Vodafone discovered security failings in Huawei internet routers used by millions of people almost a decade ago.
Europe’s biggest mobile phone operator said on Tuesday that it found “vulnerabilities” in consumer equipment supplied by the Chinese telecoms company to Vodafone Italia between 2009 and 2012.
Vodafone and Huawei both confirmed the vulnerabilities were discovered in the Chinese routers, but denied allegations in a report by Bloomberg that the security lapses amounted to “hidden backdoors” that could be used to spy on millions of people’s internet browsing.
The emergence of the security lapses – which according to Bloomberg were also found in Vodafone’s networks in the UK, Germany, Spain and Portugal – comes as the US tells the UK to ban Huawei from forthcoming 5G networks due to fears the Chinese state could use the technology to spy on western governments.
The US said on Monday that it would review intelligence sharing with the UK if Theresa May did not reverse her decision to allow Huawei’s equipment to be used in the UK’s next-generation mobile network. Robert Strayer, a deputy assistant secretary at the US state department, said the use of the Chinese company’s equipment in any area of the UK’s 5G network was “an unacceptable risk”.
The UK’s National Security Council, made up of senior ministers and intelligence chiefs, last week agreed in principle to allow Huawei to supply “non-core” technology in future 5G networks despite objections from five cabinet ministers.
The US is calling on all allies in the “Five Eyes” intelligence grouping – which also comprises Canada, Australia and New Zealand – to exclude the company. Australia and New Zealand have already blocked telecoms companies from using Huawei equipment in 5G networks, while Canada is still reviewing its relationship with the company.
The Bloomberg story quoted Vodafone security reports dating back to 2009-12, which said the telecoms company had found “telnet services, which Bloomberg said could be used to remotely control devices and give Huawei access to sensitive data”.
Both Vodafone and Huawei denied the telnet services could be used as a backdoor allowing spying on users. The companies said the telnet equipment was to test the network, had been left behind by accident and was later removed.
Huawei said in a statement: “The story published by Bloomberg today is misleading. It refers to a maintenance and diagnostic function, common across the industry, as well as vulnerabilities, which were corrected over seven years ago. There is absolutely no truth in the suggestion that Huawei conceals backdoors in its equipment.”
A spokesman for Vodafone said: “The ‘backdoor’ that Bloomberg refers to is telnet, which is a protocol that is commonly used by many vendors in the industry for performing diagnostic functions. It would not have been accessible from the internet. Bloomberg is incorrect in saying that this ‘could have given Huawei unauthorised access to the carrier’s fixed-line network in Italy’.
“In addition, we have no evidence of any unauthorised access. This was nothing more than a failure to remove a diagnostic function after development. The issues were identified by independent security testing, initiated by Vodafone as part of our routine security measures, and fixed at the time by Huawei.”
The Vodafone spokesman also denied Bloomberg’s claim the same issues were identified in Vodafone’s networks in the UK, Germany, Spain and Portugal.
The Vodafone security report, quoted by Bloomberg, is said to have found six “critical” and nine “major” security breaches in the Huawei technology. Vodafone’s chief information security officer is quoted in the 2011 report as saying: “Unfortunately for Huawei, the political background means that this event will make life even more difficult for them in trying to prove themselves an honest vendor.
“What is of most concern here is that actions of Huawei in agreeing to remove the code, then trying to hide it, and now refusing to remove it as they need it to remain for ‘quality’ purposes.”
