Huawei to meet with security researcher who disclosed vulnerabilities in its products

The company plans to engage with security researchers to improve product security

Chinese networking and telecommunications equipment manufacturer Huawei plans to send a team of engineers to Germany in order to meet with Felix Lindner, a security researcher who earlier this year disclosed vulnerabilities in the company's products, he confirmed.

The meeting was first revealed by John Suffolk, Huawei's global head of cybersecurity, during an interview, Reuters reported Thursday.

The company is not just interested in fixing the particular flaws reported by Lindner, but in making systemic changes that would make its products more secure in the long term, Suffolk said in the interview.

Felix "FX" Lindner is the technical and research lead at Recurity Labs, an IT security consultancy company based in Germany. This year, he disclosed critical vulnerabilities in Huawei home and small enterprise routers during the Defcon and Hack in The Box security conferences.

He also criticized the company for the lack of transparency when it comes to security issues and the poor quality of code in its products.

"I was surprised to learn that they told the press about this meeting before it actually took place, but it is correct that such a meeting is planned," Lindner said via email. "What Huawei's goals are for the meeting is not known to me yet."

"Unfortunately we are unable to disclose more information apart from what John Suffolk said in the interview," Yingying Li, marketing and communications manager at Huawei in the UK said Thursday via email. "We have set up a comprehensive security assurance system and have it stress tested on regular basis. The company will keep seeking ways to enhance the product security together with our customers and industry peers."

In the interview, Suffolk noted that Huawei has made changes in its approach to security since he joined the company in 2011, which included making it easier for security researchers to report vulnerabilities.

"It is correct that they appointed a Product Security Incident Response Team (PSIRT) and more prominently published how to reach it," Lindner said. "However, other areas still need some work. Security advisories, for example, are not yet widely circulated."

"Currently, all one can see is the apparent willingness to engage, which is a good first step," the researcher said. "Whether this will lead to a serious product security program or not is something time will tell."

Before joining Huawei as its global head of cybersecurity, Suffolk served as the chief information officer of the British government for six years. Back in September, he published a paper in which he outlined Huawei's commitment to cybersecurity.

"The company remains open for a constructive dialogue with all stakeholders, especially in the field of cyber security which is one of our top priorities," Roland Sladek, Huawei's vice president of international media affairs for the EMEA region, said via email.

For the past few years, the company has strongly disputed accusations of having ties to the Chinese military or the country's intelligence services.

A report released earlier this month by the U.S. House of Representatives' Permanent Select Committee on Intelligence said that using equipment from Huawei and fellow Chinese telecom vendor ZTE for U.S. critical infrastructure would pose a national security threat because of the possible ties between the two companies and the Chinese government. The committee advised the U.S. government, its contractors, as well as private-sector companies to avoid buying networking equipment from the two Chinese vendors.

Huawei dismissed the report as being politically motivated.

Join the CSO newsletter!

Error: Please check your email address.

Tags networking hardwareHuaweitelecommunicationonline safetyNetworkingsecurityExploits / vulnerabilitiesRecurity Labs

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place