Huawei Says It Would Offer Access To Its Source Code • Hacker News Board

Re: Huawei Says It Would Offer Access To Its Source Code

#11

Post by jsnell » Wed, Oct 24, 2012, 4:09 PM UTC

seivan wrote: post #8

Has anyone compared Ericssons tech with Huawei? Honest question. I feel like if you're setting up infrastructure, take it from the countries that does it the best. Ericsson is Swedish and _THE_ first country to roll out with 4G (around my parents place, even).

The technology isn't really relevant. Sure, organizations with unlimited budget would probably choose some other vendor than Huawei. But that really doesn't include most mobile operators in the world. And then what starts mattering is that Ericsson or NSN charges twice as much for the same capacity. Or that Huawei is willing to give financing on good terms (including on parts of the network supplied by other vendors).

Re: Huawei Says It Would Offer Access To Its Source Code

#12

Post by eru » Wed, Oct 24, 2012, 4:09 PM UTC

binarymax wrote: post #10

ari_elle wrote: post #7

In my opinion it's the right way to address this. They enter the US market to have their reputation instantly destroyed by official US institutions, that are filing concern about possible spying through their products at a moment where they haven't even looked at it, to later conclude that there were security risks found but none of the allegations were true. I don't know how big the final damage for Huawei is, but t…

I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be showing officials 'cleaned' code, and then ship different code with spyware/malware baked in. The only way to really trust the code is if an end user can download the source, review it, build it, and install it on their device.

There's another way, but it's highly technical: Proof carrying code.

Re: Huawei Says It Would Offer Access To Its Source Code

#13

Post by xyzzy123 » Wed, Oct 24, 2012, 4:18 PM UTC

I think it's a nice political move, but I will be surprised if it makes much difference in the end.

It is impossible to demonstrate trustworthiness to someone who isn't willing to believe it.

Some issues which would get raised by your friends if they didn't want you to buy Huawei:

Firstly, you have the problem of underhanded code (e.g http://underhanded.xcott.com/) e.g. deniable backdoors. Auditing a large C codebase to the point where you have confidence in it is Expensive and Time Consuming.

Secondly, version control gets to be a huge problem. If you are going to rely on the results of your audit, now you have to build the firmware yourself with a trusted toolchain. This is going to be a lot of work. Especially since you now have to do this for every firmware release for every product you use. Most organisations aren't getting patching and release management right even as things stand right now.

Thirdly: do we need to look at the FPGAs, ASICs and "auxiliary" firmware? Are all the parts standard? Where were they fabbed? Can we trust those guys? Is the router we get next month going to be the same board revision, with parts from the same vendors?

Fourthly: how comfortable are the players in various countries going to be with a Chinese state-owned company having their detailed network designs for telcos and core networks? (I mean, pretending they don't already ;)

Paranoid hat mode: I do wonder whether the huge mistrust of Huawei is standard anti-competitiveness... or because everyone's agencies have been using {backdoors, bugs, info} provided by various companies and "friendly employees" for years - and buying Huawei kit just seems like it's making things too easy for certain parties.

If you are interested in these kinds of shenigans: http://spectrum.ieee.org/telecom/security/the-athens-affair/... is a fascinating read.

Re: Huawei Says It Would Offer Access To Its Source Code

#14

Post by ari_elle » Wed, Oct 24, 2012, 4:22 PM UTC

binarymax wrote: post #10

ari_elle wrote: post #7

In my opinion it's the right way to address this. They enter the US market to have their reputation instantly destroyed by official US institutions, that are filing concern about possible spying through their products at a moment where they haven't even looked at it, to later conclude that there were security risks found but none of the allegations were true. I don't know how big the final damage for Huawei is, but t…

I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be showing officials 'cleaned' code, and then ship different code with spyware/malware baked in. The only way to really trust the code is if an end user can download the source, review it, build it, and install it on their device.

I see a flaw in your flaw.

1st) small chance that spying features are implemented that a paranoid analyzing by US officials wouldn't have revealed* (or that the US would have said the products are good, while still having reasonable concerns about potential spying)

2nd) i don't know how they would give their source code to government officials but i guess it's fair to assume that it can be done in private and trusting nature (also they probably are able to test if a piece of hardware runs the code given or not)

3rd) risk of secretive spying features being found is high * * (even if you want to argue it might be lower than described by myself above -> see 1st), therefore generally would lead to one of the biggest company scandals in the 21st history and completely destroy all of Huawei's business in all of the Western World (not worth it)

* somebody shall correct me if i might be wrong, but wouldn't it be pretty hard to hide spyware in software being used worldwide by millions of users and that is center of attention by governments for a long time

* * think of the amount of Huawei contractors, the sheer quantity of their sales

Re: Huawei Says It Would Offer Access To Its Source Code

#15

Post by xyzzy123 » Wed, Oct 24, 2012, 4:29 PM UTC

ari_elle wrote: post #14

binarymax wrote: post #10

Earlier quoted context omitted.

I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be showing officials 'cleaned' code, and then ship different code with spyware/malware baked in. The only way to really trust the code is if an end user can download the source, review it, build it, and install it on their device.

I see a flaw in your flaw. 1st) small chance that spying features are implemented that a paranoid analyzing by US officials wouldn't have revealed* (or that the US would have said the products are good, while still having reasonable concerns about potential spying) 2nd) i don't know how they would give their source code to government officials but i guess it's fair to assume that it can be done in private and trustin…

It doesn't have to be "spyware" per se. It just has to be a bug or problem that you (and your friends) know about that your customer doesn't.

Re: Huawei Says It Would Offer Access To Its Source Code

#16

Post by xyzzy123 » Wed, Oct 24, 2012, 4:31 PM UTC

eru wrote: post #12

binarymax wrote: post #10

Earlier quoted context omitted.

I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be showing officials 'cleaned' code, and then ship different code with spyware/malware baked in. The only way to really trust the code is if an end user can download the source, review it, build it, and install it on their device.

There's another way, but it's highly technical: Proof carrying code.

Right except PCC for ARM SoC are pretty thin on the ground. So they would have to build a PCC compiler and runtime, and then you'd have to audit those...

Re: Huawei Says It Would Offer Access To Its Source Code

#17

Post by DannyBee » Wed, Oct 24, 2012, 4:54 PM UTC

ari_elle wrote: post #5

pfortuny wrote: post #3

Yes, and get all the bugs they want to fix fixed for free, is it not? And leave open those they deem worth leaving.

Huawei wants to enter US market -> spying suspicions Huawei makes source code open -> all they want is free bug fixing Is that really fair? Note: Have you even read the article? They say they would make the source code available for official governmental institutions to analyze it if they wanted, they don't say anything about making it completely open-source!

Making the source code open doesn't help unless you can flash the devices, since you have no guarantee the source code is what's on the devices.

Plus, if the backdoors are in hardware (say the hardware AES implementation has a small key scheduling "bug" or something) , not software, source code wouldn't help.

Re: Huawei Says It Would Offer Access To Its Source Code

#18

Post by danielweber » Wed, Oct 24, 2012, 5:14 PM UTC

xyzzy123 wrote: post #13

I think it's a nice political move, but I will be surprised if it makes much difference in the end. It is impossible to demonstrate trustworthiness to someone who isn't willing to believe it. Some issues which would get raised by your friends if they didn't want you to buy Huawei: Firstly, you have the problem of underhanded code (e.g http://underhanded.xcott.com/ ) e.g. deniable backdoors. Auditing a large C codebas…

Thank you. "Ability to read the source code" is amazingly low for knowing if the code is trustworthy.

And don't forget we have to trust the compiler that compiled the compiler. EDIT: I see you mention "trusted toolchain" in your second point.

Re: Huawei Says It Would Offer Access To Its Source Code

#19

Post by gbaygon » Wed, Oct 24, 2012, 5:42 PM UTC

edoloughlin wrote: post #9

jivatmanx wrote: post #2

Let's not forget: Aliyun OS is an admitted illegal closed-source Linux fork (And likely an Android ripoff). Perhaps China should comply with basic U.S. law if they want to sell things here.

> Perhaps China should comply with basic U.S. law if they want to sell things here. You'd better hope they don't start with labour law or you might not be able to afford to buy any of their stuff.

I hope you are being ironic.

Re: Huawei Says It Would Offer Access To Its Source Code

#20

Post by Zarathust » Wed, Oct 24, 2012, 5:47 PM UTC

Still, it would be very hard to make sure that the provided code is indeed the one running on the suspicious machines. The only way I see to make sure of that would be to provide tools to compile and flash the hardware, which doesn't make much business sense. This also gives no protection to silicon based backdoors that has nothing to do with OS code.