The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple • Hacker News Board

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#281

Post by ryandrake » Thu, Oct 04, 2018, 2:25 PM UTC

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

Could this be solved by a clause in the contract that specified if any randomly sampled devices came tampered with, the manufacturer did not get paid?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#282

Post by andrewflnr » Thu, Oct 04, 2018, 2:25 PM UTC

Recurecur wrote: post #167

Narkov wrote: post #37

Earlier quoted context omitted.

Intrusion Detection Systems are basic network security 101 type stuff. I'd be surprised if anything that was really "high risk" didn't use an IDS.

Intrusion detection involves connections coming from the outside. These attacks originate inside the network, from the compromised equipment. Except on extremely controlled networks, this would be very hard to detect. It gets even worse when you consider that the Chinese had/have a distributed network of compromised machines. Imagine using a Google edge server as a dead drop...

An IDS is perfectly capable of flagging outgoing or internal traffic.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#283

Post by SheinhardtWigCo » Thu, Oct 04, 2018, 2:27 PM UTC

octosphere wrote: post #276

Just as a sidenote: X-raying PCBs and then diffing them against clean PCBs is a worthwhile thing to do if you're concerned about hardware backdoors, or 'interdiction' of hardware in a supply chain. I do this sometimes when ordering super-critical equipment like Thinkpads from the U.S as you never know what lurks on the motherboard (keyloggers, etc). I have a clean Thinkpad that I use to compare against potential back…

How do you know that your clean Thinkpad is clean?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#284

Post by hatergonnahate » Thu, Oct 04, 2018, 2:32 PM UTC

m_mueller wrote: post #211

baybal2 wrote: post #139

Earlier quoted context omitted.

America has fabs, both old and leading edge, but ask industry giants like Gemalto to even bother to manufacture chips anywhere outside of Taiwan, assemble the final product outside of China. They will never do that, because they look for the cheapest solution. The bigger the company, the less it cares about things other than cost. This is why Mediatek and Broadcom can usurp the market of network SoCs, while making pr…

What about Japan? I know they've lost most of their semiconductor business as well, but they still have some capacity no?

Japan was ruined mostly because of population problem years ago and (very) slowly recovering. I've saw a TV drama in 2016 (http://www.ntv.co.jp/english/pc/2016/04/were-millennials-got...) basically describing what the younger generation is still struggling.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#285

Post by lmilcin » Thu, Oct 04, 2018, 2:33 PM UTC

mercer wrote: post #266

lmilcin wrote: post #157

Earlier quoted context omitted.

The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.

I'd very much love to hear more stories if you have any!

We had MasterCard end-to-end test auditor on site. This is the first time ever you get to do a transaction with real transaction system with real credit card.

Due to requirements we opted to have the only large meeting room to have outside our secure zone. This created an issue as we had no network access from there and in the end we decided to use slow GPRS terminal for the test.

The end-to-end test starts with offline transactions which by their very nature are quite fast (it is negotiated between terminal and card).

But then we went to online transaction and it finished instantly too.

The auditor, bewildered, proclaimed the test failed as he assumed it was incorrectly processed offline instead of going online. But then I pointed out to the printout to show ARQC (basically says it was certified online).

Now, the real discussion started. The terminal was very slow taking quite few seconds to establish GPRS and then even more for the SSL handshake so the auditor said it was not possible to make it work.

How it worked was that I have completely gutted OpenSSL and had entire cryptographic state stored locally (safely, using internal HSM) so the SSL session could be optimistically re-established without another handshake even after TCP connection was closed. The first message the terminal sends is already encrypted transaction message, there is no SSL handshake. I wrote an application to terminate the connection in our data center so that it stored the states of each connection in the database. The entire handshake was only done if the first message could not be decrypted successfully.

The operating system was single-threaded with no multitasking of any kind. This meant that all applications on this device did their operations sequentially. Send network message, print something, display something, etc.

I wrote a cooperative multitasking functionality into the application (using coroutines) so that it could work on multiple tasks at the same time (like talking to network and printing).

I then have segregated all data on the printouts so that it can start printing without having to already have response from network. Hopefully if everything went right, the response would come before it even came to that place on the printout effectively looking as if it was done in zero time.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#286

Post by dustinmoorenet » Thu, Oct 04, 2018, 2:34 PM UTC

We need open source hardware designs that can be built locally (where ever your local might be). This black box hardware crap has to stop. Smart people who know how all this works need to dump all their knowledge in to a design and a process. Trade secrets are keeping us not only limited in choices but exposed to bad actors who can control a link in the supply chain.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#287

Post by jeremy7600 » Thu, Oct 04, 2018, 2:35 PM UTC

DarkWiiPlayer wrote: post #89

ryanmarsh wrote: post #48

Earlier quoted context omitted.

I take a different view of this. Some 30 companies got this hardware, two are named as having the resources to find the offending hardware. By this logic you’re still safer using a company such as Amazon.

My point is that you should care about privacy, even if you're using, for example, apple services. Thinking that nobody has the resources to hack a company that big isn't an argument and has just been disproven. In other words, if you have plans to ever be a politician that china may not want in any position of power, don't store your nudes on icloud/dropbox/google drive, or they may suddenly get leaked when you leas…

Disproven on speculation?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#288

Post by hef19898 » Thu, Oct 04, 2018, 2:36 PM UTC

I am sincerly impressed by the amount of supply chain analysis and operative supply chain management that went into that hack. And once the Chinese identified a distribution node in that particular supply chain, supermicro, they opted for a brute force attack by seeding these backdoor chips into supermicros servers and wating where they ended up. That was one hell of a hack.

It also gives you pause. Did that happen only once? For how long? Where esle did these chips and servers end up in the end?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#289

Post by village-idiot » Thu, Oct 04, 2018, 2:36 PM UTC

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

At what point does it get cheaper to buy from sources that are more expensive but more trustworthy?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#290

Post by contingencies » Thu, Oct 04, 2018, 2:37 PM UTC

RL_Quine wrote: post #12

ThePhysicist wrote: post #3

Is there an article that describes a bit more in detail what the chips actually did (or were capable of doing)? They only say "the microchip altered the operating system’s core so it could accept modifications.", which I might interpret as circumventing signature checks to allow installing modified firmware on the systems? But how does the chip connect to the network and how does it receive commands? That said, it's…

SuperMicro hardware has very extensive IPMI integration into the mothebroard, which amongst other things can take over and inject frames into the network interface, emulate a VGA device, talk to the CPUs serial lines directly, flash firmware, control the state of a number of physical devices- and this is what it supports just from the web interface it presents by default with the password "ADMIN:ADMIN". My money, bas…

The problem with an IPMI BMC is that if you have malware that roots the OS from the BMC that in turn roots the BMC to reinstall itself from the OS, then you can never actually get rid of it. I actually opened a bug with a major clustering vendor in about 2012 because of this. Their response was a docfix.