The curious case of Bloomberg's Huawei scoop
Add Axios as your preferred source to
see more of our stories on Google.
A Huawei logo. Photo: Jaap Arriens/NurPhoto via Getty Images
Bloomberg reported Tuesday that Vodafone's Italian division had discovered "backdoors" in its Huawei-brand telecommunications equipment in 2011 and 2012.
But, but, but: The story did not play well in the security community, where the evidence is seen as insufficient to the central claims. It didn't make a strong case that the "backdoor" was anything more than a minor, unintentional problem. Vodafone's official stance was it wasn't.
Reality check: The story was based on internal memos leaked to Bloomberg.
- The "backdoors" were a number of security flaws that Vodafone found in security testing. All hardware and software have security vulnerabilities, so that doesn't seem particularly malicious.
Details: One "backdoor" was Telnet, an extremely common communications protocol that many hardware manufacturers use for configuration. While Huawei used the industry standard way to make Telnet inaccessible via the wider internet, Vodafone has a policy of not allowing Telnet.
- When Huawei fixed the equipment, it claimed it resolved the Telnet issue, but Telnet was still accessible.
- According to the memos, Huawei said that Telnet couldn't be entirely removed from the router.
To be clear: This chain of events is common for manufacturers. It's hard to make the leap to claiming this was a backdoor based on the story.
- This is where the story stopped.
However: Bloomberg may not have given the full account of the technical reasoning that the Telnet issue was intentional.
- Bloomberg did not release the memos, so it's hard to verify any technical details.
- Still, according to Stefano Zanero, an expert quoted in the story who did see the memos, the memos make Huawei seem sketchier than the story suggested.
According to Zanero, the following was left out of the story:
- The Telnet service wasn't in guides explaining how the hardware worked.
- The passwords to the Telnet service couldn't be changed, meaning the manufacturer would always know how to hack the hardware.
- It accepted connections in a nonstandard way, which made it seem hidden.
- The Telnet was successfully removed once but reintroduced later.
The bottom line: It still isn't a smoking gun. Even with Zanero's elaborations, to most of the security community, this has read like Vodafone employees attributing malice to incompetence.
Go deeper: Vodafone denies Bloomberg report on security flaws in Huawei equipment
