Huawei security questioned around the world

Huawei security came under fire from multiple sides recently, and while experts downplayed some of the risks, Huawei's network technology is a growing part of global wireless networks.

The latest security troubles for Huawei began with a vulnerability in a Windows driver that could have led to privilege escalation attacks. In describing the process of finding the flaw, Microsoft mentioned DoublePulsar, a kernel backdoor created by the NSA and used as part of the WannaCry ransomware, but the company stopped short of comparing the Huawei issue to a backdoor.

"While the original alert turned out to be benign, in the sense that it didn't detect an actual kernel threat like DoublePulsar, it did trigger an investigation that eventually led us to finding vulnerabilities," wrote Microsoft's Defender Research Team in its analysis. "The two vulnerabilities we discovered in the driver prove the importance of designing software and products with security in mind. Security boundaries must be honored. Attack surface should be minimized as much as possible."

Despite expert views that the issue seemed benign, news reports of the Huawei security vulnerability likened the flaw to the NSA's backdoor and cast suspicion on Huawei.

"It was a pretty standard software vulnerability. Thousands of similar vulnerabilities are found every year," said Peter Firstbrook, research vice president at Gartner.

Jake Williams, founder and president of Rendition Infosec, based in Augusta, Ga., said the issue shows that Huawei lacks a secure development lifecycle.

"I definitely wouldn't call it a backdoor. If anything it's a bugdoor -- a backdoor that is disguised as a bug. It's hard to look at any vulnerability and conclusively say 'this is a backdoor,'" Williams said. "Huawei clearly doesn't use a secure development lifecycle and this is clearly to their detriment."

Huawei's security troubles continued with two scathing reports from the U.K. The Huawei Cyber Security Evaluation Centre Oversight Board, part of the U.K.'s National Cyber Security Centre (NCSC), also expressed concern over the company's software development and said the company could "provide only limited assurance that the long-term security risks can be managed in the Huawei equipment currently deployed in the U.K."

In an interview with the BBC, Dr. Ian Levy, technical director at the NCSC, added color to the report by calling Huawei security "very, very shoddy" and implying the British government should ban Huawei equipment.

In early March, Huawei began a proactive campaign to defend the company's security by opening a Cyber Security Transparency Centre in Brussels. During the opening ceremony for that facility, Ken Hu, Huawei's deputy chairman said, "Trust needs to be based on facts, facts must be verifiable, and verification must be based on common standards. We believe that this is an effective model to build trust for the digital era."

"We welcome all regulators, standards organizations, and customers to fully use this platform to collaborate more closely on security standards, verification mechanisms, and security technology innovation," Hu said. "Together, we can improve security across the entire value chain and help build trust through verification."