Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

bloomberg.com

Post reply on HN
Print view View original

41–50 of 818 posts

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#41

Post by orbifold »

sschueller wrote: post #17

This sounds like something out of a movie. I would like some technical details how this is supposed to work with only a 6 lead chip.

Most likely it is using SPI https://en.wikipedia.org/wiki/Serial_Peripheral_Interface, that requires four pins and the two remaining ones are power and ground. SPI what is used to access EEPROMs and flash memory, so an attack that you can do is daisy chain such a device in the path to the EEPROM the board management controller uses as its firmware storage. Then you can very easily insert your own instructions and get the board management controller to execute whatever you want.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#42

Post by RL_Quine »

newsDerp wrote: post #39
ThePhysicist wrote: post #3

Is there an article that describes a bit more in detail what the chips actually did (or were capable of doing)? They only say "the microchip altered the operating system’s core so it could accept modifications.", which I might interpret as circumventing signature checks to allow installing modified firmware on the systems? But how does the chip connect to the network and how does it receive commands? That said, it's…

5. When a server was installed and switched on, the microchip altered the operating system’s core so it could accept modifications. The chip could also contact computers controlled by the attackers in search of further instructions and code. So, in typical vulnerability/payload/exploit fashion, the board's bus is vulnerable by default, because the chip pierces all the usual lines of defense protecting against network…

It's not particularly magical, there's consumer chips around which are not a whole lot bigger (though obviously in a more standard package). You don't get a lot of resources, but you don't really need it if all the other frameworks are in place in other software. If this sort of thing is something you can buy on Mouser for a few cents, the espionage grade material is probably an order or magnitude more higher quality.

https://www.microchip.com/wwwproducts/en/ATtiny4

For scale, this alone is about the size of a large SMD capacitor and would basically be lost in most designs today.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#43

Post by newsDerp »

RL_Quine wrote: post #42
newsDerp wrote: post #39

Earlier quoted context omitted.

5. When a server was installed and switched on, the microchip altered the operating system’s core so it could accept modifications. The chip could also contact computers controlled by the attackers in search of further instructions and code. So, in typical vulnerability/payload/exploit fashion, the board's bus is vulnerable by default, because the chip pierces all the usual lines of defense protecting against network…

It's not particularly magical, there's consumer chips around which are not a whole lot bigger (though obviously in a more standard package). You don't get a lot of resources, but you don't really need it if all the other frameworks are in place in other software. If this sort of thing is something you can buy on Mouser for a few cents, the espionage grade material is probably an order or magnitude more higher quality…

Figure it's custom silicon, given the nature of the story, and "magic" in the sense of "magic number programming" to time the attack.

https://en.wikipedia.org/wiki/Magic_number_%28programming%29

For example, looking for ELF or Portable Executable headers, as a crude estimate to determine attack opportunities. In this case, the magic numbers would probably be more selective and sophisticated, but still have an aspect of hard-coded values, since we're talking custom silicon.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#44

Post by vezycash »

>Amazon’s security team conducted its own investigation into AWS’s Beijing facilities and found altered motherboards there as well, including more sophisticated designs than they’d previously encountered.

>...the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached

>...that generation of chips was smaller than a sharpened pencil tip, the person says.

I hope this corrects the mistaken believe that China can't home grow sophisticated tech.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#45

Post by ryanmarsh »

My gut feel about this for many years has been outsourcing chip manufacturing to another country is a serious security risk. This was a hardware device, hard to detect as it was, how much code is in the chips we already expect on a motherboard?

It seems flat out foolish for one country to own the world’s computer manufacturing.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#46

Post by kjullien »

It's been a few years I've given up on the idea of privacy with technology. The number of security flaws that get discovered daily is only the tip of the iceberg. I'm pretty sure some governments (or organizations) have had backdoors, be they hardware or software, in place for more than 20 years. We simply don't know about it yet (and probably never will). Would that actually be that far-fetched? I think not sadly. Even the Intel Spectre et Meltdown fiascos are a sign that we have no idea how to actually secure this stuff. And that's normal, the very definition of IT security is that nothing can be secure. Take the whole antiquated concept of processor rings for instance, we are adding a new level every other year now it feels like... I find it way more interesting (even if it is ultimately "worse") to adapt to the mentality that "nothing is secure" than "let's try and make it secure", which as stated is in itself a fallacy...

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#48

Post by ryanmarsh »

DarkWiiPlayer wrote: post #4

I will certainly show this to everybody who tells me "google won't get hacked" when privacy comes up :) Talking about things like this https://news.ycombinator.com/item?id=18074097

I take a different view of this. Some 30 companies got this hardware, two are named as having the resources to find the offending hardware. By this logic you’re still safer using a company such as Amazon.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#49

Post by pjc50 »

newsDerp wrote: post #39
ThePhysicist wrote: post #3

Is there an article that describes a bit more in detail what the chips actually did (or were capable of doing)? They only say "the microchip altered the operating system’s core so it could accept modifications.", which I might interpret as circumventing signature checks to allow installing modified firmware on the systems? But how does the chip connect to the network and how does it receive commands? That said, it's…

5. When a server was installed and switched on, the microchip altered the operating system’s core so it could accept modifications. The chip could also contact computers controlled by the attackers in search of further instructions and code. So, in typical vulnerability/payload/exploit fashion, the board's bus is vulnerable by default, because the chip pierces all the usual lines of defense protecting against network…

This sounds like speculation. I'm quite capable of coming up with my own unfounded speculation, but there is a real report out there with the actual details in that really needs to be made public, legally or otherwise. There ought to be a CVE about this. Where is it?
Post reply on HN