Making sense of the alleged Supermicro motherboard attack • Hacker News Board

Re: Making sense of the alleged Supermicro motherboard attack

#11

Post by jonathankoren » Fri, Oct 05, 2018, 4:18 PM UTC

qualsiasi wrote: post #4

I'm no expert, but wouldn't be more efficient to completely replace the BMC with a malicious one? That way it should be virtually impossible to detect

In true HN fashion, I’m not an expert either, but I can think of two plausible reasons.

1) Directly compromising via software the BMC is easy to detect if you bothered to look. (i.e. checksums don’t match), and would only last as long as the BMC isn’t flashed.

2) It’s simply currently easier to make a second component, rather than to integrate it into the main chip directly. Of course, if I was in charge of this project, I’d already be investing resources into exploring this option.

Re: Making sense of the alleged Supermicro motherboard attack

#12

Post by codetrotter » Fri, Oct 05, 2018, 4:18 PM UTC

mediocrejoker wrote: post #7

LeonM wrote: post #3

Earlier quoted context omitted.

EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant

Are you basing this off the photo in the Bloomberg article that shows a small (0402?) SMT package with three terminals? I wonder if that's an actual photo of the chip in question.

FTA: https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iWRg56pmx50...

> [...] a picture of the alleged implant. This shows a 6-pin silicon chip inside a roughly 1mm x 2mm ceramic package – as often used for capacitors and other so-called ‘passive’ components, which are typically overlooked.

Re: Making sense of the alleged Supermicro motherboard attack

#13

Post by creeble » Fri, Oct 05, 2018, 4:19 PM UTC

qualsiasi wrote: post #4

I'm no expert, but wouldn't be more efficient to completely replace the BMC with a malicious one? That way it should be virtually impossible to detect

Or even why two SPI roms?

Why not just one with special code? It's not like anyone is routinely reverse engineering the BMC boot code.

It seems like an awful lot of provable trouble to go through (note that there is no physical evidence in the public eye yet) when you could do the same thing, at the factory, with just software.

Re: Making sense of the alleged Supermicro motherboard attack

#14

Post by wyldfire » Fri, Oct 05, 2018, 4:20 PM UTC

qualsiasi wrote: post #4

I'm no expert, but wouldn't be more efficient to completely replace the BMC with a malicious one? That way it should be virtually impossible to detect

The cons to that approach is the work it takes to design a BMC without knowing how the existing one is designed. Replicating all of the BMC behavior is hard. Differences in behavior might be easily spotted, whereas this can lie dormant until triggered. "Why does unit #4322 have a faster/slower ping response?" Oops, discovered!

Re: Making sense of the alleged Supermicro motherboard attack

#15

Post by jonathankoren » Fri, Oct 05, 2018, 4:23 PM UTC

simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

I don’t know what you mean by the first question. The implication was that this was a bit of a drift net attack. Compromise a few lots, then wake them up a few months later figure out where they are. Most aren’t useful, but if you got the right batch, some might end up someplace interesting.

I would assume the reason why no one noticed outbound traffic is because it’s dormant.

Re: Making sense of the alleged Supermicro motherboard attack

#16

Post by wyldfire » Fri, Oct 05, 2018, 4:23 PM UTC

simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

> Why wouldn’t a company notice any of the outbound traffic using firewalls?

The attacker could use this to escape AWS/shared computing sandboxes/containers in order to attack their peers. Exfiltrating the data stolen could be easily hidden in something that looks like legitimate customer traffic.

Re: Making sense of the alleged Supermicro motherboard attack

#17

Post by creeble » Fri, Oct 05, 2018, 4:25 PM UTC

wyldfire wrote: post #9

> There are few facts, and much supposition. Can't we watch it in action? Probe it and run the system, watch for activity on the SPI lines. Can we dissect it and look for how it might interact with the world? Does it have anything like an RF front end, or does it wait for some specific BMC/network activity before triggering?

We could do all of those things if anyone were to come forward with actual, physical evidence (i.e., a board).

But so far no one has.

Re: Making sense of the alleged Supermicro motherboard attack

#18

Post by JohnJamesRambo » Fri, Oct 05, 2018, 4:26 PM UTC

lovelearning wrote: post #2

It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…

That’s my main takeaway from all of this- Elemental is great at their job and didn’t just do a half assed attempt at an audit. They actually did what they were hired to do. I wonder how rare that is.

Re: Making sense of the alleged Supermicro motherboard attack

#19

Post by radicalbyte » Fri, Oct 05, 2018, 4:29 PM UTC

simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs) to control the controller.

Re: Making sense of the alleged Supermicro motherboard attack

#20

Post by auslander » Fri, Oct 05, 2018, 4:29 PM UTC

lovelearning wrote: post #2

It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…

> what circumstances is it possible that SM's QC missed this out

Rogue insider, paid or patriotic, likely both.

> affect things like the power budget, weight, and latency

All three would have no measurable change, falling into measurement error margin. Its a death sentence for Supermicro, nothing will help to restore trust. They should publish a detailed post-mortem analysis, though.