---

1.媒體來源:
Bloomberg


2.記者署名:
Daniele Lepido


3.完整新聞標題:
Vodafone Found Hidden Backdoors in Huawei Equipment



4.完整新聞內文:
For months, Huawei Technologies Co. has faced U.S. allegations that it flouted
 sanctions on Iran, attempted to steal trade secrets from a business partner a
nd has threatened to enable Chinese spying through the telecom networks it’s
built across the West.

Now Vodafone Group Plc has acknowledged to Bloomberg that it found vulnerabili
ties going back years with equipment supplied by Shenzhen-based Huawei for the
 carrier’s Italian business. While Vodafone says the issues were resolved, th
e revelation may further damage the reputation of a major symbol of China’s g
lobal technology prowess.

Europe’s biggest phone company identified hidden backdoors in the software th
at could have given Huawei unauthorized access to the carrier’s fixed-line ne
twork in Italy, a system that provides internet service to millions of homes a
nd businesses, according to Vodafone’s security briefing documents from 2009
and 2011 seen by Bloomberg, as well as people involved in the situation.

Vodafone asked Huawei to remove backdoors in home internet routers in 2011 and
 received assurances from the supplier that the issues were fixed, but further
 testing revealed that the security vulnerabilities remained, the documents sh
ow. Vodafone also identified backdoors in parts of its fixed-access network kn
own as optical service nodes, which are responsible for transporting internet
traffic over optical fibers, and other parts called broadband network gateways
, which handle subscriber authentication and access to the internet, the peopl
e said. The people asked not to be identified because the matter was confident
ial.

A backdoor, in cybersecurity terms, is a method of bypassing security controls
 to access a computer system or encrypted data. While backdoors can be common
in some network equipment and software because developers create them to manag
e the gear, they can be exploited by attackers. In Vodafone’s case, the risks
 included possible third-party access to a customer's personal computer and ho
me network, according to the internal documents.

The Trump administration, arguing such end-runs around security in Huawei’s e
quipment could invite espionage by the Chinese state, is trying to persuade We
stern allies to block the company from the next generation of mobile networks.
 Huawei has repeatedly denied that it creates backdoors and says it’s not beh
olden to Beijing.

Huawei’s ability to continue winning contracts from London-based Vodafone, de
spite the carrier’s security concerns, underscores the challenge facing the U
S. as it tries to hinder the world’s top telecom equipment vendor and No. 2
supplier of smartphones. Huawei is vying against a stable of Western companies
 including Nokia Oyj and Ericsson AB to roll out fifth-generation, or 5G, wire
less networks.

Vodafone has defended Huawei against the U.S. onslaught, which has placed Euro
pe—Huawei’s largest market outside China—in the middle of a trade battle be
tween two superpowers. At stake is leadership in key areas, principally 5G tec
hnology that’s designed to support the internet of things and new application
s in industries spanning automotive, energy to healthcare. Vodafone Chief Exec
utive Officer Nick Read has joined peers in publicly opposing any bans on Huaw
ei from 5G rollouts, warning of higher costs and delays. The defiance shows th
at countries across Europe are willing to risk rankling the U.S. in the name o
f 5G preparedness.

In a statement to Bloomberg, Vodafone said it found vulnerabilities with the r
outers in Italy in 2011 and worked with Huawei to resolve the issues that year
 There was no evidence of any data being compromised, it said. The carrier al
so identified vulnerabilities with the Huawei-supplied broadband network gatew
ays in Italy in 2012 and said those were resolved the same year. Vodafone also
 said it found records that showed vulnerabilities in several Huawei products
related to optical service nodes. It didn’t provide specific dates and said t
he issues were resolved. It said it couldn't find evidence of historical vulne
rabilities in routers or broadband network gateways beyond Italy.

“In the telecoms industry it is not uncommon for vulnerabilities in equipment
 from suppliers to be identified by operators and other third parties,” the c
ompany said. “Vodafone takes security extremely seriously and that is why we
independently test the equipment we deploy to detect whether any such vulnerab
ilities exist. If a vulnerability exists, Vodafone works with that supplier to
 resolve it quickly.”

In a statement, Huawei said it was made aware of historical vulnerabilities in
 2011 and 2012 and they were addressed at the time.

However, Vodafone’s account of the issue was contested by people involved in
the security discussions between the companies. Vulnerabilities in both the ro
uters and the fixed access network remained beyond 2012 and were also present
in Vodafone’s businesses in the U.K., Germany, Spain and Portugal, said the p
eople. Vodafone stuck with Huawei because the services were competitively pric
ed, they said.

While backdoors are common in home routers, they are usually fixed by manufact
urers once disclosed, said Eric Evenchick, Principal Research Consultant at At
redis Partners, a U.S. based cybersecurity firm. Evenchick called the situatio
n with Huawei’s equipment “very concerning.”

Founded in 1987, Huawei entered the European market in 2000. Landmark contract
s with Britain’s BT Group Plc and Norway’s TeliaSonera helped Huawei win mar
ket share from—and eventually surpass—Nokia and Ericsson.

Vodafone started buying wifi routers from Huawei in 2008 for its Italian busin
ess and, later, for the U.K., Germany, Spain and Portugal. Routers are special
ized machines that assist in directing voice and other kinds of data coursing
over the internet.

Pulling Ahead
Between 2013 and 2018, Huawei increased its telecom market share by 8 percenta
ge points.

Vodafone managers had concerns with the security of the routers almost right a
way. They were the topic of an internal presentation from October 2009 that po
inted to 26 open bugs in the routers, six identified as “critical” and nine
as “major.” Vodafone said in the report that Huawei would need to remove or
inhibit a so-called telnet service—a protocol used to control devices remotel
y—that the carrier said was a backdoor giving Huawei access to sensitive data
.

In January 2011, Vodafone Italy started a deeper probe of the routers, accordi
ng to an April report from the year. Security testing by an independent contra
ctor identified the telnet backdoor as the greatest concern, posing risks incl
uding giving unauthorized access to Vodafone’s broader Wide Area Network (WAN
 is a network that spans a large footprint). Vodafone noted that it’s an indu
stry practice by some router manufacturers to use a telnet service to manage t
heir equipment, but the company said it didn’t allow this.

The document chronicles a two-month period during which Vodafone’s Italian un
it discovered the telnet service, demanded its removal by Huawei and received
assurances from the supplier that the problem was fixed. After further testing
, Vodafone found that the telnet service could still be launched.

Vodafone said Huawei then refused to fully remove the backdoor, citing a manuf
acturing requirement. Huawei said it needed the telnet service to configure de
vice information and conduct tests including on wifi, and offered to disable t
he service after taking those steps, according to the document.

Huawei’s apparent reluctance only amplified concerns that were circulating ev
en then that the company might pose a security threat to customers.

“Unfortunately for Huawei the political background means that this event will
 make life even more difficult for them in trying to prove themselves an hones
t vendor,” Vodafone said in the April 2011 document authored by its chief inf
ormation security officer at the time, Bryan Littlefair. He noted that Vodafon
e had made a recent security visit to Shenzhen and said he was surprised Huawe
i hadn’t given the matter a greater priority.

What is of most concern here is that actions of Huawei in agreeing to remove t
he code, then trying to hide it, and now refusing to remove it as they need it
 to remain for ‘quality’ purposes,” Littlefair wrote.

Huawei declined to comment on the concerns raised by Littlefair. Littlefair di
dn’t respond to requests for comment.

“There’s no specific way to tell that something is a backdoor and most backd
oors would be designed to look like a mistake,” said Stefano Zanero, an assoc
iate professor of computer security at Politecnico di Milano University. “Tha
t said, the vulnerabilities described in the Vodafone reports from 2009 and 20
11 have all the characteristics of backdoors: deniability, access and a tenden
cy to be placed again in subsequent versions of the code,” he said.

Huawei called software vulnerabilities “an industry-wide challenge.” In a st
atement, it said: “Like every ICT vendor we have a well-established public no
tification and patching process, and when a vulnerability is identified we wor
k closely with our partners to take the appropriate corrective action.”

Made in China
Huawei has a lot of market share to lose in Europe, the Middle East and Africa

Huawei has expanded its relationship with Vodafone well beyond routers and is
now its fourth-largest supplier behind Apple, Nokia and Ericsson. Huawei’s ge
ar is found across Vodafone’s wireless networks in Europe; in the U.K., equip
ment from Huawei accounts for about one-third of the radio-access network, a c
ritical piece of the infrastructure.

Some telecom companies have taken steps to limit Huawei’s exposure from the m
ost sensitive parts of their networks, amid the added government scrutiny. In
January, Vodafone’s CEO Read said the company had paused purchases of Huawei
equipment for the core of its mobile networks in Europe, citing too much “noi
se” around the situation.

Still, carriers including Vodafone are fighting against the threat of Huawei b
eing banned in Europe because they’ve come to rely so heavily on the supplier
 Abandoning Huawei for 5G, with Europe already lagging behind China and the U
S., could force them to rip out the supplier’s 4G gear, a process that could
 take years and cost billions of dollars.

— With assistance by Tommaso Ebhardt, Tom Giles, Thomas Seal, Frank Connelly,
 and Patricia Suzara



5.完整新聞連結 (或短網址):
https://tinyurl.com/y3ao6n69

6.備註:


--
--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 111.71.96.113
※ 文章代碼(AID): #1So2tVU2 (Gossiping)
※ 文章網址: https://www.ptt.cc/bbs/Gossiping/M.1556622815.A.782.html