New Evidence of Hacked Supermicro Hardware Found in US Telecom: Bloomberg (bloomberg.com) 191
A major U.S. telecommunications company discovered manipulated hardware from Super Micro Computer in its network and removed it in August, fresh evidence of tampering in China of critical technology components bound for the U.S., Bloomberg reported Tuesday. From the report: The security expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery following the publication of an investigative report in Bloomberg Businessweek that detailed how China's intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015. Appleboum previously worked in the technology unit of the Israeli Army Intelligence Corps and is now co-chief executive officer of Sepio Systems in Gaithersburg, Maryland. His firm specializes in hardware security and was hired to scan several large data centers belonging to the telecommunications company. Bloomberg is not identifying the company due to Appleboum's nondisclosure agreement with the client. Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server's Ethernet connector, a component that's used to attach network cables to the computer, Appleboum said.
Bloomberg! Bloomberg! Bloomberg! (Score:5, Interesting)
Re:Bloomberg! Bloomberg! Bloomberg! (Score:4, Insightful)
Nope, nor have enough details been released that somebody could even start. There's speculation, but Bloomberg hasn't published anything that would let someone verify it on their own.
Re:Bloomberg! Bloomberg! Bloomberg! (Score:5, Interesting)
The authors of this most recent story were also the author of the original Supermicro story. They also wrote other pieces over the last couple of years were they have made lots of spectacular claims, with little or no evidence, and, there has never been any follow-up on the stories.
Re:Bloomberg! Bloomberg! Bloomberg! (Score:5, Interesting)
I have no evidence of this but... if you were writing those stories, why wouldn't you?
2018/10/04 US:SMCI $21.47 --> $8.55
2018/10/09 US:SMCI $15.55 --> $10.80
Re: (Score:2)
I have no evidence of this but... if you were writing those stories, why wouldn't you?
I suspect one wouldn't because it would be a massive financial risk by one who doesn't have massive amounts of money to lose (aka some journalists)
Re: (Score:2)
Re: (Score:2)
https://en.wikipedia.org/wiki/Market_manipulation [wikipedia.org]
Also see the bullet poi
Re: (Score:2)
That wouldn't be independent verification. At most, you could verify that Yossi Appleboum claims to have seen compromised servers. That's lovely, but I can also claim to have seen Bigfoot living in my data center, and it's worth about as much (though I'm not pitching a business locating rack-dwelling cryptids).
For independent verification, we'd need a way to identify suspicious servers (like a batch of affected part or serial numbers), a real picture of the offending chip, and someone completely unaffiliate
Yossi Appleboum, BB's source for second story, hat (Score:2)
Yossi Appleboum Disagrees with How Bloomberg is Positioning His Research ... ... â Other Components
ServeTheHome â
Re: (Score:2)
Re:Bloomberg! Bloomberg! Bloomberg! (Score:4, Insightful)
Does Bloomberg?
Re: (Score:1, Offtopic)
Re: (Score:2)
He didn't equate Bloomberg with the Chinese government except in the sense that neither can be trusted with outrageous claims without verification.
Re: (Score:2)
Re: Bloomberg! Bloomberg! Bloomberg! (Score:2)
the idea of bloomberg publishing sensational garbage is even easierto believe
Re: (Score:2)
Re: (Score:2)
So then we're left with an important question: Why did Amazon & Apple dump Supermicro at around the same time?
Government contracts requiring certification that in turn require a secure supply chain which in turn requires systems to be manufactured in the US.
Big, boring makers of overpriced data center equipment play this game well. Supermicro sell less costly stuff, but it's made in China.
Re: (Score:2)
Re: (Score:2)
I read it.
It is still a real thing. To get certified to be eligible to bid for and get certain government contracts, a certified secure supply chain is needed. This is not new.
This being true doesn't tell you whether or not that's the cause of recent actions - but it tells you that it's going to happen anyway and you can't tell the difference from the outside.
It's worth looking to see it Apple and Amazon were bidding for some large government business around the same time.
Re: (Score:2)
Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. And Elemental was just one of hundreds of Supermicro customers.
So, as far as being the "reason" for dumping Supermicro at that time, "government contracts" do not compute.
Re: (Score:2)
China fucking with the supply chain in such a ham fisted way and at the same time confining it to only one brand of motherboard is a bit odd to say the least.
I would expect something harder to detect, harder to prove, nearly impossible to trace back, and affecting every single brand of motherboard.
I would also expect that once it came out, a zillion tweets and blogs of OMG, I found one and a zillion me-to articles from every news outlet saying OMG these people found one. Complete with pictures.
Re:Bloomberg! Bloomberg! Bloomberg! (Score:4, Interesting)
Why would it be in any way shape or form outrageous, they would be logical and expected. The best supply line hack, high efficiency capacitors are smaller than low efficiency capacitors (much more expensive as well). So you can put a high efficiency capacitor in a low efficiency capacitor casing and have room left for a chip. What the chip does is check from a signal on the power flow, if it gets the right code, it shorts out the connection and the capacitor dies, taking out what ever product ie a computer it is in. So done on a broad scale you can collapse a country. The chaos, everything with that capacitor goes down, replacement computer motherboards are really difficult to order because the computers down. Get the motherboard, and if the signal is still going, once it is powered it fails.
Get enough tainted capacitors into the infrastructure and that country goes down for months, everything goes down, it basically just lost a war it never knew it was fighting, would I trust capacitors out of China or the US in essential infrastructure, absolutely not, I would strive for all infrastructure components to be locally made. If I was supplying them to another country, I would bobby trap it all, just in case, so much fucking cheaper than a war machine and far more effective. Not happy with the supply of my tainted components, make your fucking own, or buy some other countries tainted components. US tech industries are so screwed and the US government did it to them.
Re: Bloomberg! Bloomberg! Bloomberg! (Score:2)
Re:Bloomberg! Bloomberg! Bloomberg! (Score:5, Insightful)
Does anybody think the Chinese government deserves the benefit of the doubt?
Does Bloomberg?
Yes. Bloomberg is a center-right media outlet, and almost all of their profitable business is related to selling financial information to professionals. They make an industry-leading software product called Bloomberg Terminal that they use to disseminate this information.
I wouldn't trust them on political reporting, because they tend to give the perspective of a center-right business executive. But on general news that doesn't relate to their industry, they are nothing if not mainstream. They don't go for bombastic tabloid nonsense, it would tarnish their brand. Getting page views isn't the purpose of their public news service; enhancing their brand is the purpose.
Therefore, I would give Bloomberg the benefit of the doubt that they believe this information to be true, and to be of great import to purchasing and IT managers, in addition to investors and financial services providers. This is big enough that the insurance community is probably taking a lot of interest, too. They would never intentionally publish a false report that purported to be of great interest to the industries where they make their bread-and-butter; it would be all downside for them.
https://www.bloomberg.com/comp... [bloomberg.com]
Don't worry about the PR there, just look at the bottom of the page under "Products" and "Industry Products" and you can understand why they are a trusted source on this; they'd lose a lot by being wrong. And they have a lot to lose.
Re: (Score:2)
Center-right media outlet before the world went insane.
Now you would call it "business journalism" or something.
Re: (Score:2)
Money remains money, even in a weird year.
Re:Bloomberg! Bloomberg! Bloomberg! (Score:5, Interesting)
> how they could siphon off gigabytes of data and ship it to China, presumably over network connections and through firewalls,
That's the interesting thing to me as well. If your network and firewalls are properly designed, it shouldn't matter if your servers have a rogue little chip wanting to call home - your network should shitcan any attempt regardless.
Re: (Score:3)
An attacker only needs to get through the defense once (for various values of once) to be successful while the defender needs to block every attack to be successful.
A little spy chip spitting out a DNS query for an innocuous looking domain to exfiltrate data and/or grab C&C instructions from a TXT record or something might never be noticed.
Re: (Score:2)
If the attacker has insider access to China's network, because of their national perimeter firewalls, they could put it all into queries for subdomains of any legit domain in China, and even intercept them so they don't get to the actual name server. They just disappear from the backbone, and the data goes into a database. Responses can happen the same way; the packets don't even exist inside the Chinese network, they just appear on the external interface and off they go to their destination.
If they control
Re: (Score:2)
That seems to be getting harder and harder to do. Sure, you block incoming traffic, but more and more software is getting dependent on the "cloud" (in the somebody else's computer sense) and it's getting harder to run current software without allowing it to talk to huge swaths of internet. It doesn't matter if it's the new hot devops tools or the latest Windows. You can't run Office with a firewall without getting constant requests to phone all over the place.
It's irresponsible that businesses have allo
Bullshit meter DINGDINGDING (Score:2)
NO! The first story was 'anonymous sources', who failed to provide any evidence or samples of the alleged hardware. Multiple credible sources have spoken up to refute the claims that they used tainted hardware or even found any such hack despite inspections.
THIS time, the only source on record is a 'security' company that seems to be staffed/directed entirely by ex CIA and Mossad operatives. They obfuscate their claim by refusing to name the actual company, and again fail to deliver any evidence.
You'd
Re:Bloomberg! Bloomberg! Bloomberg! (Score:5, Insightful)
The public deserves the truth.
Security is complicated. On the one hand, perfect security is impossible. Your servers can be hacked, your data can be stolen, and your users can be phished.
However, there is another perspective that I think is equally important, if not moreso: It's not hopeless. The attackers are not omnipotent. They have 9-5 schedules, bureaucracies, budgets, and deadlines. If your system is protected well enough that your attackers' budget runs out, it will stay safe. From that perspective, security is just a matter of economics. Your security is bought by spending a little money and effort to drastically increase the effort the attackers need to spend.
An attacker embedding a custom chip in server hardware, then processing thousands of phone-home results is expensive for them, and unlikely to get a result. However, replacing your whole data center to use non-Supermicro servers is also expensive. Frankly, the whole thing probably isn't worth anybody's time.
Breaking into an internet-facing server with a default password is easy. There are lots of routers and firewalls out there with default credentials or hidden backdoor accounts. Exploiting one of those is ridiculously cheap for an attacker, and gets them far better results.
The notion of "the attacker is almighty" doesn't help improve overall security, because it silences discussion about how to actually improve security posture. Instead, we should set aside hardware concerns for now, and ask "What's the easiest way we can be attacked, and how can we fix it?", then make the fix, and repeat until your own budget runs out.
My skepticism is not about doubting China's ability. I'm sure China (or any nation or well-funded individual) could get hardware inserted into servers. What I'm skeptical of is whether China (or any nation or well-funded individual) would even bother with the expense and risk when they could send a phishing campaign instead.
Re: (Score:2)
...Why? Are Americans somehow incapable of being bribed to tweak a design? Does spending more on American parts mean your engineers are more likely to actually read the instruction manual and change defaults? Is an American developer going to oppose when their boss tells them to store passwords in plaintext, because the deadline's approaching and they refuse to delay for something the customer will probably never notice?
Checking the country of origin is a poor proxy for security. All it really means to have
Re: (Score:3)
Put in a tightly-configured firewall so your data doesn't get sent anywhere without your approval.
Keep management systems isolated so the data-holding servers can't modify that firewall.
Don't rely on tightly-integrated single-source solutions, so one vendor being compromised won't leave that firewall ineffectual.
Maintain independent layers of security that protect in case of another layer's failure.
That's defense in depth.
Re: (Score:2)
The whole point if this is that if they have a chip in your infrastructure, you have no defense.
That's the defeatist attitude that is so harmful to having meaningful security discussions.
Outward blocking firewall is great, unless they have their chip in it in which case they can be running an invisible proxy, or secret port knocking activated by other chips to trigger a "please forward this traffic".
But that means they need two chips, in two appliances, from probably two vendors, with two separate supply chains. For the price of bringing in a second-source vendor, you've doubled their attack cost.
Any defense you can implement, I can undermine for 1% of the effort
I think you mean "I can trivially move the goalposts a bit further".
if I already have access to the hardware via these exploits/backdoors and vulnerabilities.
Or in other words, "If everything is already completely breached, then everything is already completely breached, so everything will always be completel
Re: (Score:3)
On the contrary... I've been a government contractor, and money was often an issue, though mostly it was in terms of ROI more than actual dollars. Governments don't mind spending a lot of money as long as they know they're getting what they asked for.
Re: (Score:3)
Re: Bloomberg! Bloomberg! Bloomberg! (Score:4, Interesting)
but I also wouldn't put it past Bloomberg to publish rumors for page hits.
The Supermicro story is turning out to be a hoax.
The only person actually named in the original Bloomberg story about the Supermicro servers was a "hardware expert" named Joe Fitzpatrick. As it turns out, he' s not all that much of an expert, and he has now done an interview where he says that he doubts the accuracy of the story:
https://risky.biz/RB517_featur... [risky.biz]
He was communicating with one of the authors of the Bloomberg story for a couple of months before the story was published. Then, the story came out and things that he had described as being hypothetically possible were in the story, but presented as facts that they had gotten from various anonymous sources
For example, the Bloomberg guy said to him "One of my sources said the chip might be a signal coupler. What does that look like?" So Joe Fitzpatrick sent him a link to a picture from a catalog. And, lo and behold, when the story was published it contained that exact picture, presented as "proof" of the chip that was implanted on the Supermicro motherboards.
Re: Bloomberg! Bloomberg! Bloomberg! (Score:4, Interesting)
It does certainly sound that the reporters behind the story are not particularly good at understanding the information they get, or else vetting their sources...
The first story appears to be cobbled together out of misunderstandnigs spread across many sources (the number of sources then used to declare how valid it must be. Of course one of those 'sources' has come forth and said one source used a hypothetical and his role in corrobariting it was to include a picture of what a signal coupler is, showing how dodgy the story was assembled.
This time, it's at least more straightforward, one named source with a more straightforward and more credible strategy. However it is entirely possible that the guy doesn't know what a BMC is and mistakes the errant traffic from a BMC trying to DHCP or somethnig as an overtly malicious thing. He may not recognize some component of the jack or phy or noted the NCSI lines from NIC to another chip and presumed that was snooping.
Now it's one thing to put this out there for further investigation to get clarity, but the stories are emphatic and unambiguously making accusations which is causing the general tech market stock to move by billions of dollars and for customers to take the headlines at face value and decide things (moving from one company that was 'more chinese' than they realized to an american company with the same supply chain issues in all likelihood, even vendors making systems elsewhere generally ship circuitboards out of China). This could end up in a big defamation suit by many parties in the tech industry.
Re: (Score:2)
This could end up in a big defamation suit by many parties in the tech industry.
If that's what it takes to improve tech journalism in the MSM, then I'm all for it.
Re: (Score:2, Interesting)
The presence or absence of a defamation lawsuit will clarify the truth. Plus a defamation lawsuit would require the companies filing the suit to prove the accusations are false and allow outsiders access to the technology under review for independent analysis. And China seems to be pretty quite about the whole affair since a story like this will further limit their ability to sell their technology in the US. Maybe China is afraid to say anything because they are afraid of giving Trump a bigger bat to whack
Re: Bloomberg! Bloomberg! Bloomberg! (Score:5, Interesting)
If there were supposedly thousands of these things sold to various customers all over the place, how is it that nobody kept one for forensic analysis?
How is there not one live example if all these networks and servers were compromised?
The CEO says keep it secret. (Score:4, Interesting)
Do you think that your corporate security team wants to admit that you were infiltrated?
The first dozen companies that admit this will likely see their stock price decline. Do you want your company to go first?
Re: (Score:3)
Yeah good plan, because it always goes better when they try to cover it up and instead get hauled in front of Congress, testifying under oath.
What does that do to the stock price?
Re: (Score:2)
The clickbait ad revenue would be peanuts compared to the lost subscriptions due to them losing reputation.
I'm not making my mind up -- I'll wait to see how this develops.
Where? (Score:5, Interesting)
Re:Where? (Score:5, Interesting)
Investigative reporting doesn't work that way in most cases. There are a lot of unknowns. Right now, they enhance their own research by not giving out too many details, and letting the companies involved say stupid things that might be refutable by that evidence.
Evidence is good. Don't decide if it is actually true or not until you get it. But that doesn't imply that when you first hear about the issue, the evidence will be published, or that it is tactically wise to lead with the evidence instead of the accusation.
If we get to the end of the story and Bloomberg says "that's all we have," that's when you can weigh the evidence they presented. If they haven't presented the evidence yet, then before you start to worry about that, you should simply check if the process has reached the end, of if the evidence is still waiting to be released. If it is still waiting to be released, there is nothing suspicious at all about the fact that you have not been given a personal viewing.
Re: (Score:2)
> Right now, they enhance their own research by not giving out too many details,
Sure, but how hard would it be for them to put out a piece of proof like saying "we found this chip (pictured at right) on several motherboards of the following model that appear in Supermicro chassis x, y, z and bb." And then anyone who owns one of those can just *go look for themselves* to see if the chip is there too.
Put up or shut up...
Re: (Score:2)
Don't decide if it is actually true or not until you get it.
The only thing is that what Bloomberg is stating in the first story and to a much lesser degree in this current one are things that are tantamount to massive tectonic accusations. In fact, I'm really under selling it here. These claims are bigger than the second coming. So yeah, you're damn tooting I'm hyper skeptical of this story.
If we get to the end of the story and Bloomberg says "that's all we have,"
No, I think you aren't understanding the gravity of these claims. If we get to the end and Bloomberg has nothing, they need to be sued into a molten crater of nothing. That
Re: (Score:2)
Where is the evidence? They keep saying they have it. Why don't they show it?
Is somebody stopping you from buying one of their products: https://www.supermicro.com/pro... [supermicro.com] ...and looking for these backdoors yourself?
Plenty of evendince of this is real (Score:5, Informative)
Now Apple and others claim they have no idea what Bloomberg is talking about. Clearly something was installed on Supermicro servers to cause Apple and others to stop using them.
Report from early 2017
https://www.marketwatch.com/st... [marketwatch.com]
Re:Plenty of evendince of this is real (Score:5, Interesting)
Re: (Score:3)
And yet, they do offer an explanation they claim is not only better, but true! That it was only a software issue. They said that in response to the first Bloomberg story. So now Bloomberg is doubling-down on that part.
Re: (Score:2, Interesting)
...it was only a software issue...
Sorry, jack: there's not any claim by Amazon or Apple that there even WAS an issue. Try again.
Re: Plenty of evendince of this is real (Score:1)
The problem is that Apple (Google, etc.) is stuck between contenders who are State actors, two of which (the US and China) can make life very difficult for any company who decides to call them out. So they play a game of mitigating risk whenever itâ(TM)s found without actually calling out the State actor for nefarious activity. Instead, they cut ties with the corporate entity that is left holding the bag. In this case, itâ(TM)s SuperMicro who let their Chinese operations become overrun by the Chin
Re: (Score:2)
Re: (Score:2)
It was a hacked driver file on their public FTP server which was downloaded to a single Apple lab machine. All the details are out there. That wasn't the reason that Apple dropped them, it was purely price. When you order your servers by the container ship it's cheaper and more efficient to go to the ODM and have them build to your specifications thus cutting out the middle man and features that your use case doesn't require (like LOM cards, when you have a redundant array of inexpensive datacenters you don
Re:Plenty of evendince of this is real (Score:4, Interesting)
I had SMCI stock in 2017 and sold it after reports that Apple dropped them when they found serious security issues with their servers.
Going by that, the timeline would be that these companies discovered malicious hardware in 2015, kept thousands of those servers in service for two or more years, and only then decommissioned them. Does that make any sense at all?
Instead, if you read their initial responses to what Bloomberg published [bloomberg.com], they actually say more than that "they have no idea what Bloomberg is talking about". For instance, Apple provides an alternative explanation for Bloomberg's confusion:
[...] Bloomberg’s reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple.
Apple dropped SuperMicro shortly after that incident, making it a much more likely cause for the falling out. Likewise, Amazon cites firmware issues with SuperMicro boards in their response, though you'll note that they were still using SuperMicro boards in 2018:
Additionally, in June 2018, researchers made public reports of vulnerabilities in SuperMicro firmware. As part of our standard operating procedure, we notified affected customers promptly, and recommended they upgrade the firmware in their appliances.
All of which is to say, nothing about Bloomberg's story makes any sense. The timeline makes no sense, none of the alleged victims has anything to gain by lying, one of their only named sources has come out saying he doubts the story [risky.biz], literally every company or agency allegedly involved has said it's untrue, and Apple has even gone so far as to formally inform Congress that inasmuch as the story pertains to them it's untrue, while additionally affirming via press releases that they are not under a gag order or anything else of the sort.
Someone's credibility is going to take a nosedive after the dust settles from this, and I expect that it will be Bloomberg's.
Re: (Score:2)
The story is a plant. The Trump admin is
The source of the story is an ex-Mossad spook with ex-Mossad spooks on the corporate board. "Trump" is too simple of an answer, but you may not be on the wrong track...
Evidence? (Score:1)
Can they a least release the damn documents.
If they don't want to compromise the company just obfuscate the names with a fucking marker.
o better yet where this devices are for god sake.
I have a load of SuperMicro gear (Score:4, Interesting)
Also from that era that they say. I haven't seen anything anomalous. The fact is that some of their IPMI stuff is vulnerable and they're not updating the firmware (eg. old versions of Dropbear SSH), so if you leave it on the Internet, it may get compromised.
On the other hand, I also don't leave that stuff on a routable VLAN. If it tries to connect to anything (and I haven't seen it reach out), I'd notice and it wouldn't work anyway. Sure the IPMI has some hooks into the rest of the hardware so it is potentially capable of doing 'weird stuff' to my Linux or Windows kernels (although it'd have to be pretty smart to intercept keyboard authentication, wait for someone to be away from the keyboard, automatically replay credentials, then load a workable kernel module to do that) and have the OS compromised do the dirty work, but then again, I haven't seen anything there either and we've used various integrity and antivirus systems from TripWire, Sophos and Cylance that probably would've noticed.
Re:I have a load of SuperMicro gear (Score:5, Insightful)
The Register also discussed this... (Score:2)
...in their first article on the subject: [theregister.co.uk]
Re: (Score:2)
Re: (Score:2)
Uhm, if somebody put a hardware backdoor in one of the chips on the board, and as far as you know hasn't activated it, why would you expect to see anything "anomalous?"
That you consider that to be information with value really discredits your analysis as a whole.
And you're simply wrong that it needs to "reach out" in a detectable way to be a problem. In fact that's the difference between a hardware backdoor and a software one! The software one has to go through whatever networking you have set up. The hardw
Re: (Score:3)
Who in the hell exposes their management consoles to the outside world?
US Government does not want egg on face (Score:1, Interesting)
The US government is going to bury this at all costs, either because it doesn't want egg on its face, or because it is complicit in this hacking. Perhaps these devices were installed at the behest of the NSA and the Chinese simply redesigned them to also send info to the Chinese government.
Not implausible, if you ask me.
Re: (Score:2, Insightful)
>The US government is going to bury this at all costs
The US government would love a culture of suspicion of foreign built hardware to develop.
That's one plausible source of the story.
Re: (Score:2)
>The US government is going to bury this at all costs
The US government would love a culture of suspicion of foreign built hardware to develop.
That's one plausible source of the story.
Too bad for the Trump admin then that there is already a culture of severe suspicion of domestically made US hardware after the NSA bugging revelations. Now that it seems everybody is spiking computer hardware with spy chips I suppose we can always follow the example of the Russians and their intelligence services, they keep all their most sensitive data on paper and replicate it only with typewriters.
Re: (Score:2)
Perhaps these devices were installed at the behest of the NSA and the Chinese simply redesigned them to also send info to the Chinese government.
Because when I want to implement my super-secret and highly illegal surveillance program, I turn to a hostile government to implement it. :eyeroll:
Re: (Score:2)
Sending the information back over the internet is not without risks. Use a person to collect data.
Transmit the data out over a short distance not using the "internet"
Smart and skilled people notice extra data moving to strange places along their networks out to the internet.
Might not be just Supermicro (Score:5, Interesting)
According to the original article - the alleged Chinese culprit chip exploited via the BMC. Aspeed is the company that makes 99% of the BMC controllers in Supermicro boards. If China really did go through the trouble to develop a chip to exploit via Aspeed controllers.... why limit themselves to Supermicro? I know at least Tyan and Lenovo also use Aspeed. From China's intelligence perspective, they would want a solution that could work across multiple board vendors.
According to latest:
Really wish they would give us more to go on than just that. Not sure about other Slashdotters, but I have Tyan/Supermicro/Insert-Taiwanese-Motherboard-Manufacturer boards in production, and would really appreciate more information on what to look for.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
>Really wish they would give us more to go on than just that. Not sure about other Slashdotters, but I have Tyan/Supermicro/Insert-Taiwanese-Motherboard-Manufacturer boards in production, and would really appreciate more information on what to look for.
It doesn't add up.
Why would you put your trojan chip in the ethernet connector? It's away from the signals you want to get to - serial and/or usb wires to get at UEFI. Trying to cram and ethernet stack, phy and the drivers into a tiny package to get at a m
Re: (Score:2)
It's also inconsistent with the first story.
Because it's a different set of hardware supply hacks.
Re: (Score:2)
It's also inconsistent with the first story.
Because it's a different set of hardware supply hacks.
Yes. And a less technically logical one. Could you fit a 10G transceiver, phy, mac and stack inside the connector? Why would you? Consider equivalence to plugging your trojan into the back panel - you could pick the ethernet, or the USB. The USB gives you keyboard access and a low effort way to subvert the machine before it's provisioned.
Re: (Score:2)
Re: (Score:3)
Why would you put your trojan chip in the ethernet connector? It's away from the signals you want to get to - serial and/or usb wires to get at UEFI
Option 1: There's no requirement that there be no connection from this chip to another part of the computer. If you're planting rogue hardware in one thing there's little reason to believe you can't plant rogue hardware elsewhere.
Option 2: PXE boot attack.
Option 3: Their desired attack vector only uses this additional chip, the chip itself isn't the attack vector. After all, where do you get that BIOS image? Or the firmware on the rest of the motherboard's chips? Or perhaps you need the server to receiv
Re: (Score:2)
Because that's generally where the aspeed BMC is, which has access to everything. The BMC has a dedicated/shared ethernet port for remote management.
Re: (Score:2)
I'm talking about the electronics.
An ethernet port has a MAC, PHY, transceiver and connector. The connector, transceiver and MAC+PHY are usually separate chips because of the different silicon needs for analog signalling and digital processing. The claim is that they stuffed all this into the connector. Maybe, but this is all to get at a config interface that you typically can get to through serial or usb wires that are comparatively trivial to latch onto.
All they had to do was show us the electronics so we
#gifs (Score:2, Funny)
Pics or it didn't happen.
Re: (Score:2)
Pics or it didn't happen.
This
Pics and network traces diffed with/without the trojan.
Re: (Score:2)
Not quite the last. I've worked HW trojan analysis before. That's why I have opinions.
Bloomberg getting desperate ... (Score:2, Interesting)
This is an interesting story and all, but a targeted attack on a single machine using interception doesn't really make it likely there was compromise of Supermicro's supply chain at the factory level.
We know NSA intercepts Cisco routers, but that doesn't prove Cisco intentionally backdoors their machines for them in the factory.
Re: (Score:2)
a targeted attack on a single machine using interception doesn't really make it likely there was compromise of Supermicro's supply chain at the factory level.
The "single machine", according to the story, had a false ethernet port manufactured into it. What is your more likely explanation?
Interestingly, though, the named source for this article is an ex-spook for Israel. We are definitely in Hardball territory with this one, kids.
Re: (Score:2)
Interception and a soldering iron.
Re: (Score:2)
"The module looks really innocent, high quality and 'original' but it was added as part of a supply chain attack," he said.
Now, he may be wrong, but your partial version of events is not what the article's partial version of events is.
Re: (Score:2)
From TFA:
"... multipl
Re: (Score:2)
We know NSA intercepts Cisco routers, but that doesn't prove Cisco intentionally backdoors their machines for them in the factory.
Given that recently every month or so a new back door was found in Cisco's products, one could say we know for sure they are at least unintentionally backdoor their machines.
Re: (Score:2)
Problem in China there is no such thing as privately owned and the government can do what ever it wants at anytime. Crap China kidnapped , I mean 'arrested' the head of Interpol without telling anyone. Interpol had to beg China to finally say he was arrested two weeks ago when he came home. https://www.cnn.com/2018/10/09... [cnn.com]
Completely incredible... (Score:5, Informative)
"Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones."
Take a look at a google image search for "motherboard" and see if you can find an RJ-45 socket that doesn't have a metal shield around it for RF blocking.
Re: (Score:2)
"Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones."
Take a look at a google image search for "motherboard" and see if you can find an RJ-45 socket that doesn't have a metal shield around it for RF blocking.
OMG! They've all been hacked!! Run for your lives!!!
Re: (Score:2)
Plastic connectors.
Do your motherboards by any chance have the words, "Fisher Price" stamped on them somewhere?
Question is (Score:2)
Will anyone admit to being compromised by such a thing, if the story turns out to be true.
The impact on stock prices alone will probably keep companies from disclosing anything if they have any say so in the matter.
If you live in the US, you can't really be outraged about what China is doing when we have the NSA intercepting Cisco* hardware and tampering with it before shipping it on to the end customer. ( *Cisco is the only one we know about, who knows what else they have their hands in )
This is something
when the chinese secret service calls.... (Score:2)
.... you don't say no. if you recall i think it was "Kingsmen", samuel jackson saying, "y'know, the chinese secret service is so secret it doesn't even have a name?" that's because it's operated along isolated cell network lines. *not even the chinese government* can contact those independent cell networks! the only way to "contact" them is for the chinese government - just like everyone else - to make a bit of a fuss, publish a press release and hope like hell that the relevant cell happens to be readin
that's directly from NSA's playbook (Score:3)
implant in ethernet connector point to NSA's ANT catalog,
either "COTTONMOUTHIII" https://nsa.gov1.info/dni/nsa-... [gov1.info]
or "FIREWALK" https://nsa.gov1.info/dni/nsa-... [gov1.info]
this whole thing sounds more and more suspicious (Score:2)
It looks as if someone is attempting to raise anti-china sentiment, with the goal of getting USA manufacturing back in shape... surely it couldn't be the US governement (haha)...
Re: (Score:3)
Why put the chip on the Ethernet connector? You know this doesn't decrypt encrypted traffic.
To give it the ability to exchange command-and-control traffic with a remote controller while keeping it from the rest of the system (by "eating" the incoming packets for itself without handing them to the processor's stack, and sending outbound packets directly, again without processing them through the rest of the system.)
This is both convenient, and lets the C&C communicate with the victim box even when the bu
Maybe they just saw Intel AMT traffic. B-) (Score:2)
TFA says: "Unusual communications from a Supermicro server ..." and on inspection the Ethernet hardware looked odd.
Maybe they just saw some Intel AMT traffic and components. B-)