Huawei to meet with security researcher who disclosed vulnerabilities in its products

The company plans to engage with security researchers to improve product security

Chinese networking and telecommunications equipment manufacturer Huawei plans to send a team of engineers to Germany in order to meet with Felix Lindner, a security researcher who earlier this year disclosed vulnerabilities in the company's products, he confirmed.

The meeting was first revealed by John Suffolk, Huawei's global head of cybersecurity, during an interview, Reuters reported Thursday.

The company is not just interested in fixing the particular flaws reported by Lindner, but in making systemic changes that would make its products more secure in the long term, Suffolk said in the interview.

Felix "FX" Lindner is the technical and research lead at Recurity Labs, an IT security consultancy company based in Germany. This year, he disclosed critical vulnerabilities in Huawei home and small enterprise routers during the Defcon and Hack in The Box security conferences.

He also criticized the company for the lack of transparency when it comes to security issues and the poor quality of code in its products.

"I was surprised to learn that they told the press about this meeting before it actually took place, but it is correct that such a meeting is planned," Lindner said via email. "What Huawei's goals are for the meeting is not known to me yet."

"Unfortunately we are unable to disclose more information apart from what John Suffolk said in the interview," Yingying Li, marketing and communications manager at Huawei in the UK said Thursday via email. "We have set up a comprehensive security assurance system and have it stress tested on regular basis. The company will keep seeking ways to enhance the product security together with our customers and industry peers."

In the interview, Suffolk noted that Huawei has made changes in its approach to security since he joined the company in 2011, which included making it easier for security researchers to report vulnerabilities.

"It is correct that they appointed a Product Security Incident Response Team (PSIRT) and more prominently published how to reach it," Lindner said. "However, other areas still need some work. Security advisories, for example, are not yet widely circulated."

"Currently, all one can see is the apparent willingness to engage, which is a good first step," the researcher said. "Whether this will lead to a serious product security program or not is something time will tell."

Before joining Huawei as its global head of cybersecurity, Suffolk served as the chief information officer of the British government for six years. Back in September, he published a paper in which he outlined Huawei's commitment to cybersecurity.

"The company remains open for a constructive dialogue with all stakeholders, especially in the field of cyber security which is one of our top priorities," Roland Sladek, Huawei's vice president of international media affairs for the EMEA region, said via email.

For the past few years, the company has strongly disputed accusations of having ties to the Chinese military or the country's intelligence services.

A report released earlier this month by the U.S. House of Representatives' Permanent Select Committee on Intelligence said that using equipment from Huawei and fellow Chinese telecom vendor ZTE for U.S. critical infrastructure would pose a national security threat because of the possible ties between the two companies and the Chinese government. The committee advised the U.S. government, its contractors, as well as private-sector companies to avoid buying networking equipment from the two Chinese vendors.

Huawei dismissed the report as being politically motivated.

2014 ARN Women in ICT Awards - Nominations close October 27!: Nominations have opened for WIICTA 2014 and will stay open until October 27. But don't be late, be among the first in and NOMINATE NOW!!!

Tags Huaweinetworking hardwareonline safetytelecommunicationsecurityNetworkingRecurity LabsExploits / vulnerabilities

Comments

Comments are now closed

 

Latest News

Oct 24
20th Century Fox deploys HP Moonshot servers
Oct 24
Adobe begins encrypting user data collected from Digital Editions app
Oct 24
St George turns on fingerprint login for Apple iOS Internet banking
Oct 24
DDoS attacks skyrocket: Akamai State of Internet Report
More News
29 Oct
NewLease & Microsoft Technical Sessions
30 Oct
Ovum 2020 Telecoms Summit
30 Oct
NewLease & Microsoft Technical Sessions
05 Nov
vForum 2014
View all events