The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple • Hacker News Board

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#661

Post by parliament32 » Thu, Oct 04, 2018, 7:50 PM UTC

bhauer wrote: post #312

As someone who has used a few SuperMicro boards in custom builds, I would like to know which motherboard models have been affected. It's not clear to me from the article whether that is even known at this time. I'd also like to know of a recommended work-around. I have always had IPMI "disabled" as much as I can; assigned a non-routable IP address in the BIOS in case it flips to a failsafe mode by piggybacking on the…

Technically BMC is the hardware and IPMI is the software, but yes they're the same thing.

It's good to change the network port settings to "dedicated" so it doesn't failover... but if it was malicious, and it clearly has the ability to piggyback on your production interface, why wouldn't it? There's honestly no way to secure this without cutting off your hardware from the internet completely (or firewalling it off similarly).

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#662

Post by housingpost » Thu, Oct 04, 2018, 7:52 PM UTC

Looks like SuperMicro was delisted by Nasdaq just over a month ago. Wonder if it has anything to do with this under their pretty poor surface excuses for not being in compliance.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#663

Post by pixl97 » Thu, Oct 04, 2018, 7:53 PM UTC

PurpleBoxDragon wrote: post #641

whydoineedthis wrote: post #615

Earlier quoted context omitted.

OMG, that is so so so so brilliant! I'm going to go tell my boss right now that the suppliers better suite up, otherwise we are going right to their more expensive, less experienced vendor and will delay our product launch for a year....and likely still suffer the same problem. Those Chinese vendors better shape up or we're going to really teach them a lesson by driving ourself out of business right quick!

Just imagine for a second if someone was advocating on HN for the use of a web framework that has knowingly allowed itself to be compromised to steal passwords because it was cheaper to use. How about a compromise? If any of your customers are a victim of a crime because you continued to use a shady but cheap vendor after seeing them trying to slip past tampered hardware, your company is held fiscally and criminally…

So no more using Intel?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#664

Post by lmilcin » Thu, Oct 04, 2018, 7:54 PM UTC

hinkley wrote: post #464

lmilcin wrote: post #427

Earlier quoted context omitted.

There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company. The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assu…

This still sounds nuts to me. Two thoughts: > they typically will not be thinking they are doing anything wrong. They are just testing if you notice and if you do not they will say it makes no difference for you but saves them costs. This is how children behave. Still feels like you’re rewarding bad behavior. You’re enabling them. I think it’s more that you’ve valued the low per unit price over having a healthy contr…

It is called business. The company's ONLY duty is to bring profit to its investors and management is legally bound to maximise it. Now, the definition of profit may differ as well as what is profitable and what is not, but the company is legally obligated to work to bring profit and if you throw a good deal because you don't like it you better explain it to your investors.

Whether you like what your supplier does or does not is of no concern. If couple of units can be detected and written off it is treated as cost and you move on to decide if it is still profitable and whether you can get better deal somewhere else.

You let you emotions rule and it just means you are not fit for the job.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#665

Post by 8note » Thu, Oct 04, 2018, 7:55 PM UTC

stopsayingthat wrote: post #522

lmilcin wrote: post #157

Earlier quoted context omitted.

The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.

The fact that you keep referring to moment of inertia as "angular momentums" make me doubt that your story is true.

how would you measure the moment of inertia though? probably by checking your changes in angular momentum when applying a moment

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#666

Post by Ericson2314 » Thu, Oct 04, 2018, 7:56 PM UTC

whydoineedthis wrote: post #612

phendrenad2 wrote: post #481

Earlier quoted context omitted.

All employee actions are company actions. You partnered with a company that can’t control what it’s employees do? No internal audits to make sure their reputation wasn’t being tarnished by a few employees?! Your loss.

lol. you haven't worked with a vendor in China before, have you?

But make no mistake, this yet another globalized race to the bottom, but one that hits capital (or the end consumer), rather than labor or the environment.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#667

Post by techntoke » Thu, Oct 04, 2018, 7:58 PM UTC

enraged_camel wrote: post #370

techntoke wrote: post #354

Earlier quoted context omitted.

Can you quote a single source from that article, or is it all anonymous?

That is also in the article... "17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."

So not a single source. Might as well be going to war over invisible weapons of mass destruction. Also, Apple and Amazon both has said they do not agree with these claims. So far this is nothing more than propaganda.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#668

Post by a1369209993 » Thu, Oct 04, 2018, 7:58 PM UTC

close04 wrote: post #257

jnbiche wrote: post #201

Earlier quoted context omitted.

> They get wiped, X-rayed, disassembled and checked, including any accessory (chargers, mice, etc.). Given how sophisticated these attacks can be, I'd think they'd issue disposable equipment to be destroyed on return, like a cheap netbook or something. I don't see how you could trust an individual viewing a simple X-ray scan to detect some extra microchip the size of a signal conditioning coupler.

Procedures change, as attacks get more sophisticated the next step could be disposable devices. But an attack like the one described in this article won't be mitigated by having a disposable device. On the other hand having your laptop "hijacked" while on a business trip will most likely involve some extra PCB or components that are a little more obvious that something that's "built in". Then again many companies or…

The obvious solution would be to earmark some number of dedicated "china laptops" that will never be trusted with anything important, and get reused everytime someone has to visit China. If they get backdoored... who cares? They can only spy on things that were getting spyed on anyway due to being in China.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#669

Post by Atlas26 » Thu, Oct 04, 2018, 7:59 PM UTC

odorousrex wrote: post #590

teddyfrozevelt wrote: post #363

Earlier quoted context omitted.

Apple is very strongly denying it as well https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...

What is more telling for me is that Apple has cut off all contracts with the company involved and will have nothing more to do with them - despite their denial.

They cut off contact for a separate reason - 2000 (IIRC) supermicro boards which did have issues.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#670

Post by 8note » Thu, Oct 04, 2018, 8:00 PM UTC

kumarvvr wrote: post #414

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

This reminds me of a story about, IIRC, Soviet intelligence personnel determining that a photocopy machine at their consulate in the USA was bugged by the CIA by measuring it's weight and comparing that value to the standard value published by Xerox. Modern times, but same old methods of "debugging" The angular momentum stuff is innovative though.

is measuring the moment of inertia not standard? I think any mechanical engineer would suggest it for that kind of problem (disclaimer; I've suggested it before for the same problem)