New Report Again Shows Global Telecom Networks Aren't Remotely Secure

from the maybe-we-should-fix-that dept

Last year, when everybody was freaking out over TikTok, we noted that TikTok was likely the least of the internet's security and privacy issues. In part because TikTok wasn't doing anything that wasn't being done by thousands of other app makers, telecoms, data brokers, or adtech companies in a country that can't be bothered to pass even a basic privacy law for the internet era. If we're serious about security and privacy solutions, we need to take a much broader view.

For example, while countless people freaked out about TikTok, none of those same folks seem bothered by the parade of nasty vulnerabilities in the nation's telecom networks, whether we're talking about the SS7 flaw that lets governments and bad actors spy on wireless users around the planet or the constant drumbeat of location data scandals that keep revealing how your granular location data is being sold to any nitwit with a nickel. Or the largely nonexistent privacy and security standards in the internet of broken things. Or the dodgy security in our satellite communications networks.

This week, Crowdstrike drove this myopia home again with a new report showcasing how Chinese hackers have compromised global telecom networks for years. The security firm found that since 2016 or so, a (likely Chinese state backed) hacking organization dubbed "LightBasin" or "UNC1945" targeted global telecom companies and was able to compromise 13 of them since 2019. First accessing an eDNS server through an SSH connection from the network of another compromised company, the hackers were able to obtain a trove of telecom data including subscriber information, call metadata, text messages and more, helping them develop a wide collection of snooping tricks:

"The report lays out how this group has developed highly customized tools and a precise working knowledge of global telecommunications network architectures such that it can emulate network protocols to allow scanning and “to retrieve highly specific information from mobile communication infrastructure.” The nature of the data targeted “aligns with information likely to be of significant interest to signals intelligence operations."

Of course this comes on the heels of a steady parade of other telecom security scandals, ranging from the SS7 flaw we still haven't fully fixed (opening the door to covert surveillance), revelations that most satellite networks have the security of damp cardboard, and recent reports of a company that handles billions of global text messages from carriers all over the world was compromised for years before anybody knew anything about it. Most of these reports come and go quietly without even a tiny fraction of the hysteria we saw aimed at TikTok.

Speaking to the press, Crowdstrike researchers were quick to point out that freaking out about malware and apps doesn't mean much if the underlying telecom infrastructure is compromised (and it very much is):

"People leverage their cellphones like they’re magic,” said Adam Meyers, CrowdStrike’s senior vice president of intelligence. “They don’t think about the fact that there’s this whole infrastructure that makes it work … and that infrastructure is not something that you can take for granted."..."They don’t need to deploy the malware onto your phone if they’re owning the network that your phone is riding on,” he said.

Granted much like everyday infrastructure issues like bridge repair, shoring up overall internet network security isn't a sexy topic that sees much traction. Unless you're a U.S. company lobbyist leveraging Xenophobia to your competitive and political tactical advantage (see the sometimes narrow hysteria surrounding 5G), much of this stuff doesn't see anywhere near the attention it deserves in a press and policy discourse that often couldn't care less.

Filed Under: privacy, security, ss7, telco equipment, telcos, telecom networks
Companies: crowdstrike

Huawei Now Using Patent Claims To Demand $1 Billion From Verizon, As The US Tries To Chase Huawei Out Of The US Market

from the patent-trade-wars dept

This one combines a few stories that we've covered a lot over the years, showing how they're intersecting. For some time now we've been covering the US's evidence-free attacks on Huawei, the Chinese telco equipment giant. Basically, for years, there have been stories insisting that Huawei is too closely linked to the Chinese government, leading to fear mongering stories saying that the company should be effectively barred from the US. However, multiple attempts to find security flaws in Huawei's products have failed to show any kind of backdoors, and the fact that US-based Huawei competitors often seem to be making the loudest noises about the Chinese giant should raise some eyebrows.

The other story we've covered a lot is around China and patents. For years and years, US companies (and policymakers) would go on and on about how Chinese companies didn't respect US patents, and demanding that China "must respect our IP." As we've highlighted for years, the Chinese government realized a decade or so ago that since the US kept trying to apply diplomatic pressure to "respect patents," China realized it could just start using patents as an economic weapon. The number of patents granted in China started to shoot up, and (surprise surprise) suddenly in legal disputes, Chinese companies were using patents to block American competitors. And the US couldn't really complain since it was the US that demanded China "respect patents" so much.

Just a few weeks ago, we noted that China was gearing up to respond to Donald Trump's ignorant trade war by using patents against US companies.

Put it all together, and it should be no surprise at all that Huawei is now demanding $1 billion from Verizon for patent infringement.

Verizon is reportedly using equipment through other companies that relies on Huawei patents covering core networking gear, internet of things technology and wireline infrastructure. Verizon and Huawei representatives met last week in New York to talk about whether the gear could infringe on Huawei patents, Reuters said.

"These issues are larger than just Verizon," a Verizon spokesman told Reuters. "Given the broader geopolitical context, any issue involving Huawei has implications for our entire industry and also raises national and international concerns."

The US government walked right into this. For years it's been demonizing Huawei without evidence, while at the same time demanding that China respect patents. So, of course, it opened itself right up to Huawei now claiming patent infringement against US companies. Even better, it's over third party gear. US policymakers can't seem to think more than a single move ahead, because it was fairly obvious how all of this would play out years ago, and yet they walked right into it.

Filed Under: china, patents, surveillance, telco equipment, trade war
Companies: huawei, verizon

US Huawei Blackballing Efforts Stall Due To Lack Of 'Actual Facts'

from the ill-communication dept

During the Trump era, the US government has dramatically ramped up claims that Chinese hardware vendor Huawei is a nefarious spy for the Chinese government, blackballing it from the U.S. telecom market. From pressuring U.S. carriers to drop plans to sell Huawei phones to the FCC's decision to ban companies from using Huawei gear if they want to receive federal subsidies, this effort hasn't been subtle.

While Huawei should never be confused with a saint (what telecom company would be?) there's several problems with the effort. The biggest being that despite a decade of hand-wringing and one eighteen month investigation by the US government, there's still no public evidence Huawei uses its network gear to spy on Americans. That's not sitting well with countries we've asked to join along in the fun.

The UK, for example, recently noted that while some Huawei products can pose risks by nature of simply being low quality, they've yet to see any threat posed by Huawei that necessitates a global ban. That position has since been repeated by other allies who have been pointing out how despite years of bluster on this subject, they've yet to see the US government release the slightest bit of evidence supporting the allegation:

"European and Asian officials have complained privately that recent American intelligence briefings for allies did not share any sort of classified information that clearly demonstrated how the Chinese government used Huawei to steal information, according to people familiar with the discussions. European officials have told counterparts that if the United States has evidence the Chinese government has used its companies to do so, they should disclose it.

One senior European telecommunications executive said that no American officials had presented “actual facts” about China’s abuse of Huawei networks.

Of course this is all hidden behind claims that this information is classified. But how hard is it to redact and provide at least some information proving your point? These allegations have also been bubbling up in fits and starts for over a decade now, and not a single security expert or any government official has been able to provide any evidence whatsoever to prove their point. While it's certainly not impossible that Huawei helps the Chinese government spy, evidence is important. Can you imagine the hysteria on countless fronts if a US company like AT&T was banned from other countries without any supporting data?

Unmentioned in coverage of this hand-wringing about Huawei has been the fact that much of the hysteria on this front has been drummed up by US networking companies, who simply don't want to compete with cheaper Chinese gear. With countless global gear makers rushing toward the trough as wireless carriers build next-generation 5G wireless networks, these efforts have only intensified. US gearmakers and their favorite lawmakers have a good schtick going: profess China must be banned from all global telecom markets based on claims of spying, then hide behind national security when anybody asks for proof.

Also ignored is that all of the hysteria about Huawei obfuscates a larger security threat (much of it originating in China): the lack of security in shitty internet of things gear. At this point you don't really need Huawei to spy on Americans, since we're connecting millions of poorly secured devices to our home and business networks annually voluntarily. Gear that often lacks any sensible security countermeasures whatsoever.

Similarly ignored is the fact that the US has engaged in most of the behavior we accuse Huawei of, including having broken into Huawei to spy on company executives. You'll often see stories like this one highlighting China's nefarious attempts to tap into undersea cables. But the press ignores that the US has been engaged in its own undersea cable and satellite communications wiretapping efforts for decades. Many of these efforts began decades ago (like Echelon), and were ridiculed as tin-foil-hat fantasy until the Snowden documents were revealed.

Again, none of this is to defend China's actual abuses, or to suggest that Huawei hasn't engaged in bad behavior. But imposing a global ban on a telecom giant for spying based on no actual evidence remains a shaky proposition, and it's something countless supporters of the blackballing effort would be screaming about incessantly were the shoe on the other foot.

Filed Under: blackballing, china, competition, fear mongering, spying, telco equipment, us
Companies: huawei

UK Suggests US Worries About Huawei Spying Are Being Overblown

from the protectionism-by-another-name dept

So, while there's really no denying that Chinese smartphone and network gearmaker Huawei engages in some clearly sketchy behavior, it's not anything that can't be matched by our own, home-grown sketchy telecom companies. And while the Trump administration has been engaged in a widespread effort to blackball Huawei gear from the American market based on allegations of spying on Americans, nobody's been able to provide a shred of public evidence that this actually occurs. At the same time, we tend to ignore the fact that the United States broke into Huawei to steal code and implant backdoors as early as 2007.

In short, this subject is more complicated that the blindly-nationalistic U.S. press coverage tends to indicate, and a not-insubstantial portion of this hand-wringing is driven by good old-fashioned protectionism.

Throughout this whole thing, Huawei executives have been right to note that in the decade-plus of these allegations and hand-wringing, you'd think some security researcher would have been able to prove that Huawei gear is spying on Americans wholesale. And last week, as news emerged that the Trump administration was finally considering a full domestic ban on using Huawei gear, our closest surveillance allies in the UK made it clear that the Huawei threat is likely being overstated by the United States:

The United Kingdom could undermine an American-led campaign to keep Chinese tech company Huawei out of super-fast 5G mobile networks around the world. The National Cyber Security Centre, part of the UK intelligence service, has concluded that there are ways to limit the risks of using Huawei to build next-generation wireless networks, according to a report by the Financial Times.

The report reiterated past concerns that while some Huwei gear may pose a security threat, it's likely because the products can sometimes be shitty, but not because they're being intentionally backdoored by the Chinese government:

If anybody knows just how Huawei works and the threat it might pose to the UK's security, it is the National Cyber Security Centre.

This arm of GCHQ has been in charge of an annual examination of the Chinese telecoms giant's equipment, and expressed concerns in its most recent report - not about secret backdoors, but sloppy cyber-security practices.

That's of course pretty common with most hardware coming out of China (especially in the internet of things space), which sort of makes the point that the Chinese don't need backdoors in Huawei gear to spy on Americans, since we're willfully putting a wide variety of shitty, half-baked IOT gear on our networks, providing industrious hackers and intelligence agencies an entire universe of attack vectors into millions of U.S. homes and businesses. Still, the solution for this is to only install gear you know to be secure, not by banning an entire company from doing business (something we aren't all that keen on when it happens to us).

If you've paid attention, U.S. gearmakers have been ginning up Huawei security fears for years, simply because they don't want to have to compete with cheaper gear. The Trump administration appears pretty happy to play along, dressing up simple protectionism as national security. And because the U.S. tech press often can't see past its own patriotism, it's coming along for the ride. Again, none of this is to say that Huawei doesn't engage in sketchy shit, just that if we're going to blackball a company for spying--providing some actual evidence of said spying is a pretty important first step.

Filed Under: china, spying, telco equipment, uk, us
Companies: huawei

As Trump Prepares Ban On Huawei, Few Notice The Major Holes In The Underlying Logic

from the do-as-we-say,-not-as-we-do dept

During the Trump era, the government has dramatically ramped up claims that Chinese hardware vendor Huawei is a nefarious spy for the Chinese government, blackballing it from the U.S. telecom market. From pressuring U.S. carriers to drop plans to sell Huawei phones to the FCC's decision to ban companies from using Huawei gear if they want to receive federal subsidies, this effort hasn't been subtle.

This week, there are rumblings that the Trump administration is about to take things further with a total ban on Huawei gear anywhere inside of the United States. The news is to be formally announced ahead of the Mobile World Congress trade show in Barcelona, likely with a heavy emphasis on how the move will cement U.S. dominance in the "race to 5G," a largely nonsensical concept drummed up by networking hardware vendor marketing departments.

The problem: there's still no public evidence Huawei uses its network gear to spy on Americans, and much of the motivation for this assault on Huawei has been proven to be largely about protectionism, not national security.

There's no doubt that Huawei, like AT&T here in the states, isn't a shining beacon of ethical behavior. At the same time, the dulcet undertones justifying much of the blacklisting is based on the premise that the company spies on Americans. Yet nobody has provided evidence of that. In fact, one 18-month investigation into Huawei in 2011 (the last time we had a flare of up this hysteria) found that there was no evidence supporting that claim:

"We knew certain parts of government really wanted” evidence of active spying, said one of the people, who requested anonymity. “We would have found it if it were there."

Also ignored is that U.S. hardware vendors like Cisco have a very long history of trying to gin up hysteria on Capital Hill on this front among lawmakers who aren't too keen on, well, facts:

"What happens is you get competitors who are able to gin up lawmakers who are already wound up about China,” said one Hill staffer who was not authorized to speak publicly about the matter. “What they do is pull the string and see where the top spins."

Also ignored in most tech press coverage of the moves against Huawei is the fact that the United States is guilty of most of the stuff we accuse Huawei of. In fact, Snowden docs revealed that the NSA (aka the United States) had broken into Huawei as early as 2007 in a bid to steal source code and covertly implant backdoors into Huawei products. Similarly you'll recall how the NSA was also busted intercepting Cisco hardware in transit, taking that gear to a special facility, then outfitting it with backdoors. That sends a pretty clear message: unethical behavior is okay when we do it.

Also ignored is the fact that our own telecom operators don't have stellar backgrounds on this subject either. AT&T, for example, is effectively bone-grafted to our nationwide intelligence apparatus, and almost certainly helps the United States spy on citizens all over the world. AT&T, a company just busted paying $600K to a dubious NYC fixer and confessed criminal, has a long history of turning a blind eye to all manner of frauds and cons being perpetrated on its own customers. Again, the message sent is: unethical behavior is okay when we do it.

Look, Huawei is no pillar of virtue, having been caught copying code and (depending on how the court battle goes) potentially violating sanctions. But a large portion of the justification for blacklisting them (in turn escalating an already troubling and costly trade war) is based on the idea that Huawei has been caught spying on Americans, something that hasn't been publicly proven. And in filings with the FCC (pdf), small carriers say they'll actively be harmed by a ban on this cheaper Huawei hardware, since the lower costs help them better compete with larger U.S. rivals.

In short, this subject is far more complicated than most press coverage suggests, and a little fuller context when it comes to discussing these moves doesn't seem like too much to ask. Especially given that the American press and government would be positively apoplectic were foreign countries to ban our own network gear as punishment for our own, well-documented sins. Patriotism oddly blinds us to our own hypocrisy on this subject, lending some wonderful cover to U.S. companies who've been pressing all the right buttons in DC in a protectionist bid to avoid having to compete with cheaper Chinese gear.

Filed Under: china, competition, donald trump, nsa, surveillance, telco equipment
Companies: cisco, huawei