Researcher details a backdoor in Huawei-owned HiSilicon chips used in millions of smart devices, including security cameras, that has been active since 2013
Researcher said he did not notify HiSilicon due to a lack of trust in the hardware vendor to adequately fix the issue.
Context & Ripple Effects
This lands on top of a years-long stack of Huawei security findings: Vodafone's earlier Telnet backdoor findings from 2011–2012, the Microsoft-discovered PCManager bug that behaved like NSA-style malware on MateBooks, and firmware testing that found vulnerabilities in 55% of sampled Huawei telecom device images. What is new here is the layer — not network gear or laptop software, but the HiSilicon system-on-chip itself, sitting inside millions of third-party security cameras and smart devices and reportedly active since 2013.
The disclosure path matters as much as the bug: the researcher says he skipped notifying HiSilicon entirely because he did not trust the vendor to fix it properly. That breaks the coordinated-disclosure model the industry runs on, and it set up Huawei's blanket denial two days later that it does not include backdoors in any product, HiSilicon included.
First-order effects
- Millions of already-deployed cameras and smart devices built on HiSilicon silicon carry a vulnerability their owners cannot patch at the chip level, leaving integrators and end users exposed with no vendor advisory to work from.
Second-order effects
- Device manufacturers that built product lines on HiSilicon chips inherit the reputational damage and face buyer pressure to prove their supply chain, while rival chip vendors gain a sales argument against Chinese silicon — a playbook the later undocumented ESP32 'backdoor' finding shows repeating across the category.
Third-order effects
- When researchers conclude vendors will not fix disclosed flaws, private reporting collapses and findings surface unpatched in public — pushing procurement toward audited silicon provenance and making chip-level security review a structural requirement for any volume IoT supplier, regardless of country.
The trend: Security scrutiny of mass-deployed chips is moving trust debates upstream from patchable software to silicon provenance, where neither vendors nor disclosure norms currently offer a reliable fix path.