The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

Post by Eriksrocks » Fri, Oct 05, 2018, 5:20 AM UTC

pjc50 wrote: post #433

baybal2 wrote: post #338

Earlier quoted context omitted.

An update on that theory: AST2400 has option for two SPI memories, one main, one "recovery." https://download.csdn.net/download/duanzhang512/10385038 The recovery overrides the primary if detected by default. The place they put their "filter cap" is right on top the empty TSOP8 pad for the recovery flash. And they probably ordered the factory to sneak the traces just a little bit more, or put hidden vias under it, or…

This is the most plausible theory I've read in this thread. Assuming the image in the article is a stock image (there isn't yet a clear image of a definitely compromised board), then the added part could simply be another TSOP8 Flash part. This implies the firmware to the AST2400 is unsigned (which it appears to be, as there's coreboot options for it). That makes the whole thing gloriously simple. A part "stuck on" a…

Post by Eriksrocks » Fri, Oct 05, 2018, 5:41 AM UTC

baybal2 wrote: post #338

baybal2 wrote: post #97

Earlier quoted context omitted.

I looked up supermicro blade motherboards, and saw that the chip was right near the IPMI chip's line to spi flash. And prior to that, there were already persistent rumors in the Chinese interney of certain Chinese mobos sending "weird garbage on ICMP," and "BMCs that somehow boot and work with their flash memory soldered off" Remembering that, I might even suggest that this is not a modchip that does something with s…

An update on that theory: AST2400 has option for two SPI memories, one main, one "recovery." https://download.csdn.net/download/duanzhang512/10385038 The recovery overrides the primary if detected by default. The place they put their "filter cap" is right on top the empty TSOP8 pad for the recovery flash. And they probably ordered the factory to sneak the traces just a little bit more, or put hidden vias under it, or…

Post by lenkite » Fri, Oct 05, 2018, 6:01 AM UTC

orochi235 wrote: post #660

whydoineedthis wrote: post #615

Earlier quoted context omitted.

OMG, that is so so so so brilliant! I'm going to go tell my boss right now that the suppliers better suite up, otherwise we are going right to their more expensive, less experienced vendor and will delay our product launch for a year....and likely still suffer the same problem. Those Chinese vendors better shape up or we're going to really teach them a lesson by driving ourself out of business right quick!

You can be as sarcastic as you want, but these stories are absolutely indicative of a much larger problem. It might be beyond the capacity of one company to fix, but in the aggregate they represent a serious political and economic threat and need to be dealt with one way or another. Preferably by literally anyone other than Donald Trump.

Post by acct1771 » Fri, Oct 05, 2018, 6:31 AM UTC

glbrew wrote: post #635

ocdtrekkie wrote: post #543

Earlier quoted context omitted.

There's definitely something afoot. Bloomberg probably wouldn't have gone forward with just an in-depth piece referencing so many major tech companies unless it had substance. But generally even when legally compelled, companies tend to prefer silence or curt denials over lengthy detailed contrary pieces. Is there a federal investigation going on into some sort of sabotage by the Chinese government? Possibly, and if…

I think it is a win-win for Apple and Amazon to spin it this way. They get to deny that they were compromised, and if that gets disproved they can easily say they were cooperating with national security operations and get away without any damage.

Post by acct1771 » Fri, Oct 05, 2018, 6:35 AM UTC

dullroar wrote: post #452

bootsz wrote: post #272

Earlier quoted context omitted.

The more I understand software the less I trust it (given the current state of engineering practices). Meanwhile all my friends/family are scrambling to install all the latest new "smart home" gadgets and I just look like a paranoid kook trying to talk them out of it.

This. I've even had an in-law say, "My brother works for the Defense Intelligence Agency, and he uses smart devices in his home, so they must be safe!", with no consideration that tech may not be his specialty, or he doesn't follow the daily IoT fiascos, or maybe he just thinks he won't get hacked. Dunno. Meanwhile, my year-old thermostat still wants me to connect it to wi-fi, and that will never happen.