The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

Post by contingencies » Thu, Oct 04, 2018, 3:11 PM UTC

baybal2 wrote: post #251

dogma1138 wrote: post #232

Earlier quoted context omitted.

That's not correct the QSA will validate that the device does not store PIN codes or the that the merchant does not store anything they are not allowed. Devices that accept cards need to comply with PED/PTS security requirements including very strict physical security requirements which are validated by PCI council approved laboratories and firms. You are not getting a device on the market or usable with any merchane…

About that, I can only say that Chinese android POSes do everything in software, for sure, without any hsm present. The question is, how Chinese banks coax Visa into allowing them using them.

Post by creeble » Thu, Oct 04, 2018, 3:13 PM UTC

jandrese wrote: post #307

jtbayly wrote: post #305

This seems either incredibly suspicious to me or indicates that Apple is way more protective of security and distrustful of the USGov than I would have thought: “Because Apple didn’t, according to a U.S. official, provide government investigators with access to its facilities or the tampered hardware, the extent of the attack there remained outside their view.” Why wouldn’t the FBI be able to compel Apple to turn ove…

Apple seems cagey about its reputation with the Chinese government. Their balls are directly in the Chinese government's hands, they don't want to do anything that might make the government upset. Beyond having their manufacturing there, it's also the biggest untapped market in the world.

Post by MrEfficiency » Thu, Oct 04, 2018, 3:14 PM UTC

dustinmoorenet wrote: post #286

We need open source hardware designs that can be built locally (where ever your local might be). This black box hardware crap has to stop. Smart people who know how all this works need to dump all their knowledge in to a design and a process. Trade secrets are keeping us not only limited in choices but exposed to bad actors who can control a link in the supply chain.

Post by baybal2 » Thu, Oct 04, 2018, 3:17 PM UTC

baybal2 wrote: post #97

ThePhysicist wrote: post #93

Earlier quoted context omitted.

That would make a lot of sense and would give the attacker a way to interface with all of the other hardware (network, disk etc.). Do you have a source for this information?

I looked up supermicro blade motherboards, and saw that the chip was right near the IPMI chip's line to spi flash. And prior to that, there were already persistent rumors in the Chinese interney of certain Chinese mobos sending "weird garbage on ICMP," and "BMCs that somehow boot and work with their flash memory soldered off" Remembering that, I might even suggest that this is not a modchip that does something with s…

Post by syn0byte » Thu, Oct 04, 2018, 3:18 PM UTC

lmilcin wrote: post #275

datavirtue wrote: post #226

Earlier quoted context omitted.

Worked in the payment industry for years. Visa/Mastercard do absolutely nothing to verify that companies are not storing Pin codes. The HSM is required for communication with them only.

That's not correct. HSMs are required so that the company does not need to have PIN codes exposed anywhere. Not having PINs or full credit card data makes your life easier as there is nothing to steal from you in the first place. If your company stored PIN codes it means you were in breach of the contract and it had to lie to the auditors to pass the certification.