Germany clocks that ripping out Huawei, ZTE network kit won't be cheap or easy Ripping and replacing Huawei and ZTE equipment from German carrier networks is going to be a painful process, according to the country's economy ministry. The letter to the Bundestag lower house of parliament's economic committee, obtained by Reuters, warns that "there is likely to be significant impact on the operation of …
Quote: "....warned that the company's close affiliation with the Chinese government poses a substantial security risk..."
New text needed: "...also warned that the Cisco company's close affiliation with the US government poses a substantial security risk...."
.....and of course that means ripping out nearly all of the internet IP infrastructure.......
.....what a good idea.......that way our "security" and "privacy" fears would be COMPLETELY eliminated!!!!
Just saying!!
As long as equipment (hardware, firmware and whatever OS and applications are on it) cannot comply with Kerckhoffs' principle there is in essence no argument to trust it, irrespective from which part of the world and cultural or political club it hails.
It's been made a lot more complicated than it needs to be, and that's not by accident.
Difficult to hide stuff "in the chips" without someone, somewhere,noticing.
Its actually an indictment of our collective lameness with communications technology that this kind of thing gets serious consideration. The only reason why Huawei and ZTE got the job in the first place is that they had the equipment to supply. Where was our ("the West's") contribution? Miles behind, at best. The fact is that we in the US owned this technology at one time but the corporations who supplied the earlier generation kit saw more money in offshoring production, test and even development of next generation kit. As someone who's been impacted by this I don't have any sympathy for the "it will cost scads of money" gripes -- you wanted it cheap, you got it cheap, thank you very much -- and I regard the whole "its a security issue" thing with derision, it belongs in the same category as "magic spy chips".
(Put simply, if you can't look at a piece of kit and not know exactly what everything does and how to debug and monitor it then you shouldn't be pontificating about it.)
There is erricson, nokia, alcatel-lucent.
There has been supply chain hardware backdoors inserted in supermicro computers in targeted attacks. So its not just hardware, or software, that is the problem. And as phones dont/cant use end to end encryption and phone numbers are easier to tie to a person, this is a fair risk.
Has there ever been any proof of this beyond an article in one publication?
Not that I know of. The report (multiple reports, but they were repetitions) were quickly disparaged. One big reason was that it is not enough to sneak a chip onto the board - it must do something detectable to do something useful, e.g., phone home, respond to external connections, etc. Nothing of the kind was ever detected on sites that were allegedly subject to the HW supply chain attack, and those sites deployed IDSs of various kinds. Those were serious players, Amazon among them IIRC (I don't recall who else, it should be relatively easy to dig up).
This is a general weakness of these HW supply chain conspiracy theories. It is possible to place an extra chip on a board, it is not quite so feasible to keep what it does undetectable, even without super special means.
Now, if Huawei, ZTE, etc. have their equipment installed on every street corner and o military bases and in Matt Hancock's office and no one checks what they send to the mothership there may be a problem. There is no contradiction.
"One big reason was that it is not enough to sneak a chip onto the board"
Nope, but what chip only does one thing these days?
Chips usually have multiple options on them: They do more than one task, because it's easier to make one chip that does several things than several chips that do one thing each. It's cheaper and faster to produce and you don't have stock of chip X sitting around because no one wants that one function at the moment.
This then leads to the theory that the chip has a back door because there's unused functions on it. Or unnecessary functions. Except they're not soldered in/wired in so can't be used. Unless someone does solder them in, but that could easily be laziness or to keep the chip secure: That particular circuit won't be included in the PCB so who cares? Anyway, they don't need to sneak a chip onto the board: They'd just need to include the circuit in the PCB. That just means the company using the chip has to be introducing the back door, not that the chip manufacturer is doing so.
But as you mention: The signal home will be detectable, if you're paying attention.
"There is erricson, nokia, alcatel-lucent."
Nope, there is Ericsson and Nokia. Together with Huawei they are the 3 main 5G suppliers, with ZTE apparently coming in 4th.
Alcatel-Lucent's telco business was bought by Nokia in 2016. Likewise Siemen's telco business formed a joint venture with Nokia, NSN, in 2007, which Nokia completely bought out in 2013.
And keeping in mind that the Global CISO for Huawei (not sure if he has retired yet, but at the time of this product development) was previously the CISO for the UK government and that the US CISO previously worked in a US government CISO role.
Yes, both US and China products for all companies will possess "Lawful Intercept Gateway"- LIG Ports, to allow legally authorised access to traffic, which of course could be abused.
The complex part at the individual level is binding IPs etc. to actual individuals, it can of course be achieved with legal access to Internet Service Provider data that could also be subject to authorised access. Also, it may be associated with the unique IMEI (International Mobile Equipment Identity) of a mobile device, or the IMSI (International Mobile Subscriber Identity) - which I can see when it flies through my switches even if the payload is encrypted - and if I think you are a "person of interest" allows me at least to see which other potential undesirables you are communicating with, and put them on my suspects list as well. In China this is all helpfully made easier in that if I buy a SIM card I have to show my passport/state ID at the time of purchase, thus binding these two numbers to me without troubling the provider.
Really, the only things different are the motivations of the interested parties.
(Please no gratuitous downvotes just for mentioning Huawei, China, or pointing out some facts).
a) Absolutely, just as Huawei and ZTE are a security risk for Germany because they're Chinese, Cisco is also because of the US. There is only 1 of the 2 that was bugging a German chancellor's phone, and it wasn't China.
b) It might be both political/security safety-first idea as well as long-term economically advantageous for Germany to use European suppliers Nokia or Eriksson (or Siemens if they build this stuff)*
c) I see no reason to panic and rip up and replace everything. Just don't buy any new Chinese/US kit and continue to build with other vendors' kit. Most of it would be replaced in 3-4 years anyway. Just do a security review and rip and replace only particularly security-sensitive bits of equipment.
* I understand that there's a fairly large possibility that Huawei, ZTE, Cisco, Nokia, Eriksson and Siemens components are all manufactured in China!!!
It depends upon what threats you are worried about. If your protocols are secure in themselves (i.e. working end-end encryption, etc) then the telco equipment can't see the contents no matter how they are routed and through who's equipment. But if you have control over the equipment in a given country, for example, you can use it for several obvious activities no mater what:
- Get the metadata on who is talking to who (and in the case of mobile phone networks where they have been), useful if you want to target specific individuals, identify who works at/with a specific company or gov department, etc.
- Copy encrypted data passing within that country so in 5-10 years time, or if other leaks / cryptanalysis breakthrough / etc happen, you might be able to decrypt it.
- Bring down comms if you enter any sort of conflict where business niceties go by the wind
Working end-to-end encryption you say? I thought we were busily banning that..
BTW, I suppose there are some endpoints such as POTS PBXs where encryption is not possible due to legacy interfaces
The other security risk I can think of is firewall devices. A backdoor in a firewall could do a lot of damage, given the amount of remote vulnerabilities in Windows etc.
"How does that play when the UK network has to meet another network which does use Huawei ? Surely the carried with the Huawei network is still capable of spilling secrets the UK network is trying to keep safe ?"
If you are referring to calls or data transfers between the relevant UK network and another (non-UK) network then obviously traffic has to be exchanged in order for calls/data to pass, and obviously UK networks don't have any control over the security etc of non-UK networks.
But that wouldn't/shouldn't have an impact on the "security" of intra-UK networks (calls and data), assuming there is a sane firewall configuration at the UK networks' boundary.
It's like you sending a parcel to a friend in another country and wanting to be sure that the other country's customs people won't open the parcel - there's nothing you can do to prevent that...
This suspect equipment sits on networks that are under our management. And we, very possibly GCHQ, have the means to capture and monitor the traffic. Surely, any traffic with Chinese IP addresses could be detected and the payloads captured?
If we have the means to capture and decode dark web traffic to intercept drugs cartel intel, then we must be able to see if China really does receive our telecoms traffic. And, if they don't, then a vast amount of money is being wasted.
@steamnut
Quote: ".....capture and monitor the traffic.....Chinese IP addresses..."
Not a network person...........but the assumption in this quote is that "suspicious" traffic is going directly to a known (see whois) Chinese IP address.
.........Suppose the " suspicious" traffic is encrypted by using a VPN, and is targeted from the VPN end point (say in Arizona, USA) to some dark web IP address who-knows-where?
Problems:
(1) VPN encryption
(2) VPN destination not in China
(3) Unknown final destination
By the way, these problems cast doubt on the ability of anyone at all:
(4) To suggest that they have identified "suspicious" traffic
(5) .....never mind actually proving their suspicions
.....but I do agree about your comment about "money....being wasted"!!
Welcome to the internet in 2023!!!
It has been commonly reported that US technology companies were doing precisely what the US government is accusing China of.
It stands to reason, that the Chinese would have the desire, motivation and capability to do so. So in principle we have to assume they are doing so, much as they publicly admit they do on their own citizens (although presumably more targeted abroad).
I seem to recall that the UK government had a specific software team that had the explicit role of studying Huawei software and electronics for suitability/backdoors.
I seem to recall that the UK government had a specific software team that had the explicit role of studying Huawei software and electronics for suitability/backdoors.
.. who publicly reported that they found nada. Bad code, OK, but he who is without sins and all that, but backdoors? None.
What we DID know is that Huawei was years ahead in 5G, and the Americans really didn't like that. So, as now with ASML, they blackmailed other governments to help them stay competitive by locking out competition they could not control. China's too big to bomb or blackmail and it can shoot back, so it had to be done another way.
As I said before, I have no reason to trust either party, but I go by the facts. So far, Huawei has come out clean, so draw your own conclusions.
It's a shame, really, because some intelligent collaboration would have been more productive for both, but the problematic word is 'intelligent'..
"Surely, any traffic with Chinese IP addresses could be detected and the payloads captured?"
In some/many telcos now the telco's own staff don't actually manage the systems, the vendors staff do, and it is likely that there is some form of off-site access to systems.
Therefore, for example, Huawei and ZTE kit may be accessed/managed from one or more of their offices (perhaps in-country, perhaps not), so it is not as simple as looking for Chinese IP addresses.
The GCHQ actually already reviewed the Huawei/ZTE equipment some years ago (before the political decision was made to ban the hardware), the head of GCHQ made a rare public address on the issue of possible vulnerabilities and he said there was nothing they saw in their testing to indicate any significant or intentional vulnerabilities in the hardware — there's always a chance they missed something but unlike a lot of hackers you can imagine they had hardware engineers probably comb over this stuff with an electron microscope, for him to go on record with that confidence
GCHQ, Germany, Belgium, the E.U and France investigated Kaspersky software after the U.S banned it and found no evidence of spying. The U.S is still struggling to remove Kaspersky from Federal systems as it is embedded into dozens of products. Putin's incompetence in intelligence gathering and dissemination prior to the Ukraine invasion should be a clue as to their spying and intelligence skills.
Chinese and Russian hackers regularly plunder U.S companies for intellectual theft and espionage, most U.S companies have proven they couldn't keep the recipe of a bologna sandwich secret.
Interesting question..
Almost three years have passed since USA attacked Huawei and we still do not have single true evidence either USA or from independent sources.
Let's expand this..
- USA attacked Irak twice, still no evidence of mass killings.
- USA attacked Libia - no evidences
- USA attacked Serbia - no evidence of war crimes
It seems America no longer needs to provide evidence for their claims
To be more accurate....
"- USA attacked Irak twice, still no evidence of mass killings."
USA attacking Iraq was never about mass killings.Iraq 1 was in defence of Kuwait, whom Iraq had invaded. Perfectly legitimate, and not much different to what US and EU are doing with Ukraine at the moment (In Iraq 1 of course there were western troops on the ground, not only material / logistical / political support).
Iraq 2 (incidentally, today marks the 20th anniversary of it) was about supposed WMDs, weapons which UN inspectors had been looking for since Iraq 1 and found nada still in place. US and UK said they had proof but never showed it (and later it turned out their proof was made-up crap). Completely destabilized the whole region for decades, millions killed, lots of political points for the chickenhawk Republicans and billions of arms orders for the military-industrial complex. WMDs found: 0
"USA attacked Serbia - no evidence of war crimes"
There's plenty of evidence of small-scale* war crimes happening in the post-Yugoslavia civil wars. There's also tons of evidence of war crimes happening in small and large-scale conflicts all over Africa, the Middle East and SE Asia, where the rest of the world doesn't fly in shooting missiles now and asking questions later.
"It seems America no longer needs to provide evidence for their claims"
Never have, never will, ever since the days of the Monroe doctrine (aka all the Americas are belong to US)
* of course I don't want to trivialise this, war crimes are always serious, they don't always justify external military intervention by Team America World Police
The US had two reasons to try to eliminate Huawei
1) Huawei kit was cheaper than the equivalent Cisco kit and Cisco donated a lot of money to US politicians
2) Huawei did not preinstall the NSA backdoors
Chinese spying was never a reason - just a slightly plausible excuse
Icon for what should happen to politicians that put their bank account over the well being of their country (99+ of all politicians)
===============>
Their mobile business was likely to make Qualcomm irrelevant as well.
In the US at least politicians are cheaper than engineers.
(In a different dimension it was reported that high power K-Street lobbying outfits were lobbying on behalf of Ukraine for free. Very altruistic -- until you realize its our defense conglomerates that are picking up the tab.)
While there is a lot of talk about back doors for spying, the reality is a back door to shut down the network is a lot more likely and impossible to detect.
Useful for the Chinese government as an economic weapon, to be able to shut down 60% of Germany's mobile network if they support imposing sanctions because China invaded Taiwan for example.
I seriously cannot understand why the German government is so naive and slow to realize putting you energy security and critical communications infrastructure under the control of the world's two biggest dictatorships (effectively) is not a good idea.
A backdoor that shutdown the network is pretty useless though, unless it's used in a country that you're planning to militarily attack.
Think about it: If you're going to attack the country then the mobile networks going down would certainly cause disruption that could make your military attack more impactful, or likely to succeed. But if you're not attacking them then activating the hidden backdoor would realistically cause only some short-term public disruption - until the country were able fix it or switch to alternative hardware. They're certainly not going to back-down on any sanctions - the public anger alone would make this impossible - they're going to escalate sanctions and other actions instead.
China is absolutely not going to attack Germany, a country half-way around the world, NATO member, and key ally of three nuclear armed countries. So if there was one, then activating a hidden backdoor will only make things worse for China.
The only value of that kind of backdoor is as a threat _before_ the sanctions - but that's a one time threat, that would be just as likely to lead to the information being made public, and then every country will stop using Chinese equipment rather than just the US and whatever countries it can strong-arm into following suit.
Now German is under the control of the greatest dictatorship of all.
The USA is no friend of Germany. This is about American hegemony and nothing else. Project for a New American Century = 1 place for the USA and everyone else can eat shit. China is far more competitive than the USA, and that just won't do. Russian gas is far cheaper than American gas and that won't do.
The economic weapon that you mention is being wielded by the USA.
China is the epitome of "We own you wholesale" (see Ankh-Morpok national anthem).
They don't need to "dominate' the world. They just want to sell stuff. Lots and lots of stuff. Anyway, there are enclaves of Chinese ex-pats (or rather, "people of Chinese ancestry") all over the world who seem to be thriving. Why go to the bother invading?
The only way to 'deal' with China is to accept the challenge and compete. (Well, there was another way -- introduce globalization and get them onto the American lifestyle. But we chose confrontation and nationalism. Bad move -- you don't want to unify a competitor, you need to give them lots of reasons to become fat and lazy.)
The USA is the epitome of "We own you wholesale". They can't stand the inconvenient truth that China has a good shot at taking this away from them. That's the only reason they have launched this trade war (or "special non-military operation" as it would be described in Moscow).
I can’t see an attack vector. Unless someone has bought an entire vertically integrated network built by one vendor, how could a back door possibly work? There would have to be collusion between multiple vendors at multiple layers of the network and across separate planes.
Think about what’s being proposed - that a network element can, on the fly, decrypt traffic, forward a copy somewhere else, re-encrypt to the original schema and send it in to the original destination without anyone noticing that traffic egress is double ingress, that there’s an unexplained transit delay from the box or that it’s consuming vast amounts of power brute forcing keys? It’s like a moon landing conspiracy.
"The main concern being that Chinese intelligence services could force Huawei to place back doors into their equipment"
Considering that a very high proportion of everyone else's kit is actually manufactured in China, there would on that basis be a reasonable chance of inserting backdoors in almost any brand of kit.
The UK's Huawei Oversight Board's chief concerns in their several annual reports was to date not backdoors but lousy development standards and poor quality control (in which I suspect they're far from unique either).
Huawei is slammed by USA government stating that they cooperate with a China Government.
But USA as land of freedom and law has not provided not a single hard evidence of Huawei equipment sending data to Chinese government.
Having in mind that Huawei equipment does not use cloud data storages, it is quite easy to check what data is that equipment sending ant to whom. However, only "proof" USA has provided was list of couple Huwei workers who were officers in the Chinese army.
To make it worse, three years have passed without single USA or independent evidence of Huawei wrong doing.
On the other side, Apple is storing data in the cloud and they refused to provide data to courts even with court order. At the same time they are fully cooperating with the USA intelligence agencies.
At this moment, I'm more worried for Apple devices who provide my data to NSA and CIA than Huawei equipment which is still not proven to provide one's data.
Not sure about Germany but remember when the UK government wanted all Huawei kit removing? The CPS weren't happy about this as they were clearly aware of how much Huawei kit there is out there and how much it would cost to replace and how long the job would take. They explained this to gov.uk who changed TAC slightly by saying only "gigabit capable" kit needed to be replaced.
At that point I was puzzled. There's not much carrier grade network kit around that isn't gigabit capable. You're not getting far without backhaul at gigabit and above. However the government had an answer for that. They meant kit that delivers gigabit services to end user. Which of course lets most of the Openreach off the hook for all those street cabs that happen to be Huawei AIO kit. Most of them might only support subscriber connections at up to 80Mbps, but the cab as a whole be be capable of shifting a gigabit/sec or more back to the exchange. Then there are a whole load of ADSL MSANs sitting in exchanges owned and operated by multiple CPs. Again the lines they support might only be up to 24Mbps but their backhaul is going to be a gig or above.
Since full fibre to the premises is still a distant dream for most properties in the UK this means that most of the network will still be passing through Huawei kit. This fact alone shows that this doesn't really have anything to do with security. In what way does the speed of a subscriber connection dictate whether there is a security risk or not?
Unsurprisingly gov.uk have an answer for that too should you be bold enough to answer the question. They claim that we'll all be on gigabit services soon so there's no point replacing the Huawei kit now. Their claim is that all the stuff that's less than gigabit capable will be out of service soon so there's no point rushing to replace it. Except that is grade A prime BS. The government's laughable target to move everybody to high speed fibre broadband by 2025 is not what it seems. In that context "fibre" means fibre to the cabinet - weasel words if ever I heard them. Fibre to the cabinet does not in any way mean high speed. It certainly does not mean gigabit. There is no planned switch off date for those FTTC DSLAMs. Worse still I know of plenty of services where the distance from the cab to the property is over a kilometre and the subscriber is getting speeds no better on VDSL than they were when on ADSL, in some cases worse.
If the government are really concerned about security they would fund a project to remove all the Huawei infrastructure in UK networks. Clearly they are not.
What puzzles me most however is the assumption among many that the only alternative is Cisco, or indeed that the only alternative is American.
Another bit of Government/Ofcom/Openreach BS is the concept of copper stop sell.
Where exchanges are due to be shut down Openreach will impose a copper stop sell order on that exchange. This absolutely does not mean they no longer sell copper services to properties in the area, what it really means is that they will no longer sell PSTN/LLU from that exchange. They will still be selling copper services, but they have just stopped calling the copper VDSL services served from street cabinets FTTC services. Now they call them SOGEA - single order generic ethernet access (IIRC).
Remember when FTTC first became a thing? If you ordered it from BT it would come with a square white Openreach branded box with three connectors - the power socket, an xDSL port and an ethernet port. Basically it was a modem but for some reason BT didn't like to call it that. The Openreach engineer would usually wall mount this next to your NTE presumably this was because VDSL routers weren't all that common and it also made the install more like cable installs were at the time. Remember when you had your cable modem and a router? Anyhow that sort of install died a death, although I still come across these boxes in use today. Well if you order SOGEA over copper now you get something very similar, but it also has an RJ11 port so you can continue to use a PSTN type phone with your line.
Basically SOGEA is just a way of Openreach saying they don't sell copper services any more, even when they do.
Not too keen to go into reasons and real reasons, but I find it mad for any country, including Germany, to go into a stripping frenzy in a panic because of Chinese hardware.
Yes, I think we in Europe ought to be less dependent on imports and that applies to energy too.
However replacing energy imports is not much of a problem in comparison to replacing lost knowledge and lost industries.
If Germany is to about 60% Huawei and ZTE then about 40% has to be something else so there must be a choice apparently.
There are ways to compete and the best way is, I would claim, just to be better.
Sadly that often requires long time planning and education, and things like that are so damned tedious and slow to rely on, for some.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
