Feeds

Huawei looking into critical router flaw claims

Telecoms kit maker defends its incident response system

Combat fraud and increase customer satisfaction

Chinese telecoms kit maker Huawei has said it is investigating claims by researchers that two of its router products contain serious vulnerabilities which could allow hackers to remotely take control of the devices.

Felix Lindner and Gregor Kopf of Berlin-based Recurity Labs announced their findings at the Defcon hacking show at the weekend (via The H), claiming that the products contain 1990s-style code and no operating system hardening, leaving them vulnerable to “90s style exploitation”.

The major coding error pointed out by the duo was a heap overflow vulnerability in the software of the AR18 and AR28 products, which are designed for use by home office workers and mid-sized enterprises respectively.

Huawei also produces routers and other kit for big-name global telecoms clients, although the researchers claimed they did not have access to test these high end products.

Lindner and Kopf complained that it has been virtually impossible to responsibly disclose their findings to Huawei because there is no obvious “externally visible product security group” and because the firm doesn’t publish security advisories for any products.

However, Huawei has hit back, claiming that its Network Security Incident Response Team (NSIRT) should always be the first port of call.

Huawei has established a robust response system to address product security gaps and vulnerabilities, working with our customers to immediately develop contingency plans for all identified security risks, and to resolve any incidents in the shortest possible time. In the interests of customer security, Huawei also calls on the industry to promptly report all product security risks to the solutions provider so that the vendor’s CERT team can work with the relevant parties to develop a solution and roll-out schedule.

For the record, an incident response organisation for comms vendors and service providers called FIRST can also be contacted in the event that security researchers find vulnerabilities like the ones above.

Huawei said it is currently “verifying” the claims made by Recurity and urged any similar claims in the future be emailed first to psirt@huawei.com ®

Combat fraud and increase customer satisfaction

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Kingston DataTraveler MicroDuo: Turn your phone into a 72GB beast
USB-usiness in the front, micro-USB party in the back
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
BOFH: Oh DO tell us what you think. *CLICK*
$%%&amp Oh dear, we've been cut *CLICK* Well hello *CLICK* You're breaking up...
AMD's 'Seattle' 64-bit ARM server chips now sampling, set to launch in late 2014
But they won't appear in SeaMicro Fabric Compute Systems anytime soon
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
Microsoft builds teleporter weapon to send VMware into Azure
Updated Virtual Machine Converter now converts Linux VMs too
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.