British ex-spies warn of risks dealing with Chinese telecom Huawei

By Europe bureau chief Lisa Millar

Two of Britain’s top cyber security experts have warned against ignoring Huawei, saying banning the Chinese telecommunications giant is not an option for the West.

Robert Hannigan, former director of Britain's intelligence and security organisation GCHQ.

“In the future there will be lots of technologies that we need where the best provider in the world and the best technology is Chinese,” said Robert Hannigan, the former director of Britain’s intelligence and security organisation GCHQ.

“What are we going to do about this?

“Are we going to cut ourselves off from this, or are we going to manage the risk?”

The answer, according to Mr Hannigan and Nigel Inkster — a 30-year veteran of the Secret Intelligence Service (MI6) — is to accept that with risks come rewards.

“What we need to do is look at this at the broader strategic context of who controls and dominates these technologies at a global level in the 21st century,” Mr Inkster said.

Huawei entered the British market in 2001, and by 2005 had signed off on its first UK contract with BT (formerly British Telecom) as it embarked on a multi-billion-pound upgrade of its network.

“I think those in the intelligence and security community were from the outset aware of the problem that this relationship could cause,” Mr Inkster said.

“But one has to bear in mind that … this was taking place in a different era, we were still in a kind of end-of-history moment.

“There was simply less awareness within government as a whole of these security issues, and frankly less of a disposition to take them particularly seriously.”

The Cell

In 2010, the Huawei Cyber Security Evaluation Centre (HCSEC) was created — otherwise known as The Cell.

In a nondescript brown brick building in an industrial site 90 minutes north of London sits a team of cyber security experts, employed by Huawei and overseen by the British Government.

Positions advertised for the Banbury facility say Huawei is seeking those looking to build a “rewarding career in cyber security”.

Their job is to ensure the integrity of Huawei’s products, which include equipment used across the UK’s fibre-optic network.

It is a model that has been suggested for Australia, to ease concerns about security to the critical national infrastructure.

But the July annual report from the board that oversees The Cell raised concerns, using language not seen in its three previous reports.

“Identification of shortcomings in Huawei’s engineering processes have exposed new risks in the UK telecommunication networks and long-term challenges in mitigation and management,” the report said.

“Due to areas of concern exposed through the proper functioning of the mitigation strategy and associated oversight mechanisms, the oversight board can provide only limited assurance that all risks to UK national security from Huawei’s involvement in the UK’s critical networks have been sufficiently mitigated.”

Its concerns were sent to the British Prime Minister’s national security adviser.

“It looks like a bit of a warning shot has been fired by the UK Government,” Mr Hannigan said, who until last year oversaw the board that issued the report.

“It’s [The Cell] working up to a point, is the way I’d put it.

“The question is, what’s the alternative? Is the alternative banning Huawei better? I don’t think it is actually.”

Huawei welcomed the UK report and the feedback.

“It confirms the collaborative approach adopted by Huawei, the UK Government and operators is working as designed, meeting obligations and providing unique, world-class network integrity assurance through ongoing risk management,” a spokesperson for Huawei told the ABC.

“The report concludes that HCSEC’s operational independence is both robust and effective.”

Huawei insisted it was under more scrutiny than any other telco and The Cell had been proven as the best model for compliance.

The risk

But both Mr Inkster and Mr Hannigan agreed there were risks to dealing with Huawei.

“Huawei has relied very substantially on Chinese Government investment and technological assistance to develop rapidly to the point where they are,” Mr Inkster said.

“And if the Chinese Government ask them to do something, they’re not in the position to refuse.

“The challenge for those who simply want to ban it is, what’s the alternative?” Mr Hannigan reiterated.

“The challenge for those who think they can manage it is — are you kidding yourselves?

“There is simply no magic solution.”

Topics: world-politics, government-and-politics, defence-and-national-security, information-and-communication, science-and-technology, united-kingdom, china

Advertisements

Phone-cracking firm Cellebrite hacked

Source: BBC

Information about the customers of Cellebrite, an Israeli firm that markets hacking tools, has been stolen in a cyber-attack.

 

The breach was first reported by tech site Motherboard, which said it was sent 900 gigabytes of data by a hacker.

Cellebrite confirmed some information had been taken but said it was not aware of any “increased risk” to clients.

The firm added that it was now notifying affected customers.

Motherboard said the data – which was not distributed online – included “what appears to be evidence files from seized mobile phones, and logs from Cellebrite devices”.

However, Cellebrite did not respond to this in its statement.

When contacted by the BBC, a spokesman said its investigation was ongoing and it had no further information to add.

The firm did say that it recently detected “unauthorised access” on an external web server – activity it described as “illegal” – and that it had launched an investigation into the incident.

It added that the data taken related to an older user account system.

Last year, Cellebrite was linked to the FBI’s attempt to hack an iPhone used by San Bernardino killer Syed Rizwan Farook. The firm has neither confirmed nor denied involvement.

“The information accessed includes basic contact information of users registered for alerts or notifications on Cellebrite products and hashed passwords for users who have not yet migrated to the new system,” the company said.

Cellebrite advised users of the my.Cellebrite system to change their passwords.

“The sort of people who use Cellebrite products don’t necessarily want others to know that they’re using it,” said Prof Alan Woodward, a cybersecurity expert at the University of Surrey.

“Law enforcement agencies and perhaps security services will be using it.”

In 2015, hackers stole data from Italian surveillance company Hacking Team and released it on to the web.

The dump included information on countries that had bought Hacking Team products.

“It’s a direct analogy I would say,” Prof Woodward told the BBC. “The embarrassment factor is going to be the same.”

Shadow brokers’ farewell

Separately, 58 hacking tools for Windows PCs were released on to the web by a group calling itself “Shadow Brokers”.

The group announced the release in a farewell message, having attempted to auction the malware online last year. At the time, Shadow Brokers claimed it had been stolen from the NSA.

Besides the newly released files, Shadow Brokers said a full cache of exploits had been left online at a price of 750 bitcoins (£500,000).

Many of the exploits were not “zero days” – attack methods that have not yet been uncovered – but ones that had already been detected by cybersecurity firm Kaspersky, according to one analyst.

“Nobody was willing to pay them,” said Prof Woodward. “They sort of stomped off in a huff, basically.”

Prof Woodward added that while some of the exploits looked “sophisticated” there was no proof that any of the data had been taken from the NSA.