Six U.S. intelligence agencies warn against using Huawei phones

Fast Company ^ | February 14, 2018 | By MG

[Red Badger]

Possibly so, but it is a ‘dumb’ phone with Alzheimers. It can’t remember a thing.............

[Red Badger]

I get e-mails from people that say at teh bottom:

‘Sent from my Huawei’ phone.......or ZTE as applicable.

Now I think these may be loaded with spy-ware...................

[Flick Lives]

We’re deeply concerned about the risks of allowing any company or entity that is beholden to foreign governments that don’t share our values...

"Our" values meaning what to the FBI? Using the power of the Federal government to spy on the opposition candidate? Those kind of values?

[ml/nj]

I am deeply concerned about the risks of allowing any company or entity that is beholden to ANY government that doesn’t share MY values to gain positions of power inside our telecommunications networks.

It is probable that the US Government is a greater threat in this regard than is the Chinese government, at least until President Trump can drain the Swamp..

ML/NJ

[Grampa Dave]

Best BOL so far on this thread monitored by the Chicoms!

Possibly so, but it is a ‘dumb’ phone with Alzheimers. It can’t remember a thing............

[Liberal Anti Venom]

D’uh! This has been a problem from the moment we began importing crap from China 25 years ago. Anybody who thinks this is a new phenomenon or that China just started doing this is either too dumb to be in the intelligence business or is on the Chinese payroll. Either way, China has already dug into the US economy and government like a tick and the damage is irreparable. JMHO.

[Liberal Anti Venom]

D’uh! This has been a problem from the moment we began importing crap from China 25 years ago. Anybody who thinks this is a new phenomenon or that China just started doing this is either too dumb to be in the intelligence business or is on the Chinese payroll. Either way, China has already dug into the US economy and government like a tick and the damage is irreparable. JMHO.

[Garth Tater]

"It would be a better choice than one of these two makes. It's design and software additions are controlled by Google, not the Chinese Government. "

Huawei is the number one hardware platform for open source phone development. The company makes unlocking their phones a breeze via their website, they provide top-notch technical support to the developers at xda-developers.com (the place to be for phone devs) AND they provide serious hardware at great prices.

As to worrying about using a phone designed and built in China - I would much rather trust something that has been torn apart, examined and put back together by a world wide community of open source software and hardware developers than I would anything coming in a locked down package from Google.

My Huawei Honor 5x has been flashed with so many flavors of linux running every Android version since Kitkat that I can't keep count. It currently drops down from Android Mashmallow into a nuke hardened selinux which lets me hang out in unsafe spaces while my Honor 8 drops into Debian GNU/Linux and lets me do dev work in my home environment.

Can you tell I'm a big fan of Huawei phones?

[Zhang Fei]

I’m sure developers can figure out ways to make sure their phones aren’t trojaned, and they can obviously root and install whatever firmware they want on their phones. The question is how a normal user downloading firmware from Huawei’s or ZTE’s website using the firmware update button on the phone can check whether those updates have been seeded with malware.

[Mastador1]

As if no other phone is built without the access to it by a company that is beholden to a foreign entity! Yes I mean Apple too!

[Garth Tater]

The update file you download (probably from huaweidl.com) will probably be a zip file that contains your new firmware and another file that ends with an .md5 extension. That .md5 file is a text file that contains a 32 character string that you match to the string you get when you check the md5 checksum of the firmware file that you downloaded.

How to Check/ Verify MD5 CheckSum of a File on Windows, Mac and Linux

To double check you can go to the appropriate forum for your phone on xda-developers.com and match the md5 checksum of the firmware the developers there are using to the one that you downloaded - but that is only for the truly paranoid (like me.)

Huawei is known for their support in the open source community and they would never knowingly provide an infected download as that is a one strike and you are forever out kind of offense - and an offense that the experts there would almost surely catch. As long as you are using the same firmware as the devs at xda (as verified by the md5 checksums) then you are as safe as you (as a user) are ever going to be.

[Zhang Fei]

they would never knowingly provide an infected download as that is a one strike and you are forever out kind of offense

---

Does “out” mean no telco will ever buy their phones again? Or merely that they’ll be the subject of internet forum criticism?

[Zhang Fei]

As long as you are using the same firmware as the devs at xda (as verified by the md5 checksums) then you are as safe as you (as a user) are ever going to be.

---

Thanks for the tip. So you’re fairly confident that the stuff posted on xda-developers isn’t a cover for malware authors looking to spread their creations?

[clee1]

That doesn’t make me feel any better...

[Garth Tater]

Very sure. Reputation is everything in the open source community and newbies' code is looked at very closely until they prove their worth and their honesty.

That's not to say you can't brick your phone by flashing it with some stuff you find on that site. My recommendation: look into TWRP (twrp.me) TWRP is software that lets you try out new kernels and ROMs without actually putting them on your phone. You'll need a separate computer to run ADB (Android Debug Bridge) and TWRP on and you'll need to make sure the latest and greatest version of TWRP (3.2 I think) supports your phone, but then you can talk your phone into booting and running off of software images residing on your work computer and not have to worry about bricking your baby while you try new things out.

PM me if you get stuck on something and I'll be glad to give you a hand.

Standard disclaimer: if you brick your phone, I don't know you and we've never talked.

[Garth Tater]

"Does “out” mean no telco will ever buy their phones again? Or merely that they’ll be the subject of internet forum criticism?"

Neither. One strike and they're out means no open source developer worth his or her salt would ever work with them again. Ever.

GNU - The Free Software Movement

Electronic Frontier Foundation

This is our world. They are trying to take it away from us but we're not going to let them. Open source rules!

[Kommodor]

Hu? No way...

https://www.youtube.com/watch?v=1Evt6As72m4

(couldn’t resist)

[Zhang Fei]

Many thanks for the tips and the information about Huawei’s open source heritage. I’ll have to take a closer look at the rooting process. What are your thoughts on ZTE? Is it like Huawei or a different animal entirely? I know Cricket and many of the Sprint MVNO’s have been selling ZTE phones because the screens are large and they’re pretty popular among users because of their durability. I have zero personal experience with ZTE myself, and am just passing on what I’ve heard from people I see using them, on 2 random occasions.

[Garth Tater]

I don't have any experience with ZTE, but these guys do.

And this guy too:

ZTE is Giving Developers a Head Start on LineageOS 15 for the Axon 7

"ZTE has apparently provided pre-release firmware to the official maintainer of LineageOS for the Axon 7 to help bring LineageOS 15 to the device."

"The official maintainer of LineageOS on the ZTE Axon 7 is XDA Recognized Developer Unjustified Dev. "

[Zhang Fei]

Thanks for the info. It sounds like ZTE is reputable enough, malware-wise, that xda-developers contributors feel it is worth their time to soup up their phones.