Chinese networking and telecommunications equipment manufacturer Huawei plans to send a team of engineers to Germany in order to meet with Felix Lindner, a security researcher who earlier this year disclosed vulnerabilities in the company's products, he confirmed.
The meeting was first revealed by John Suffolk, Huawei's global head of cybersecurity, during an interview, Reuters reported Thursday.
The company is not just interested in fixing the particular flaws reported by Lindner, but in making systemic changes that would make its products more secure in the long term, Suffolk said in the interview.
Felix "FX" Lindner is the technical and research lead at Recurity Labs, an IT security consultancy company based in Germany. This year, he disclosed critical vulnerabilities in Huawei home and small enterprise routers during the Defcon and Hack in The Box security conferences.
He also criticized the company for the lack of transparency when it comes to security issues and the poor quality of code in its products.
"I was surprised to learn that they told the press about this meeting before it actually took place, but it is correct that such a meeting is planned," Lindner said via email. "What Huawei's goals are for the meeting is not known to me yet."
"Unfortunately we are unable to disclose more information apart from what John Suffolk said in the interview," Yingying Li, marketing and communications manager at Huawei in the UK said Thursday via email. "We have set up a comprehensive security assurance system and have it stress tested on regular basis. The company will keep seeking ways to enhance the product security together with our customers and industry peers."
In the interview, Suffolk noted that Huawei has made changes in its approach to security since he joined the company in 2011, which included making it easier for security researchers to report vulnerabilities.
"It is correct that they appointed a Product Security Incident Response Team (PSIRT) and more prominently published how to reach it," Lindner said. "However, other areas still need some work. Security advisories, for example, are not yet widely circulated."
"Currently, all one can see is the apparent willingness to engage, which is a good first step," the researcher said. "Whether this will lead to a serious product security program or not is something time will tell."
Before joining Huawei as its global head of cybersecurity, Suffolk served as the chief information officer of the British government for six years. Back in September, he published a paper in which he outlined Huawei's commitment to cybersecurity.
"The company remains open for a constructive dialogue with all stakeholders, especially in the field of cyber security which is one of our top priorities," Roland Sladek, Huawei's vice president of international media affairs for the EMEA region, said via email.
For the past few years, the company has strongly disputed accusations of having ties to the Chinese military or the country's intelligence services.
A report released earlier this month by the U.S. House of Representatives' Permanent Select Committee on Intelligence said that using equipment from Huawei and fellow Chinese telecom vendor ZTE for U.S. critical infrastructure would pose a national security threat because of the possible ties between the two companies and the Chinese government. The committee advised the U.S. government, its contractors, as well as private-sector companies to avoid buying networking equipment from the two Chinese vendors.
Huawei dismissed the report as being politically motivated.