Italy Cyber Security company Swascan has uncovered vulnerabilities in Huawei’s web applications.
Swascan says it has identified three vulnerabilities in Huawei’s web applications that belong to “CWE” categories (CWE stands for “Common Weakness Emuneration”) such as Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119), Out-of-Bounds Read (CWE-125), and OS Command Injection (CWE-78). Swascan has notified Huawei about these vulnerabilities in the hopes that the company will beef up its web security. The Italian Cyber Security company says that cooperation between software and cyber security companies is needed in this age of cyber attacks.
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) occurs when someone can write to a place that lies beyond a memory buffer (that is, a place where data is stored and transferred). A hacker who gets this permission could execute arbitrary code, allowing him or her to do anything he or she wants to the application, such as overwrite security-critical data that would deny certain power to someone who isn’t an administrator, for example.
This effort could lead to the overwriting of computational instructions, the corruption of relevant memory, as well as a crash. Sensitive information, such as where the buffer (the place where data is located) lies in memory, could be leaked as a result, allowing the hacker to plan further attacks in order to seize more sensitive information. A hacker could create an infinite loop where a program goes through the same thing on-screen over and over and over again indefinitely.
An Out-of-Bounds Read (CWE-125) occurs when the software reads past the intended buffer, when one can read past the data location where certain data is stored. This can lead to a crash or the access of sensitive information from other places where the hacker should not have permission to go.
An OS Command Injection (CWE-78) is just as it sounds: a way for the hacker to inject commands into the OS such that the malicious activity seems to derive from the application or the owner thereof, rather than a malicious hacker. OS Command Injections are the equivalent of telephone robocallers who “spoof” numbers to appear as though a local number or even your own number is calling you when the call is coming from a different number altogether. The danger behind OS Command Injections is that the hacker could disable the software (OS) or read and change data that should be off-limits to someone other than the user accessing the web application.
These vulnerabilities over web applications, as new as it may sound, isn’t to those who’ve been keeping track of Huawei these last several weeks. Finite State published its own scathing report of Huawei’s software loopholes and vulnerabilities, with the firm discovering that at least 55% of Huawei’s devices have “potential backdoors” that could be exploited by hackers or even the Chinese Government.
The Huawei-backed Huawei Cyber Security Evaluation Centre (HCSEC) has continued to assert that Huawei has known software vulnerabilities it has failed to patch up over at least the last year.
Just this week, Huawei CEO Ren Zhengfei says that consumer privacy is important to Huawei, that it patterns itself after Apple when it comes to protecting its users. But if that is so, why would all these overwriting vulnerabilities exist in Huawei’s software? Why allow at least half of your devices to have potential backdoors that can be exploited, if you want to see consumer privacy realized with customers?
Apple has secured its consumer privacy, so much so that the Federal Government asked Apple to unlock the iPhone 5c belonging to the San Bernardino killer Syed Farook. Apple denied the government’s request because, to write in loopholes into a device’s software and hardware would allow them to be exploited by anyone for any reason — deliberate or not.
When one considers Huawei’s numerous software vulnerabilities, coupled with the company’s ties to the Chinese military and military background for a number of employees (not to mention it publishes technological papers with the military), it stands to reason that Huawei possesses the know-how and experience to secure its devices and software but refuses to do it — for whatever reason(s).
These types of software and hardware reports explain why US President Donald Trump has placed Huawei on the US Entity List and is forbidding the Shenzhen-based corporation from selling its smartphones, smartwatches, tablets, and other telecommunications gear such as routers here in the US, and why the US is discouraging its allies from doing business with Huawei when it comes to rolling out their respective 5G networks.