The Long Hack: How China Exploited a U.S. Tech Supplier
Former officials say both hardware and firmware were tampered with.
www.bloomberg.com
and again the china and supermicro bashing continues by bloomberg
- Thread starter audio catalyst
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
www.bloomberg.com
So did they ever find the super secret chip on the supermicro MB? No.
Do they successfully launch the campaign against China since the article? Yes.
Is China USSR?
Do we want another cold war?
Who is benefiting from all of these?
In the cloud age, servers are commodity, who is willing to pay for 25%+ premium on the "SECURE" supply chain?
Do they successfully launch the campaign against China since the article? Yes.
Is China USSR?
Do we want another cold war?
Who is benefiting from all of these?
In the cloud age, servers are commodity, who is willing to pay for 25%+ premium on the "SECURE" supply chain?
Did the original story have anyone speaking on the record? That stood out here, although much of what is claimed is as unlikely as it was back in 2018, if not more.
The system firmware compromise is far more believable, but dragged down by the lacking credibility of the rest of the story.
The system firmware compromise is far more believable, but dragged down by the lacking credibility of the rest of the story.
Original story is here: China Used a Tiny Chip in a Hack That Infiltrated U.S. Companies
Other stories by Michael Riley: Michael Riley - Bloomberg
Other stories by Jordan Robertson: Jordan Robertson - Bloomberg
China seems to be their thing...
Supermicro is down 7% already.
Other stories by Michael Riley: Michael Riley - Bloomberg
Other stories by Jordan Robertson: Jordan Robertson - Bloomberg
China seems to be their thing...
Supermicro is down 7% already.
I don’t mean to sound controversial, but I always ask, “Who benefits?” With no corroborated proof- it almost makes me wonder if someone is trying to manipulate SM’s stock price?
To be clear- I am not following every detail of this... it just seems to me that this sounds like a ”Rinse & Repeat” of the first round when the stock plummeted. (In other words- why in the heck is this back in the news??)
To be clear- I am not following every detail of this... it just seems to me that this sounds like a ”Rinse & Repeat” of the first round when the stock plummeted. (In other words- why in the heck is this back in the news??)
C'mon - there was an animated GIF and everything! Bill Gates isn't just injecting microchips in to everyone at the behest of pizza-eating Illuminati - he's injecting miniature chinese spies as well! :flail:
Are you now, or have you ever, used any bits that were once used on a Supermicro motherboard?
I am security paranoid, so I am more inclined to believe it is true. I think the new article clarified a few things:
1. They stood by their claim that there are chips embedded in the motherboard PCB targeted at certain organisations. This is not as hard to pull off as people think. Just look at any micro SD card. That's a large capacity multi-layer NAND and a controller packaged in plastic of less than 1mm in thickness. All PCBs I've seen in my life are thicker than that.
And you don't really need that much chip area to introduce a backdoor into what sounded like the BMC in the original article. All you need is some kind of device on the SPI bus to return a slightly modified BMC ROM after the image signature has been verified (if implemented). This will only require local modification of the PCB (SPI only uses 4 wires and does not have to be impedance/latency matched, etc).
With the spying budget of the second-largest economy in the world and considering the potential reward, I think any sane person in the spying community who have thought of this idea would be crazy to not put it into practice.
2. There are a lot more examples of software exploits, which is perhaps old news to the security community. People have been asking for open source BIOS for years. The problem is the entire X86 ecosystem, including Intel's Secure Boot implementation, implicitly trusts (certain regions of) the BIOS even though BIOS modding and viruses has been around since the 90s.
I guess what's new is this is an insider job, so it wouldn't matter if you flash the BIOS again after receiving the hardware as the code that jumps to the backdoor is in the official release as well.
3. The Bloomberg article and articles linking to that (like this one from well-respected security researcher Bruce Schneier) are now censored in China. Bruce also confirmed he heard similar tales from DoD.
1. They stood by their claim that there are chips embedded in the motherboard PCB targeted at certain organisations. This is not as hard to pull off as people think. Just look at any micro SD card. That's a large capacity multi-layer NAND and a controller packaged in plastic of less than 1mm in thickness. All PCBs I've seen in my life are thicker than that.
And you don't really need that much chip area to introduce a backdoor into what sounded like the BMC in the original article. All you need is some kind of device on the SPI bus to return a slightly modified BMC ROM after the image signature has been verified (if implemented). This will only require local modification of the PCB (SPI only uses 4 wires and does not have to be impedance/latency matched, etc).
With the spying budget of the second-largest economy in the world and considering the potential reward, I think any sane person in the spying community who have thought of this idea would be crazy to not put it into practice.
2. There are a lot more examples of software exploits, which is perhaps old news to the security community. People have been asking for open source BIOS for years. The problem is the entire X86 ecosystem, including Intel's Secure Boot implementation, implicitly trusts (certain regions of) the BIOS even though BIOS modding and viruses has been around since the 90s.
I guess what's new is this is an insider job, so it wouldn't matter if you flash the BIOS again after receiving the hardware as the code that jumps to the backdoor is in the official release as well.
3. The Bloomberg article and articles linking to that (like this one from well-respected security researcher Bruce Schneier) are now censored in China. Bruce also confirmed he heard similar tales from DoD.
I don't think anyone here will deny that such a thing is impossible - far from it, as you say it's relatively easy to conceal a fair amount of 'ware in to a relatively tiny area. Supply chain attacks are hard, but certainly not impossible as we've been seeing more and more.
But the refutations from people using this hardware who've been able to find anything of the sort themselves. Sure, absence of evidence isn't evidence of absence, but I've still yet to see any evidence at all from the Bloomberg sources so to my mind they're firmly in the scaremongering end of the paranoia spectrum at the moment.
There's far easier ways to compromise the security on the BMCs and backdoors in the software itself would be an ideal place to start.
I guess this is an ongoing investigation or the US is already engaged in equally dirty counter-measures, so they cannot officially disclose what they know. I wouldn't be surprised if the NSA learned a trick or two and is actively using it against other counties.
As for the average Joe (not) finding proof, I think 99.9999995%
P) of the users/companies who have received a compromised board have no technical capability to identify such a chip. Even if they just did a surface mount, instead of the chip sandwiched in PCB, when was the last time anyone tried to identify every component on their motherboard? Even fewer people have the capability to X-ray stuff.Similarly, no one would expect those companies who have been issued FISA orders to break the law just to admit they have been hacked... Most of the companies with technical resources to discover this are perhaps already involved.
The US has been caught doing supply chain hacks several times already, so that's not new news. Stuxnet is probably the most famous example.
And I wasn't talking about average Joes not finding hidden spyware chips - several tech companies were involved last time (including Apple and Amazon who most definitely do have the resources to disassemble and X-ray a motherboard or two), none of whom found any evidence and vociferously denied Bloomberg's evidence-free accusations.
StH's original coverage is still very much worth a read, here's an example of a rebuttal from one of the researchers Bloomberg cited:
Following on from the recent GameStop furore, it'd be interesting to see if there were any large short positions on SM before the renewed (and, as far as I can tell, still evidence-free) accusations were made.
And I wasn't talking about average Joes not finding hidden spyware chips - several tech companies were involved last time (including Apple and Amazon who most definitely do have the resources to disassemble and X-ray a motherboard or two), none of whom found any evidence and vociferously denied Bloomberg's evidence-free accusations.
StH's original coverage is still very much worth a read, here's an example of a rebuttal from one of the researchers Bloomberg cited:
Following on from the recent GameStop furore, it'd be interesting to see if there were any large short positions on SM before the renewed (and, as far as I can tell, still evidence-free) accusations were made.