The Channel logo

News

By | Phil Muncaster 2nd August 2012 04:41

Huawei looking into critical router flaw claims

Telecoms kit maker defends its incident response system

Chinese telecoms kit maker Huawei has said it is investigating claims by researchers that two of its router products contain serious vulnerabilities which could allow hackers to remotely take control of the devices.

Felix Lindner and Gregor Kopf of Berlin-based Recurity Labs announced their findings at the Defcon hacking show at the weekend (via The H), claiming that the products contain 1990s-style code and no operating system hardening, leaving them vulnerable to “90s style exploitation”.

The major coding error pointed out by the duo was a heap overflow vulnerability in the software of the AR18 and AR28 products, which are designed for use by home office workers and mid-sized enterprises respectively.

Huawei also produces routers and other kit for big-name global telecoms clients, although the researchers claimed they did not have access to test these high end products.

Lindner and Kopf complained that it has been virtually impossible to responsibly disclose their findings to Huawei because there is no obvious “externally visible product security group” and because the firm doesn’t publish security advisories for any products.

However, Huawei has hit back, claiming that its Network Security Incident Response Team (NSIRT) should always be the first port of call.

Huawei has established a robust response system to address product security gaps and vulnerabilities, working with our customers to immediately develop contingency plans for all identified security risks, and to resolve any incidents in the shortest possible time. In the interests of customer security, Huawei also calls on the industry to promptly report all product security risks to the solutions provider so that the vendor’s CERT team can work with the relevant parties to develop a solution and roll-out schedule.

For the record, an incident response organisation for comms vendors and service providers called FIRST can also be contacted in the event that security researchers find vulnerabilities like the ones above.

Huawei said it is currently “verifying” the claims made by Recurity and urged any similar claims in the future be emailed first to psirt@huawei.com ®

comment icon Read 10 comments on this article alert Send corrections

Opinion

Chris Mellor

Drives nails forged with Red Hat iron into VCE's coffin
Sleep Cycle iOS app screenshot

Trevor Pott

Forget big-spending globo biz: it's about the consumer... and he's desperate for a nap
Steve Bennet, ex-Symantec CEO

Chris Mellor

Enormo security firm needs to get serious about acquisitions

Features

Windows 8.1 Update  Storeapps Taskbar
Chinese Buffet self-service
Chopping down the phone tree to scrump low-hanging fruit
An original member of the System/360 family announced in 1964, the Model 50 was the most powerful unit in the medium price range.
Big Blue's big $5bn bet adjusted, modified, reduced, back for more
Microsoft CEO Satya Nadella
Redmond needs to discover the mathematics of trust