Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

bloomberg.com

Post reply on HN
Print view View original

421–430 of 818 posts

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#421

Post by bravo22 »

awayenberg wrote: post #64

So the chip shown in the article looks like a typical SMD balun, it is a type of transformer used to adapt impedance between two transmission line. It’s designed to replace a series a lumped element (capacitor, inductors, resistors) normally used for impedance adaptation (in a T or Pi network). The most common used for the device is directly between an antenna an a RF front-end to serve as an antenna tuner. Technical…

It does look like a balun which is clever but based on the pinout I think it is meant to intercept SPI flash and patch it as needed.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#422

Post by jki275 »

contingencies wrote: post #317
RL_Quine wrote: post #30

Earlier quoted context omitted.

I've worked on systems deployed in the financial sector in high risk environments. This sort of monitoring doesn't happen in the real world.

It does. I've deployed systems that would not only notify staff when novel packets were observed but immediately isolate anomalous hardware through a combination of powerdown and network fabric reconfiguration.

The amount of false positives a system like that would generate would rapidly render such a system entirely unusable.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#423

Post by chris72205 »

blackrock wrote: post #364

This reminds me of that old story about the Xerox copy machines that the Soviet Union bought. Where each unit was planted with a image recorder. And for years, the American spy agencies had a great laugh, that they were able to intercept all the documents that the Russians made a copy of. Back then, this was an off-network infiltration. Where the copied images, were retrieved during regular servicing intervals by a X…

I had never heard of this...but now I can only imagine how exciting this must have been as one of the engineers-- working on a top secret project for the CIA in an abandoned bowling alley: https://electricalstrategies.com/about/in-the-news/spies-in-...

edit: whoops, looks like amatecha beat me to posting more info

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#424

Post by crunchlibrarian »

fcantournet wrote: post #378
enraged_camel wrote: post #356

Earlier quoted context omitted.

I mean what are they gonna say? "Yes, we have been aware that an unknown but possibly huge number of our servers have been compromised, but decided to keep our customers in the dark"?

Your point being ?

I think the point is that actual honesty from these megacorps would be so surprising that even raising the possibility of it happening is so absurd it feels like parody writing.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#425

Post by forapurpose »

Eridrus wrote: post #279
vezycash wrote: post #82

Earlier quoted context omitted.

You're right. One question though. Would a politically correct, by-the-book US president have had the balls to sanction China? Considering such sanctions could affect the US economy.

> Would a politically correct, by-the-book US president have had the balls to sanction China? Does Trump even have a goal in mind with his tariffs? It seems like he just wants to score political points, rather than achieve any actual outcomes.

The goal, explicitly stated and often acted on in many contexts, is to disrupt international order and cooperation (including trade), and promote nationalistic competition by all countries. Recently his UN speech, for example, advocated it.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#426

Post by joshgel »

zjfroot wrote: post #113

Statements from Amazon, Apple, Supermicro and Chinese government. https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... From Apple: "Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we h…

I mean: > The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#427

Post by lmilcin »

zelon88 wrote: post #406
lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company.

The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assuming the company was involved which they could not have been as they have been the ones damaged the most).

If the company does screw you (like replacing components for something cheaper) they typically will not be thinking they are doing anything wrong. They are just testing if you notice and if you do not they will say it makes no difference for you but saves them costs.

The way to work is then verify everything and politely point it out. If you notice they will correct apparent mistake.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#428

Post by clubm8 »

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

>measuring angular momentum on a special fixture

Can you elaborate on this concept a bit? I'm not familiar with this term and the sources I looked up were pretty physics-y and out of my depth.

This sounds like a very interesting and creative solution. Good lateral thinking on your part! :)

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#429

Post by abecedarius »

jiveturkey wrote: post #398
awayenberg wrote: post #64

So the chip shown in the article looks like a typical SMD balun, it is a type of transformer used to adapt impedance between two transmission line. It’s designed to replace a series a lumped element (capacitor, inductors, resistors) normally used for impedance adaptation (in a T or Pi network). The most common used for the device is directly between an antenna an a RF front-end to serve as an antenna tuner. Technical…

you would be extremely hard pressed to fit that amount of logic (and code) into that small of a package. and to operate intelligently, as you suggest, it needs a CPU clock, not available to it from where it would sit. And it would need to do signal analysis in real time, with no power and no clock. it's not possible.

Clockless CPUs exist.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#430

Post by BurningFrog »

zelon88 wrote: post #406
lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

This is also such a good anonymous story that I'd give decent odds it's made up.
Post reply on HN