The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple • Hacker News Board

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#151

Post by TazeTSchnitzel » Thu, Oct 04, 2018, 11:51 AM UTC

Dowwie wrote: post #83

This story could easily be interpreted as anti-China propaganda. Could you think of any other sovereign power who would want a backdoor into servers used by billions of people across the internet? Hardware comes from China. This doesn't mean that the Chinese government orchestrated the attack. The United States government is having a trade war with China. This article's publication isn't just coincidence. Further, th…

> Could you think of any other sovereign power who would want a backdoor into servers used by billions of people across the internet?

The US's NSA would want and probably does have such a thing.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#152

Post by C1sc0cat » Thu, Oct 04, 2018, 11:52 AM UTC

07d046 wrote: post #87

awayenberg wrote: post #64

So the chip shown in the article looks like a typical SMD balun, it is a type of transformer used to adapt impedance between two transmission line. It’s designed to replace a series a lumped element (capacitor, inductors, resistors) normally used for impedance adaptation (in a T or Pi network). The most common used for the device is directly between an antenna an a RF front-end to serve as an antenna tuner. Technical…

I don't know enough about this, but isn't the article saying that the appearance is deceptive: The chips on Elemental servers were designed to be as inconspicuous as possible, according to one person who saw a detailed report prepared for Amazon by its third-party security contractor, as well as a second person who saw digital photos and X-ray images of the chips incorporated into a later report prepared by Amazon’s…

How specialised? ohmmeters inductance capacitance meters are not exactly exotic.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#153

Post by Sidnicious » Thu, Oct 04, 2018, 11:52 AM UTC

RL_Quine wrote: post #42

newsDerp wrote: post #39

Earlier quoted context omitted.

5. When a server was installed and switched on, the microchip altered the operating system’s core so it could accept modifications. The chip could also contact computers controlled by the attackers in search of further instructions and code. So, in typical vulnerability/payload/exploit fashion, the board's bus is vulnerable by default, because the chip pierces all the usual lines of defense protecting against network…

It's not particularly magical, there's consumer chips around which are not a whole lot bigger (though obviously in a more standard package). You don't get a lot of resources, but you don't really need it if all the other frameworks are in place in other software. If this sort of thing is something you can buy on Mouser for a few cents, the espionage grade material is probably an order or magnitude more higher quality…

For another example, I have a couple of these which are a bit bigger but have an ARM SoC and onboard Bluetooth (with antenna):

https://www.digikey.com/en/product-highlight/t/taiyo-yuden/e...

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#154

Post by ksec » Thu, Oct 04, 2018, 11:53 AM UTC

tomglynch wrote: post #14

blackdogie wrote: post #11

Earlier quoted context omitted.

It was perfect on a mobile device.

Good point. Definitely seems designed for mobile (only).

I know this is going off the main topic. But it is very strange that I discover Black background, as in Dark mode in macOS, doesn't work at all despite what I have always thought it would be cool. But Black background on mobile devices work absolutely great!.

And I have no idea why, I searched on Google and couldn't find any decent answer. All results were either OLED being battery friendly with switched off pixels or other mobile UX for Dark mode. None of them describe the difference felt in Desktop and Mobile. Any link or explanation would be much appreciated.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#155

Post by lmilcin » Thu, Oct 04, 2018, 11:56 AM UTC

jypepin wrote: post #77

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

First, wow this is both incredible and crazy! Both the China-side hacks and your side's anti-hack. Mind. Blown. Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems?

This wasn't our device. There was a big, reputable company behind the device. We were ordering a number of those and they would be shipped to us directly from China.

Also, we were basically locked in due to the magnitude of investment in the software we have developed for the device.

Fortunately this only lasted for few months until it was dealt with. It was quite new back then (a decade ago) and it was a surprise for everybody I guess.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#156

Post by malmsteen » Thu, Oct 04, 2018, 11:58 AM UTC

TazeTSchnitzel wrote: post #138

zjfroot wrote: post #113

Statements from Amazon, Apple, Supermicro and Chinese government. https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... From Apple: "Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we h…

Assuming Bloomberg's story is true, I wonder what reason Apple has to hide. Not wanting to upset relations with the PRC govt?

they have literally every reason to deny and literally no reason to say it's true

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#157

Post by lmilcin » Thu, Oct 04, 2018, 11:58 AM UTC

etatoby wrote: post #140

jypepin wrote: post #77

Earlier quoted context omitted.

First, wow this is both incredible and crazy! Both the China-side hacks and your side's anti-hack. Mind. Blown. Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems?

You are underestimating the FUN of playing anti-anti-^N-hacks. I have had the privilege to be paid to so anti-anti-^N-hacking on a firewall thingy in the past and it was a challenge and a joy!

The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#158

Post by ajpikul » Thu, Oct 04, 2018, 11:59 AM UTC

TazeTSchnitzel wrote: post #138

zjfroot wrote: post #113

Statements from Amazon, Apple, Supermicro and Chinese government. https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... From Apple: "Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we h…

Assuming Bloomberg's story is true, I wonder what reason Apple has to hide. Not wanting to upset relations with the PRC govt?

This article is more or less total bullshit. At _best_ that device might be a mechanism to cause failure intentionally. And there are tons of ways to detect it with commodity technology, and plenty of vendors who implement that technology for assembly manufactures commercially.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#159

Post by lmilcin » Thu, Oct 04, 2018, 12:00 PM UTC

ElBarto wrote: post #80

jypepin wrote: post #77

Earlier quoted context omitted.

First, wow this is both incredible and crazy! Both the China-side hacks and your side's anti-hack. Mind. Blown. Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems?

I think what is described is an issue with process. If the device is sealed with an anti-tampering system then the contents must be checked by a trusted entity before being sealed. Trying to guess the contents of a box that you cannot open sounds a bit like madness.

See, the article showed that even largest companies are not completely immune to the problem. This was decade ago and payment card industry, not exactly national security matters.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#160

Post by nithinm » Thu, Oct 04, 2018, 12:02 PM UTC

Dowwie wrote: post #83

This story could easily be interpreted as anti-China propaganda. Could you think of any other sovereign power who would want a backdoor into servers used by billions of people across the internet? Hardware comes from China. This doesn't mean that the Chinese government orchestrated the attack. The United States government is having a trade war with China. This article's publication isn't just coincidence. Further, th…

your comment looks like an pro-china propaganda. In china the state has heavy control on all the companies. The hardware is manufactured in china. I don't think something like this is happen without the state's knowledge.