Making sense of the alleged Supermicro motherboard attack
lightbluetouchpaper.org
Making sense of the alleged Supermicro motherboard attack
1–10 of 328 posts
Re: Making sense of the alleged Supermicro motherboard attack
#2It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised.
Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is it possible that SM's QC missed this out on so many boards? Won't it affect things like the power budget, weight, and latency? What do professional EE people here think?
Re: Making sense of the alleged Supermicro motherboard attack
#3It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…
EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant
Re: Making sense of the alleged Supermicro motherboard attack
#4I'm no expert, but wouldn't be more efficient to completely replace the BMC with a malicious one? That way it should be virtually impossible to detect
Re: Making sense of the alleged Supermicro motherboard attack
#5It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…
EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant
If it replaced a DNP part, it could have been found at a flying probe test. Half the expected impedance on a few of those pins?
Also AOI might have picked up a difference.
Re: Making sense of the alleged Supermicro motherboard attack
#6Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls?
Two pieces of the story that don’t add up for me.
Re: Making sense of the alleged Supermicro motherboard attack
#7It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…
EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant
Are you basing this off the photo in the Bloomberg article that shows a small (0402?) SMT package with three terminals?
I wonder if that's an actual photo of the chip in question.
Re: Making sense of the alleged Supermicro motherboard attack
#8It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…
Depends on where it was added. Doing it as part of the assembly process would require having access to the pick and place software along with being able to load reels of the implant into the machine. A well placed insider may be able to make that happen, and automated optical inspections would be fed by the modified pick and place program, so checks would pass as the new component is part of the build.
Re: Making sense of the alleged Supermicro motherboard attack
#9> There are few facts, and much supposition.
Can't we watch it in action? Probe it and run the system, watch for activity on the SPI lines.
Can we dissect it and look for how it might interact with the world? Does it have anything like an RF front end, or does it wait for some specific BMC/network activity before triggering?
Re: Making sense of the alleged Supermicro motherboard attack
#10It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…
EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant
One of the bloomberg articles claimed that in some cases it was "thin enough that they’d been embedded between the layers of fiberglass" -- like as if it were a passive in a blind/buried via?
This seems like a very sophisticated attack.