The Channel logo

News

By | Phil Muncaster 2nd August 2012 04:41

Huawei looking into critical router flaw claims

Telecoms kit maker defends its incident response system

Chinese telecoms kit maker Huawei has said it is investigating claims by researchers that two of its router products contain serious vulnerabilities which could allow hackers to remotely take control of the devices.

Felix Lindner and Gregor Kopf of Berlin-based Recurity Labs announced their findings at the Defcon hacking show at the weekend (via The H), claiming that the products contain 1990s-style code and no operating system hardening, leaving them vulnerable to “90s style exploitation”.

The major coding error pointed out by the duo was a heap overflow vulnerability in the software of the AR18 and AR28 products, which are designed for use by home office workers and mid-sized enterprises respectively.

Huawei also produces routers and other kit for big-name global telecoms clients, although the researchers claimed they did not have access to test these high end products.

Lindner and Kopf complained that it has been virtually impossible to responsibly disclose their findings to Huawei because there is no obvious “externally visible product security group” and because the firm doesn’t publish security advisories for any products.

However, Huawei has hit back, claiming that its Network Security Incident Response Team (NSIRT) should always be the first port of call.

Huawei has established a robust response system to address product security gaps and vulnerabilities, working with our customers to immediately develop contingency plans for all identified security risks, and to resolve any incidents in the shortest possible time. In the interests of customer security, Huawei also calls on the industry to promptly report all product security risks to the solutions provider so that the vendor’s CERT team can work with the relevant parties to develop a solution and roll-out schedule.

For the record, an incident response organisation for comms vendors and service providers called FIRST can also be contacted in the event that security researchers find vulnerabilities like the ones above.

Huawei said it is currently “verifying” the claims made by Recurity and urged any similar claims in the future be emailed first to psirt@huawei.com ®

comment icon Read 10 comments on this article alert Send corrections

Opinion

Microsoft CEO Satya Nadella
ARA_LIbertad

Chris Mellor

Elliott Management sinks its teeth into retiring godhead
Satya Nadella
cloud computing Fight

Features

Failure to crack next-gen semiconductors threatens to set back humanity
SMEs get lip service - what they need is dinner at the Club
SAP Match Insights
Vorsprung durch grossendatatechnik, as we like to say in Germany
Inside the Google Lab where surgeons prepare the human/dog experiment
Big Blue exec tells El Reg what to keep an eye on