Bloomberg Reports China Infiltrated the Supermicro Supply Chain We Investigate

Discussion in 'STH Main Site Posts' started by Patrick Kennedy, Oct 4, 2018.

  1. zack123

    zack123 New Member

    Joined:
    Jan 3, 2016
    Messages:
    9
    Likes Received:
    1
    Well, Apple's statement does not confirm an attack at all, it specifically says the malware on the server was an accident.

     
    #21
  2. wildpig1234

    wildpig1234 Well-Known Member

    Joined:
    Aug 22, 2016
    Messages:
    1,620
    Likes Received:
    191
    instead of buying their MB, i just bought a few shares....might as well....lol, the shares are a lot cheaper than the MB...
     
    #22
  3. Robert Fontaine

    Robert Fontaine Active Member

    Joined:
    Jan 9, 2018
    Messages:
    113
    Likes Received:
    26
    I wonder if Bloomberg is going to get hit with libel on this one. Hard to imagine they don't have double sourced facts for an allegation like this.
     
    #23
  4. zir_blazer

    zir_blazer Active Member

    Joined:
    Dec 5, 2016
    Messages:
    216
    Likes Received:
    64
    Wasn't there an article posted a few years ago about how it was possible to add an extra layer onto chips with an embedded trojan during manufacturing? I can't find the article, but it was related to IBM. Basically, unless you have full control of the entire manufacturing process, you can't be sure if someone didn't tampered with your chips. So if AMD or IBM needs to use a third party foundry that has been compromised (Or if they have a rogue employee), they could potentially slighty modify the chip to add some form of advanced backdoor.

    I always find amusing that some hardcore open source advocates badmouths AMD or Intel as if they could intentionally be hiding backdoors in microcode because it is propietary, yet they don't ask for the Processor full Verilog schematics and a mean to audit the manufacturing process, heh.
     
    #24
  5. Robert Fontaine

    Robert Fontaine Active Member

    Joined:
    Jan 9, 2018
    Messages:
    113
    Likes Received:
    26
    There were a couple of 3 letter agencies in the U.S. that were grabbing shipments in transit and doing neat things to bug it a while back. Another company's support software gave them access to all the things remotely. Management Interfaces (lmfao) - don't put them on the network. The number of back doors caused as the result of developer, marketing, corporate management tools is almost uncountable. It is almost impossible to stop the mfr, operating system vendor or anyone with physical or network access to the machine... lol... did I miss anyone? I'm not very smart but if you give me a screwdriver and 15 minutes I can fix most things. Occasionally the customers make it tougher than that but usually I can get them back into their machines no matter how hard they thought they locked them down.
     
    #25
  6. Dawg10

    Dawg10 Associate

    Joined:
    Dec 24, 2016
    Messages:
    203
    Likes Received:
    98
    #26
    eva2000 likes this.
  7. Patrick

    Patrick Administrator
    Staff Member

    Joined:
    Dec 21, 2010
    Messages:
    11,543
    Likes Received:
    4,467
    #27
    eva2000 and Dawg10 like this.
  8. Dawg10

    Dawg10 Associate

    Joined:
    Dec 24, 2016
    Messages:
    203
    Likes Received:
    98
    :) Following...
     
    #28
  9. Robert Fontaine

    Robert Fontaine Active Member

    Joined:
    Jan 9, 2018
    Messages:
    113
    Likes Received:
    26
    Not quite as cool as the NSA's hard drive firmware hack or as targeted as the US/Israeli attack on Iranian centrifuges but this is fun nonetheless. The whole supply chain issue is a very big deal but practically there is very little anyone can afford to do about it. Against advanced persistent threats (attribute them as you like) we are mostly powerless. The cost of defense and in-sourcing is simply too high for folk to incur. That the NSA is moving onto AWS makes this apparent. That monster hold everything data center they built in Utah turns out to be not big enough.
     
    #29
    fohdeesha likes this.
  10. Robert Fontaine

    Robert Fontaine Active Member

    Joined:
    Jan 9, 2018
    Messages:
    113
    Likes Received:
    26
    [​IMG]

    Someone Identified the chip in the picture in the bloomberg story as DPX202500DT-9032A1 : Detailed Information | RF Components and Modules - Diplexers | TDK Product Center Unable to confirm.

    Read the Bloomberg articles twice. It is amazing how many words you can write and be entirely fact free. Over 30 companies but they can only name amazon, elemental, apple and supermicro? chips that look like x... but no pictures, drawings or otherwise. It's like a big gray pudding carefully avoiding specifics. A year of careful analysis to report vague statements of a conspiracy? Apples denial was a hell of a lot more clear than Bloomberg's vague accusations. How can it take a year to release a report so vague as to have no identifiably confirmable facts.

    Show me a motherboard, a schematic, a chip.... Give me a voice altered voiceover of an actual interview with an engineer describing the specifics. I want to believe but this "report" leaves me doubting Bloomberg's honesty. Nothing in all those words appears to be verifiable. I simply do not believe that there is no individual willing to step forward and say... Look at the motherboard here, here and here. It's bugged. Have a nice day.
     
    #30
    Last edited: Oct 5, 2018
    eva2000 likes this.
  11. markpower28

    markpower28 Active Member

    Joined:
    Apr 9, 2013
    Messages:
    393
    Likes Received:
    98
    Good stuff, TDK is the maker. Now we have Japanese involved
     
    #31
  12. markpower28

    markpower28 Active Member

    Joined:
    Apr 9, 2013
    Messages:
    393
    Likes Received:
    98
  13. Robert Fontaine

    Robert Fontaine Active Member

    Joined:
    Jan 9, 2018
    Messages:
    113
    Likes Received:
    26
    #33
  14. MiniKnight

    MiniKnight Well-Known Member

    Joined:
    Mar 30, 2012
    Messages:
    2,941
    Likes Received:
    857
    I agree. If they had such detailed knowledge, how didn't they have an actual photo? The one atop the pencil looks different than that one.
     
    #34
  15. i386

    i386 Well-Known Member

    Joined:
    Mar 18, 2016
    Messages:
    1,665
    Likes Received:
    400
  16. MiniKnight

    MiniKnight Well-Known Member

    Joined:
    Mar 30, 2012
    Messages:
    2,941
    Likes Received:
    857
    #36
  17. Joel

    Joel Active Member

    Joined:
    Jan 30, 2015
    Messages:
    807
    Likes Received:
    155
    Looking more and more like a hit job (just like something else that's all over the news right now). I agree with Patrick that the SEC should get involved...
     
    #37
  18. Dawg10

    Dawg10 Associate

    Joined:
    Dec 24, 2016
    Messages:
    203
    Likes Received:
    98
    #38
  19. fohdeesha

    fohdeesha Kaini Industries

    Joined:
    Nov 20, 2016
    Messages:
    1,341
    Likes Received:
    1,079
    As soon as I saw this was done with an "extra hidden chip", alarm bells started going off in my head. This can easily be done using the existing hardware - Adam Nielsen and I did *exactly* this with iDRAC using nothing but the existing EMMC flash / network stack / etc. That's how easy this is with physical access for 5 minutes and zero root of trust / sig checking on the BMC (which SM does not have). Just dump it to the non-volatile user config EMMC partition as well and magic, it now survives firmware updates as well. If Dell was not even checking these partitions for additions, you can bet your whole lab SM isn't either

    There's zero reason to risk detection and complicate the process with an "extra hidden chip" (notice how vague all these reports have been, including the picture of a totally unrelated RF part)

    I'd put money on someone at bloomberg being in a world of hurt soon
     
    #39
    BlackHole, arglebargle and Rain like this.
  20. arglebargle

    arglebargle H̸̖̅ȩ̸̐l̷̦͋l̴̰̈ỏ̶̱ ̸̢͋W̵͖̌ò̴͚r̴͇̀l̵̼͗d̷͕̈

    Joined:
    Jul 15, 2018
    Messages:
    634
    Likes Received:
    207
    Man, if I had money to throw at stock you can bet I'd have been buying SuperMicro on the 4th as the stock cratered.
     
    #40
    fohdeesha likes this.
Similar Threads: Bloomberg Reports
Forum Title Date
STH Main Site Posts Investigating Implausible Bloomberg Supermicro Stories Oct 22, 2018
STH Main Site Posts Yossi Appleboum Disagrees with How Bloomberg is Positioning His Research Against Supermicro Oct 9, 2018

Share This Page