Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making sense of the alleged Supermicro motherboard attack

lightbluetouchpaper.org

Post reply on HN
Print view View original

21–30 of 328 posts

Re: Making sense of the alleged Supermicro motherboard attack

#21

Post by kevin_thibedeau »

wyldfire wrote: post #14
qualsiasi wrote: post #4

I'm no expert, but wouldn't be more efficient to completely replace the BMC with a malicious one? That way it should be virtually impossible to detect

The cons to that approach is the work it takes to design a BMC without knowing how the existing one is designed. Replicating all of the BMC behavior is hard. Differences in behavior might be easily spotted, whereas this can lie dormant until triggered. "Why does unit #4322 have a faster/slower ping response?" Oops, discovered!

You don't have to redesign the BMC. Just repackage them with additional dice to take over I/O pins as needed.

Re: Making sense of the alleged Supermicro motherboard attack

#22

Post by simplecomplex »

wyldfire wrote: post #16
simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

> Why wouldn’t a company notice any of the outbound traffic using firewalls? The attacker could use this to escape AWS/shared computing sandboxes/containers in order to attack their peers. Exfiltrating the data stolen could be easily hidden in something that looks like legitimate customer traffic.

Huh? The traffic has to travel over wire as TCP/IP, regardless of what device generated it. Any outbound firewall would detect that, especially traffic going to ports that aren’t even open/used.

Re: Making sense of the alleged Supermicro motherboard attack

#23

Post by simplecomplex »

radicalbyte wrote: post #19
simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs) to control the controller.

The traffic has to travel over wire as TCP/IP, regardless of what device generated it. It has to travel over wire somewhere! The device can’t magically communicate with China. Any outbound firewall could detect that, especially traffic going to ports that aren’t even open/used.

Re: Making sense of the alleged Supermicro motherboard attack

#24

Post by docker_up »

Is this really that hard to imagine?

I am willing to bet that there are teams of spies who have infiltrated Google, Facebook, Amazon, etc. Spies from US, Russia, China, Britain, Israel, Germany, etc, must have dozens of spies working as engineers are getting access to all that data as we speak.

To think that they aren't would be rather naive, in my opinion. If I were head of the spy agencies in any one of those countries, it would definitely be the first thing I would do.

Re: Making sense of the alleged Supermicro motherboard attack

#25

Post by simplecomplex »

jonathankoren wrote: post #15
simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

I don’t know what you mean by the first question. The implication was that this was a bit of a drift net attack. Compromise a few lots, then wake them up a few months later figure out where they are. Most aren’t useful, but if you got the right batch, some might end up someplace interesting. I would assume the reason why no one noticed outbound traffic is because it’s dormant.

So if there’s a bunch of compromised boards, where are they? Which boards? If they truly are in a bunch of datacenters, and we know the manufacture and models, why hasn’t anyone just gone and looked? Or Why haven’t the leakers just provided the actual chip? It should have been as easy as ordering one.

Re: Making sense of the alleged Supermicro motherboard attack

#26

Post by ams6110 »

kevin_thibedeau wrote: post #21
wyldfire wrote: post #14

Earlier quoted context omitted.

The cons to that approach is the work it takes to design a BMC without knowing how the existing one is designed. Replicating all of the BMC behavior is hard. Differences in behavior might be easily spotted, whereas this can lie dormant until triggered. "Why does unit #4322 have a faster/slower ping response?" Oops, discovered!

You don't have to redesign the BMC. Just repackage them with additional dice to take over I/O pins as needed.

Or just reflash the firmware. They should, but most people don't reflash the bios and BMC firmware when they install a new server. In fact I routinely encounter servers that are 5+ years in service that have never been reflashed.

Re: Making sense of the alleged Supermicro motherboard attack

#27

Post by auslander »

simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

> notice any of the outbound traffic

Outbound traffic is allowed unrestricted in 95% of the deployments, it is just a life fact, people trust their own systems.

Re: Making sense of the alleged Supermicro motherboard attack

#28

Post by coolspot »

docker_up wrote: post #24

Is this really that hard to imagine? I am willing to bet that there are teams of spies who have infiltrated Google, Facebook, Amazon, etc. Spies from US, Russia, China, Britain, Israel, Germany, etc, must have dozens of spies working as engineers are getting access to all that data as we speak. To think that they aren't would be rather naive, in my opinion. If I were head of the spy agencies in any one of those count…

Especially if you:

1) happen to be country that makes all electronics

2) Company with a lot of ties to your country is happen to be top server supplier

3) Companies that use these servers happen to work for DoD, CIA and all major points of interest.

Re: Making sense of the alleged Supermicro motherboard attack

#29

Post by true_religion »

simplecomplex wrote: post #23
radicalbyte wrote: post #19

Earlier quoted context omitted.

There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs) to control the controller.

The traffic has to travel over wire as TCP/IP, regardless of what device generated it. It has to travel over wire somewhere! The device can’t magically communicate with China. Any outbound firewall could detect that, especially traffic going to ports that aren’t even open/used.

I think the idea is that the traffic goes over intranet to another computer that they legitimately control within the datacenter, then goes to China.

Or if they can insert themselves into the maintenance team, they can retrieve their chips at a later date.

Re: Making sense of the alleged Supermicro motherboard attack

#30

Post by dpedu »

radicalbyte wrote: post #19
simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs) to control the controller.

Cloud instances are generally firewalled off from each other, usually cross-account, vpc, etc. Two machines can't reach each other just because they're AWS instances. That would be silly.
Post reply on HN