Huawei Will Not Patch 3G Routers Vulnerabilities

A security researcher has several 3G routers from the Chinese manufacturer Huawei network several vulnerabilities discovered that the company will not patch. It involves 14 models used by ISPs around the world, including Tele 2 and E-Plus in Germany.

According to researcher Pierre Kim devices are poorly designed and they are full of vulnerabilities. For example, the password and the name of the administrator stored in plain text in a cookie, the DNS server can be modified without valid credentials, the wifi password can be retrieved without credentials and it is possible for one of the models without authentication to adapt the firmware.

Kim Huawei warned in August about the vulnerabilities, but the Chinese manufacturer announced it will release no security updates because the devices are no longer supported. Huawei also advises users to no longer supported models to replace them with new routers. Kim then finally decided to publish his research.

Malware Infected Xiaomi Smartphone Appears Counterfeiting

Last week there was a fuss about Chinese smartphone manufacturer Xiaomi standard that malware would be delivered, but now it is confirmed that it is a counterfeit device. Bluebox security company published last Thursday a blog posting about malware that was found on the Xiaomi Mi 4 LTE smartphone. The company had bought the unit in China.

When scanning of the apps on the smartphone was found one suspect app, allowing users of information risk could walk.Initially the Chinese smartphone manufacturer would not have responded to the findings of Bluebox. After publication of the research did however a response, which the company claimed that there was possibly purchased a manipulated device.

Bluebox had purchased over the phone namely a physical supplier, while Xiaomi China does not sell equipment through "third-party" parties. The aircraft would only online and through the shops of telecom providers are offered. Then again Bluebox responded with criticism, because it was apparently possible for stores or anyone in the distribution chain to adjust the devices.

Counterfeit
After an extensive testing on the basis of all kinds of pictures is now been established that it is a counterfeit Mi 4. The unit was so well imitated that it initially also managed to circumvent a special app Xiaomi for detecting counterfeit devices. The latest version of the app can now detect the counterfeit version.

According Bluebox let the incident shows how important it is for companies to take researchers reports seriously and work together. Further notes the security of the supply chain, where it happens that consumers compromised smartphones can purchase. Finally, the tools to identify counterfeit goods must be improved.