“Nationally significant” vulnerability last year found by cyber security analysts who were tasked with investigating Huawei equipment used in the UK’s telecommunications networks.
According to a report, UK Huawei Cyber Security Evaluation Centre (HCSEC) investigators found an issue that was so severe they withheld it from the company. Vulnerabilities are normally software design failures which may allow hostile actors to conduct a cyber attack. They may not be intentional and cannot be seen as an indication of any hostile intent by the developers.
The report states that the UK’s National Cyber Security Centre (NCSC) “does not believe that the defects identified are as a result of Chinese state interference”, adding that there is no evidence the vulnerabilities were exploited.
Instead, the agency outlined that “poor software engineering and cyber security processes lead to security and quality issues, including vulnerabilities”, highlighting a concern about “the increasing number and severity of vulnerabilities discovered”.
The report states that “If an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, they may be able to affect the operation of a UK network, in some cases causing it to cease operating correctly”. “Other impacts could include being able to access user traffic or reconfiguration of the network elements.”
More from News
- Valutico Acquires AI Innovator Paraloq Analytics to Revolutionise Private Company Analysis
- How Do UK Consumers Spend Their Disposable Income?
- Spain Tops The List As Most Productive European Country
- Industry Leaders Share Their Thoughts On The Recent Interest Rate Hold
- Bank Of England Holds Interest Rates At 4.25%, What Does This Mean For UK?
- One Of The Largest Data Breach In History Leaked 16 Billion Passwords
- 23andMe Co-Founder Bids To Buy Back Data After Company Announces Bankruptcy
- How Is The UK Boosting The Cyber Sector?
After these concerns were seen they were reported to Huawei, in line with the HCSEC’s vulnerability disclosure process.
The report further notes that HCSEC “continues to reveal serious and systematic defects in Huawei’s software engineering and cyber security competence” – and warns that despite fixing specific issues when directed to do so, the agency has “no confidence that Huawei will effectively maintain components within its products”.
After hearing these concerns, a Huawei spokesperson states that the company is committed “to a process that guarantees openness and transparency, and demonstrates HCSEC has been an effective way to mitigate cyber security risks in the UK”.
The spokesperson stressed that the NCSC’s conclusion demonstrates that the defects were not a malicious interference from the Chinese state, and that the UK’s networks are not more vulnerable than they were last year, stating:
“As innovators, we continue significant investment to improve our products. The report acknowledges that while our software transformation process is in its infancy, we have made some progress in improving our software engineering capabilities”
“Huawei has faced the highest level of scrutiny for almost 10 years. This rigorous review sets a precedent for cyber security collaboration between the public and private sectors, and has provided valuable insights for the telecoms sector.”
“We believe this mechanism can benefit the entire industry and Huawei calls for all vendors to be evaluated against an equally robust benchmark, to improve security standards for everyone.”
American restricts on Huawei will prohibit US technology companies from providing components to the company, for example computer chips. The British government have ordered that all Huawei equipment must be stripped out of the UK’s telecommunication networks by 2027, as a result of these restrictions. This comes after the recommendation of the NCSC stating that the security of Huawei’s equipment can no long be guaranteed if it was to use chips from less trusted manufactures.