Huawei Telecom Gear Much More Vulnerable to Hackers Than Rivals’ Equipment – WSJ

“Reminds me of  the 1990’s Microsoft Windows/Internet Explorer Security Issues, Not Stuxnet”

-Mayo615

Source: Huawei Telecom Gear Much More Vulnerable to Hackers Than Rivals’ Equipment, Report Says – WSJ

A detailed report, prepared by Finite State, a Columbus, Ohio-based cybersecurity firm, concludes that Huawei telecom switching gear is far more vulnerable to hacking than other vendors’ hardware due to firmware flaws and inadvertent “back doors” that were discovered. The report has been circulated widely among cybersecurity experts in the U.S. and UK, and it is considered credible. The report stops short of concluding that Huawei deliberately inserted the flaws to enable espionage, as it appears more likely that these are flaws that are due to undetected software development errors. The Trump Administration has nevertheless seized on the report to claim evidence of Chinese espionage intent. The report’s conclusions do offer sound evidence that Huawei gear should not be inserted into telecom systems until these errors are removed.  This reminds me of the time when Microsoft Internet Explorer and Windows were suspected of being serious security risks for having so many security holes.

Huawei Enterprise Network Switch

From the Wall Street Journal:

WASHINGTON—Telecommunications gear made by China’s Huawei Technologies Co. is far more likely to contain flaws that could be leveraged by hackers for malicious use than equipment from rival companies, according to new research by cybersecurity experts that top U.S. officials said appeared credible.

Over half of the nearly 10,000 firmware images encoded into more than 500 variations of enterprise network-equipment devices tested by the researchers contained at least one such exploitable vulnerability, the researchers found. Firmware is the software that powers the hardware components of a computer.

The tests were compiled in a new report that has been submitted in recent weeks to senior officials in multiple government agencies in the U.S. and the U.K., as well as to lawmakers. The report is notable both for its findings and because it is circulating widely among Trump administration officials who said it further validated their policy decisions toward Huawei.

“This report supports our assessment that since 2009, Huawei has maintained covert access to some of the systems it has installed for international customers,” said a White House official who reviewed the findings. “Huawei does not disclose this covert access to customers nor local governments. This covert access enables Huawei to record information and modify databases on those local systems.”

The report, reviewed by The Wall Street Journal, was prepared by Finite State, a Columbus, Ohio-based cybersecurity firm.

While the report documents what it calls extensive cybersecurity flaws found in Huawei gear and a pattern of poor security decisions purportedly made by the firm’s engineers, it stops short of accusing the company of deliberately building weaknesses into its products. It also didn’t directly address U.S. claims that Huawei likely conducts electronic espionage for the Chinese government, which Huawei has long denied.

A Huawei official said the company welcomed independent research that could help improve the security of its products but added he couldn’t comment on specifics in the Finite State report because it wasn’t shared in full with the company.

“Without any details, we cannot comment on the professionalism and robustness of the analysis,” the Huawei official said.

Based in Shenzhen, Huawei is the world’s largest telecommunications equipment provider and a leader in next-generation 5G wireless technology.

Huawei has emerged as a central fixture in the growing rift between the U.S. and China over technology, especially with the approach of 5G cellular technology.

The Commerce Department in May cited national-security concerns when it added the telecommunications giant to its “entity list,” which prevents companies from supplying U.S.-origin technology to Huawei without U.S. government approval.

Finite State Chief Executive Matt Wyckhouse co-founded the firm in 2017, after spending nearly 13 years at nearby Battelle, a private, nonprofit applied-science and technology firm that does work in the private and public sectors.

Mr. Wyckhouse, a computer scientist who worked in Battelle’s national security division handling defense and intelligence-community contracts, said Finite State did the work pro-bono and not on behalf of any government. He also said he felt the best way to make policy makers aware of the issues was to make his firm’s research available to the public. He plans to publish it this week.

“We want 5G to be secure,” Mr. Wyckhouse said.

Finite State said it used proprietary, automated systems to analyze more than 1.5 million unique files embedded within nearly 10,000 firmware images supporting 558 products within Huawei’s enterprise-networking product lines.

The company said the rate of vulnerabilities found in Huawei equipment was far higher than the average found in devices manufactured by its rivals, and that 55% of firmware images tested contained at least one vulnerability—which the authors described as a “potential backdoor”— that could allow an attacker with knowledge of the firmware and a corresponding cryptographic key to log into the device.

The report includes a case study comparing one of Huawei’s high-end network switches against similar devices from Arista Networks andJuniper Networks Inc. It found that Huawei’s device had higher risk factors in six of nine categories, generally by a substantial margin.

“In our experience, across the board, these are the highest numbers we have ever seen,” Mr. Wyckhouse said.

In one instance in the case study, Huawei’s network switch registered a 91% risk percentile for the number of credentials with hard-coded default passwords compared against all of Finite State’s entire firmware data set.

By comparison, the risk level for Arista and Juniper was rated at 0%.

Chris Krebs, the top cybersecurity official at the Department of Homeland Security, said Finite State’s research added to existing concerns about Huawei equipment and the conclusion that the company hasn’t shown the intent or capability to improve its security practices.

“With Huawei having not demonstrated the technical proficiency or the commitment to build, deploy, and maintain trustworthy and secure equipment, magnified by the Chinese government’s potential to influence or compel a company like Huawei to do its bidding, we find it an unacceptable risk to use Huawei equipment today and in the future,” Mr. Krebs said.

White House officials who reviewed the Finite State report said the findings revealed flagrant violations of standard protocols. They said the report’s findings also suggested Huawei may be purposely designing its products to include weaknesses.

For example, some of the vulnerabilities found are well-known cybersecurity problems that aren’t difficult to avoid. Of the devices tested, 29% had at least one default username and password encoded into the firmware which could allow malicious actors easy access to those devices if the credentials were left unchanged, according to the report.

A particularly unusual finding was that security problems became quantifiably worse in at least one instance for users who patched a network switch with an updated version of firmware compared with the two-year-old version being replaced. Patches are intended to reduce cybersecurity weaknesses, but a comparison of the two versions found the newer one performed worse across seven of nine categories measured.

“For years, Huawei has essentially dared the international community to identify the security vulnerabilities that have so often been alleged regarding the use of the company’s products,” said Michael Wessel, a member of the U.S.-China Economic and Security Review Commission, a bipartisan panel that makes recommendations to Congress. “It’s hard to see the range and depth of the vulnerabilities identified by Finite State to be anything other than intentional.”

The U.K.’s National Cyber Security Centre also reviewed the Finite State research, people familiar with the matter said, and found it broadly aligned with the technical analysis in the agency’s own report, published in March. The U.K. report accused Huawei of repeatedly failing to address known security flaws in its products and admonished the firm for failing to demonstrate a commitment to fixing them.

A 2012 U.S. government review of security risks associated with Huawei didn’t find clear evidence that the company was being used by China as a tool for espionage, but concluded its gear presented cybersecurity risks due to the presence of many vulnerabilities that could be leveraged by hackers.

Rep. Mike Gallagher, (R., Wis.), said the report highlights the urgency for members of Congress and others to stop Huawei from taking over the global telecommunications supply chain.

“I’ve long thought we should treat Huawei as an appendage of the Chinese Communist Party,” said Mr. Gallagher, who earlier this year introduced legislation targeting Chinese telecommunications firms. “But even I was taken aback by the scale of the security flaws within Huawei’s network architecture as revealed by the report.”

Strategic Inflection Points

I want to more fully explain the concept of Strategic Inflection Points. I have referred to this topic in my Week 5 and Week 11 update videos. Former Intel CEO Andy Grove first described a strategic inflection point as a time in the life of a business when its fundamentals are about to change. That change can mean an opportunity to rise to new heights. But it may just as likely signal the beginning of the end. An inflection point can be the result of an action taken by a company or an action taken by another entity. An excellent recent example may be Facebook’s announced intention to enter the cryptocurrency market. The markets have already reacted sharply to Facebook’s move. Analysts have suggested that it may significantly alter the forecasts for cryptocurrencies. Change is inevitable and change is happening more rapidly than ever. Adaptation to change is imperative for corporate survival.

Managing The Accelerated Corporate Lifecycle

As Change Accelerates, More Important Than Ever

Anyone starting a new company should understand the concept of the “corporate life cycle”, and use it as a guide for understanding where the company is in that cycle, to understand the risks at each stage, and to recognize the need for action to change course. This graphic shows a typical corporate life cycle and different possible paths as the company matures. Management of the corporate life cycle also dovetails with the concept of a “strategic inflection point,” which I briefly discussed in my Week 5 Report, The Internet of Things. John Chambers, the former CEO of Cisco Systems has pointed out that the rapid acceleration in market changes has also accelerated the corporate life cycle, emphasizing the importance of understanding it. Companies abound that were initially very successful and yet eventually closed their doors, or were acquired because the company did not anticipate market changes and the need to adapt to the new situation.

Strategic Focus versus Nimbleness

This week I want to discuss the importance of strategic focus, while still being open to possible opportunities, sometimes called corporate “nimbleness,” which may seem like a contradiction. I am a strong believer in strategic focus, however, I have also personally experienced a case where an “openness” to opportunity transformed the enterprise from a pedestrian company into a Silicon Valley legend. Ascend Communications was “focused” on ISDN based video conferencing with a modest and profitable OEM agreement with AT&T. However, AT&T came to Ascend and asked if it could solve a much bigger problem…

Engineer to Entrepreneur

For the last few years, I have been invited to speak with graduating classes of university engineering students. I call my lecture “Engineer to Entrepreneur.”  From my background in teaching management and entrepreneurial mentorship, I focus on the unique challenges engineers face in entering the business world, particularly those who may consider starting their own new business. I discuss a full range of issues, but my personal emphasis from my experience is the “character” issue.  Some excellent engineers have successfully made the transition to entrepreneurship and executive management, but for others, the Odyssey is a bridge too far. Engineers must learn to think differently than when they are solving an engineering problem.  Consequently, I place significant emphasis on honest self-analysis and appreciation of one’s strengths and weaknesses.  Listening is a priceless skill. If you have experienced Google’s Larry Page in public, he is an excellent example of an engineer who has very successfully transitioned into a senior management role. Sergei Brin, on the other hand, opted for a CTO-like role, which I think was the right choice for him. That is the point of my lecture. I hope that many who view my YouTube Channel will find it helpful. You can find the complete lecture on my website.

Remember that my website, mayo615.com has over 400 posts on a wide range of management and technology topics.

Mayo615’s French Odyssey: A Complete Product

The concept of a Total Product or Complete Product is essential to product success, particularly in an emerging new company. This concept was pioneered by Harvard Business School professor Ted Levitt and later updated and adapted to the high technology industry by a group of us at Intel. Engineers commonly believe that when their product development is finished, the product is ready for market. Nothing could be further from the truth. The engineering “deliverable” is not a product. It must be surrounded by a number of other intangible value items before it is a Complete Product. In Levitt’s model, these items are the augmented product, the expected product, and the potential product. The Intel variant, shown here, is more detailed but essentially very similar.

Mayo615 Has A New Look

Welcome To Mayo615’s New Look

I decided it was time to update the website with a new look. Most importantly, The Mayo615 site now supports Google’s AMP (Accelerated Mobile Pages), an open source initiative, enabling pages to display quickly and optimally on mobile devices. Have a browse and leave me a comment on what you think.

Internet of Things At A Strategic Inflection Point

IoT Technology And Market Requirements Convergence

Current Long-Term Market Projections Are Based On The Emergence Of Technology Solutions

This Mayo615 YouTube Channel video focuses on a particularly important technology market, the Internet of Things. IoT is at a strategic inflection point, due to explosive projected market growth and unresolved problems of wireless data throughput and energy-efficiency needs. The IoT market is projected to grow to 75 Billion devices by 2025. This growth is predicated on very high throughput wireless networks combined with high energy-efficiency which are not yet available.  Existing wireless technologies, including 5G, will not meet this market need. Also, the extreme diversity of IoT applications will require both small sensors that operate using minimal energy and bandwidth and virtual reality applications with very high Gigabit per second data rates and substantial power requirements. For example, Intel estimates that one autonomous vehicle will generate 4 Terabytes of data daily.

The good news is that through my work evaluating advanced research proposals in IoT, I can report that a solution may already be at the laboratory “proof of concept” stage.

The proposed solution that is emerging is the development of innovative software-hardware architectures in which all network layers are jointly designed, combining a millimeter wave high-throughput wireless network and a battery-free wireless network into a single integrated wireless solution.

This is no small feat of engineering but it does appear to be feasible. There are many challenges to successfully demonstrating a millimeter wave wireless network integrated with the Tesla-like concept of radio-wave backscatter energy harvesting. However, collaboration among universities and large Internet companies’ research units are nearing the demonstration of such a network. The likely horizon for this becoming an industry standard is probably three to five years, with prototype products appearing sooner.

You can also read my earlier website posts on the Internet of Things here on mayo615.com.  Links to related posts on IoT are also shown below on this post.

Canadian Tech Out of Touch With Global Entrepreneur Ecosystem

Canadian Tech Industry Still Not Confronting Its Infrastructure Issues

This is yet another excellent article questioning the Canadian tech industry’s appreciation of its significant deficiencies and challenges. It reflects my own view after much research and many interviews. It is also the view of UoT Professor Richard Florida who published a similar article in the Globe & Mail recently. Venture capital is anemic, but many also believe that there is a lack of scale-up management talent. Another factor is deeply-embedded Canadian conservatism, as evidenced by the bizarre entry of high street commercial banks’ debt offerings to entrepreneurs.

Source: Canadian tech needs to redefine its sense of scale

CANADIAN TECH NEEDS TO REDEFINE ITS SENSE OF SCALE/BetaKit

If like me, you spend a lot of time poring over the latest in Canadian tech, chances are good that you see both the huge potential of our technology companies and the simultaneous challenge: too often, they’re being held back by Canada’s scale-up deficit.

This, of course, isn’t news. In all the years I’ve participated in this sector, it’s been an ongoing challenge—one that has been the topic of countless discussions, panels, and debates. It’s an issue that has long challenged our innovation and technology sectors, and though it’s been talked about at length, it’s a conversation that deserves our full attention until we get it right.

Canada has become a launch-pad for early-stage companies, but, with a few notable exceptions, we are largely still lacking later-stage success stories.

PwC Canada’s recent MoneyTree report shows that our technology sector has seen a significant increase in funding deal volume in the last year—up 30 percent from 2017. But when one reads between the lines, it’s also clear that our homegrown tech companies are still largely stuck in a middle ground. In fact, of all the companies raising seed or early-stage funding during 2015-2017, only roughly 10 percent of them raised expansion or later-stage funding during 2016-2018.

Even if we leave room for successful shops that don’t need to raise further VC, that still doesn’t account for all of it. Many stall, naturally. They don’t continue to climb the curve and thereby miss the opportunity to hit scale. Of course, some companies shouldn’t scale and falter for good reasons. But many should and, for one reason or another, don’t. As a result, it seems that Canada has become a launch-pad for early-stage companies, but, with a few notable exceptions, we are largely still lacking the later-stage success stories we see in many other ecosystems.

Addressing this begins with challenging our very definition of scale. When we talk about Canada’s scale-up dilemma, we tend to focus on the obvious: raising capital, multiplying sales, and increasing market share in large, global, addressable markets. All of this is important but, in my experience, it’s only a part of the equation. Whether founders are on their first venture or their fifth, early-stage companies face many challenges to growth, and mature technology ecosystems support them by ensuring they see the bigger picture, beyond raising capital and increasing sales. It’s time to redefine our collective understanding of what scale means, and arrive at a new recipe that touches on all the moving parts companies need to master if they’re going to level-up.

To redefine scale, we need to take a closer look at the state of our ecosystems, which can become global hubs for highly skilled digital, creative, and leadership talent, and at the roadblocks that are currently preventing companies from scaling up. Let’s start by looking to the key stakeholders who will inevitably play an important role in shaping the future of the tech sector, including our government, VCs, and the public and private sector buyers of technology.

Government, of course, has several levers to pull when it comes to helping companies scale, like shaping policies and regulations that work to benefit our technology sector, while ensuring tax dollars are well spent through targeted incentive programs matched with data and IP policies that achieve the right balance.

Government(s) of all levels need to re-commit to working with Canadian technology companies at all stages of their evolution. They need to commit to procurement policies and practices that produce a real and predictable market for our tech companies to address and sell into. Federal and provincial governments of all stripes have made promises in this regard, but the velocity of, and commitment to, local sourcing hasn’t yet translated for our entrepreneurs.

Our government can also work to modernize our federal and provincial processes that foster the development and retention of IP, and continue to evolve tax incentives that support later-stage companies. These improvements would also encourage greater global investment in the Canadian ecosystem. According to the World Economic Forum Executive Opinion Survey, two of the most problematic factors of doing business in Canada are inefficient government bureaucracy and tax rates.

Data regulations and privacy policies, too, are of particular focus for governments worldwide. Ours can help us ensure that Canadian technology shops want to stay here, to do their important work, while being intentional about our data protection policies. After all, scaling does not mean scaling by any means, and protecting our data sovereignty is important.

Beyond government support, we should also look to VCs and other sources of private capital to enable companies to scale. Here, we often turn to Silicon Valley for inspiration, as investors there tend to be more willing to place big bets and write big cheques. Canada can learn from this. Any investor is going to have more misses than hits and, without higher risk tolerance, we won’t be able to finance the technological sophistication that will propel us to the next level.

According to the 2019 Canadian Startup Outlook Report, 56 percent of companies state that their long-term goal is to be acquired.

There is good news for Canada: CPPIB recently announced investments of $1 billion in venture funds, much of which will focus on technology companies. I’d love to see our wider investment community follow their lead. Funds like Novacap, Georgian Partners, OMERS Ventures, and more occupy the unique position of helping shape the future of Canada’s innovation economy. They’re already investing in some great home-grown companies, and their continued willingness to take bigger risks on innovative, growth-stage companies will help create the culture we need.

There’s even more good news when it comes to talent in Canada: we’re well positioned to become a hub for top tech and innovation talent. Our immigration policies, like BC’s Provincial Nominee Program and the federal Global Skills Strategy, are helping to draw the global talent stream north; our colleges, universities, and research hubs are world-renowned. Still, as I’ve seen with the corporate boards and senior leadership teams I’ve been involved with, companies need seasoned global talent if they want to become truly global players. It’s time we cast a wider net, finding ways to incentivize governance and executive talent from technology hubs like Boston, New York, Shenzhen, Dublin, Tel Aviv, and beyond to help Canadian companies reach their next stage and deliver on the promise of scale.

Established Canadian corporates have a big role to play here too. While our market is small by comparison to our neighbour, there is big buying power in our financial services, energy, retail, healthcare, automotive, and other major industries. Without a hint of protectionism, we can look to the Canadian innovation and technology markets each and every time we are procuring a solution, looking for new technologies or even looking for a problem to solve. In fact, according to the 2019 PwC annual CEO survey, 52 percent of Canadian CEOs surveyed see collaboration with start-up entrepreneurs as a key growth strategy.

Another way for companies to level-up and scale quickly is to reconsider some elements of the growth strategy playbook. Not surprisingly, according to the 2019 Canadian Startup Outlook Report by Silicon Valley Bank, 56 percent of companies state that their long-term goal is to be acquired. However, we should consider a shift in mindset that focuses on growth by acquisition rather than looking primarily at exit strategies or organic growth. This approach works well in dynamic sectors like fintech and healthcare. I’ve seen companies enjoy success by expanding into international markets or adjacent spaces, growing horizontally through acquisitions. Our tech leaders need to be thinking long-term so that, whether they’re building to grow, to expand, or to sell, they have the right structures and systems in place.

I am hopeful that these thoughts are provocative and assist some in considering strategies and actions that will lead to the scale Canada needs. True scale is critical if we want our technology companies to drive our GDP, provide high-paying jobs, and spur the innovations that will elevate us on the world stage.

This article was originally published on LinkedIn. Photo courtesy @dingle.

Could Macron and Brexit make France Europe’s tech capital? 🇫🇷

Source: Could Macron and Brexit make Paris Europe’s tech capital?

FRANCE 24

Date created : 13/04/2019 – 18:14Latest update : 15/04/2019 – 08:23

Ludovic Marin/AFP | French President Emmanuel Macron speaks as he visits the start-up campus Station F on October 9, 2018.

This article’s original headline and content focused only on a very large, high profile startup incubator in Paris, but frankly, there is a lot more going on in other parts of France as well.

Text by:Charlotte WILKINS

Shortly after his election in May 2017, President Macron said he wanted France itself “to think and move like a start-up” – a vision of the country’s digital future that is gaining traction as Britain wrestles with Brexit.

French President Emmanuel Macron’s vow to make France a ‘start-up nation’ amid the uncertainty over Brexitis raising the question of whether Paris could supplant London as the capital of European tech.

Since his election, Macron has wooed tech entrepreneurs with a string of initiatives in the form of lavish tax breaks, subsidies, and credits for research. In March 2018, he promised to invest €1.5 billion into artificial intelligence research through 2022.

Some of these initiatives, in addition to Macron’s dynamism, have lured British tech companies who are looking to gain a foothold in Europe.

“It made sense to have a European base,” said Cedric Jones*, a Briton who recently launched a start-up at Station F, the cavernous old train station that is now home to the world’s largest start-up campus. “If I’m going to make waves in continental Europe… I wanted to get here before Brexit happened.”

Jones is among dozens of foreign entrepreneurs who have recently launched their start-up at Station F, whose 3,000 desk hub has seen spiraling applications from English-speaking nationals in the last two years.

Some cite political woes back home, the burgeoning French tech sector, or are inspired by Macron’s bid to make Paris the innovation heart of Europe.

“There’s an air of optimism and a can-do spirit in France that I feel we’ve lost somewhat in the US,” said Mark Heath, a New Yorker, who stayed on in France to launch a start-up after studying at INSEAD in 2017.

The Macron effect

Much of the investment in French tech predates Macron’s reforms. The state investment bank Bpifrance, launched by former French president François Hollande in 2013, has been widely credited with developing the sector. Hollande also set up new foreign visas for start-up entrepreneurs.

But Zahir Bouchaary, a Briton who works out of Station F, credits Macron with injecting dynamism into the sector.

“Macron has installed a [start-up] mentality within the French ecosystem itself,” said Bouchaary, adding that it has become much easier to do business in France in the last few years.

“French customers are a lot more willing to work with start-ups than they were before,” said Bouchaary. “France was a very conservative country and our clients were used to working with big old-fashioned companies that have been around for a while. For the past few years, they’ve opened up a lot more to working with younger companies and seem to take more risks than they did before.”

Jones agreed that Macron was “the single variable”. “When he [Macron] goes, the dynamism will go too. I absolutely would not expect that to remain the case if he’s not the president.”

However, although Macron has moved to ease labour laws, Jones said that navigating the country’s labyrinthine bureaucracy in French remained “very burdensome”, and that it was far easier to build a business in the UK. “Whether it’s from a tax perspective or from a legal perspective it’s just so much more complicated.”

UK tech ‘resilient’

The tech scene in London appears to be just as vibrant as ever, explained Albin Serviant, president of Frenchtech in London, who said many UK-based tech entrepreneurs are adopting a “wait and see” approach to Brexit.

“The UK ecosystem is quite resilient,” said Serviant.

“In the first quarter of 2019, there were about €2 billion invested in tech in London. That’s compared to 1.5 billion last year, which is plus 30 percent. And that’s twice as much as France – which invested 1 billion. France is catching up very fast but the investment money is still flowing in the UK,” he added.

Serviant cited London’s business-friendly ecosystem and international talent pool as reasons for why London remains the capital of the European tech sector. Barcelona and Berlin are also contenders for the UK’s tech start-up crown.

Nonetheless, Serviant cautioned against the effects that a hard Brexit would have on the tech sector in the UK.

“‘If Brexit happens in a bad way and if people like me and other entrepreneurs have to leave, obviously that’s very bad for the UK because what makes it very different is the international DNA of London.”

Hard Brexit would not just damage the UK tech sector but would also pose challenges for British developers, who post-Brexit may need a carte de séjour to work in the country, looking to find work in France.

Sarah Pedroza, co-managing director of Hello Tomorrow technologies, a Paris-based startup NGO, said that if she had to choose between hiring a British national and an EU citizen with the same skillset, she would opt for an EU citizen because there would be less paperwork involved.

Brexit aside, others suggest that France is snapping at the UK’s technological heels.

“I do think France has the potential under Macron to close the gap with the UK,” said Jones.

“The single biggest factor in what’s going on for France is that France is developing a sense of confidence in itself, in its start-up scene, as a tech hub, that’s being helped by France and that’s also being helped by Brexit.”