to keep the details under wraps for now, but they could have allowed a bit more info I think, and maybe a date when full details would be released. They shouldn't need to be whiter-than-white (compared with everyone else), but that's the reality of their current situation.
I think we must be careful to meet every message about Huawei with comments about Cisco.
Yes, Cisco has its own problems and I would not trut them either, but bringing that up every time is whatabouterism that doesn't help the discussion.
I would much rather that some more pressure is brought to bear on Huawei to make them understand why disclosure (post fix) is A Good Thing™ and if they can't do it just yet (for instance, because they suspect there's still a decent volume of unpatched gear out there) they should consider setting a deadline - also because that could encourage the laggards to get on with updating.
They've had a good boost from the US government to move into a controlled disclosure model that makes them more trusted than US gear, but it appears they're still on a learning curve. Talking about the competition is only going to provide excuses for the executive team not to go all the way.
Um, *were* there any CVE numbers? That is, what if Huawei is not only hiding the newly discovered flaws in their network, but hiding the fact that the same flaws may exist in *other* networks?
This sounds like a winning strategy, to be able to say *our* network is (now) more secure than other networks. Haha!
Yeah but this sounds like some infosec bod finding flaws in their _website_, not their products. You wouldnt get a CVE because some bod reports an XSS in your website. The vulnerability is not common.
You would fix it and ask bod not to report it till its fixed.
Bit Clickbaity if you ask me.
If they were hired by Huawei to do the pentesting, then I agree, that's different. But if that were the case, then I wonder why they're making any statement at all. Surely any disclosure would be made by Huawei itself, and the pentesters would not be free to talk directly to anybody else about it at all.
If Huawei didn't hire them, the only reason to sign an NDA is so they can claim reward money from Huawei. That's the practice that I'm actually condemning in my comment. Those sorts of "rewards" are effectively just hush money.
If the weren't even getting money out of Huawei, then there is literally no reason at all to sign an NDA, and if they did so in that circumstance, then they deserve to have heaps of scorn piled on them.
Pen testing bounty hunting is commonplace now.
you might not like it, but it doesn't really harm you - directly or indirectly. It appears to be proprietary web-sites that were vulnerable, and Hauwei (and google, and others) pays when this is brought to their attention. The site gets fixed, and the bounty hunter is allowed to say they found bugs etc - for their credibility - after the issue has been understood and resolved.
Better that than just selling the vuln to a competitor or a hacking team to do real mischief.
"you might not like it, but it doesn't really harm you - directly or indirectly. "
I'm not saying that it harms me, I'm saying that it doesn't help in the effort of increasing everyone's security.
"for their credibility"
If someone is telling the world that they found a security problem, but isn't saying what the problem is, that doesn't help their credibility, it harms it.
"Better that than just selling the vuln to a competitor or a hacking team to do real mischief."
Of course -- that's just plain criminal. But that isn't the alternative.
"If Huawei didn't hire them, the only reason to sign an NDA is so they can claim reward money from Huawei. That's the practice that I'm actually condemning in my comment. Those sorts of "rewards" are effectively just hush money."
I understand and share your reservations about hush money, and yet what's the alternative? Sure there are some security researchers who report vulnerabilities out of the goodness of their hearts or because they can get a paper / gold star out of it, but there aren't that many of them - not enough to assess a large enough percentage of sites / devices etc.
Commercial bug-hunters are essentially bounty hunters, they do it for the money and the only ones willing to pay are the companies whose products' security vulnerabilities have been found. In this scenario the bug-bounty plus NDA is probably the least-worst tradeoff
If it is a website vulnerability then fair enough, they should have just said that in the first place.
Depends on how it relates to the Huawei account that asks for various permissions to enable for example the step counter / fit app and other apps that are pre installed.
If it can push apps to a mobile in the same way Google play can then its a serious issue. I doubt and hope it's not that bad but... Plan for the worst if there is no info forthcoming etc
The whole point of responsible disclosure is supposed to be that there's a compromise. The vulnerability isn't disclosed to the whole world until the vendor has had a reasonable opportunity to protect its customers, if possible. In exchange, the details get published openly once that's happened, both so that the world can judge the vendor and everyone (including other vendors who might have similar bugs!) can learn from it. When done this way, everyone benefits: the vendor gets to protect its customers, the customers get protection, the researchers get to publish and be publicly acknowledged, and everyone has an opportunity to learn. Whether or not this is your preferred system, it does have some merit.
Signing an NDA is not responsible disclosure; it is, plainly, non-disclosure. Vendors who employ contractors in this manner need to stop calling this responsible disclosure, because it isn't, and the rest of us need to stop going along with the lie and allowing contractors to promote themselves in this manner. If this is what vendors think responsible disclosure is going to be, then full disclosure is the only answer. The party that welches on a compromise agreement can expect to lose the benefits thereof.
RE: "The vulnerability isn't disclosed to the whole world until the vendor has had a reasonable opportunity to protect its customers" - good point
There might not be an NDA. The article states "likely under an NDA" - LIKELY! The 'reasonable opportunity' might not be complete yet. What if the vulnerabilities are in some popular code library? What if there is a lot of code to check? It might not be responsible behaviour to release full details yet.
So why release anything? Swascan get some pluses for finding the bugs, Huawei get some pluses for having fixed them. The world gets to know some people are trying to make software better
>Time for Swascan to reconsider the relationship with Huawei
Why? If they want to get paid they will follow the rules like everyone else - Huawei always credit the source when they publish. It's hardly secretive and the bounties (upto 1 million RMB) and policy is better than many companies of its size.
https://www.huawei.com/en/psirt
... there had been that kind of article on ElReg every time Oracle refused to tell me, their customer, any detail about a critical vulnerability they announced on the systems they sold me.
So this article leaves me a little uneasy. I understand Huawei is under the spotlight and it's good clickbait, but well... A really astounding headline would be "HUAWEI DOES SOMETHING NO MAJOR US COMPANY IS DOING".
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
