Making sense of the alleged Supermicro motherboard attack • Hacker News Board

Re: Making sense of the alleged Supermicro motherboard attack

#91

Post by JohnJamesRambo » Fri, Oct 05, 2018, 5:49 PM UTC

coolspot wrote: post #32

JohnJamesRambo wrote: post #18

Earlier quoted context omitted.

That’s my main takeaway from all of this- Elemental is great at their job and didn’t just do a half assed attempt at an audit. They actually did what they were hired to do. I wonder how rare that is.

You perhaps meant not Elemental, but Elemental's auditors is great at their job. > ... In late spring of 2015, Elemental’s staff boxed up several servers and sent them to Ontario, Canada, for the third-party security company to test, the person says. Nested on the servers’ motherboards, the testers found a tiny microchip ...

Oh yes, my mistake yes, I thought Elemental was the name of the third party security company. Do we know the name of that company? They need some major kudos for this.

Re: Making sense of the alleged Supermicro motherboard attack

#92

Post by vajrabum » Fri, Oct 05, 2018, 5:50 PM UTC

romed wrote: post #66

I’m just going to throw this out there: BMCs and ILOMs are for tiny shops where “the IT guy” might have to do something from the beach at Cannes on their vacation. If you are a large operator like Apple you absolutely do not need BMCs.

Uh no. Having worked around those sorts of datacenters, the larger you are the more you're going to need the BMC and the iLO. Going to the server physically is almost never the answer at scale. The rack/data center guys generally don't know much at all.

Re: Making sense of the alleged Supermicro motherboard attack

#93

Post by sho_hn » Fri, Oct 05, 2018, 5:50 PM UTC

briatx wrote: post #46

docker_up wrote: post #24

Is this really that hard to imagine? I am willing to bet that there are teams of spies who have infiltrated Google, Facebook, Amazon, etc. Spies from US, Russia, China, Britain, Israel, Germany, etc, must have dozens of spies working as engineers are getting access to all that data as we speak. To think that they aren't would be rather naive, in my opinion. If I were head of the spy agencies in any one of those count…

It's not at all hard to imagine, especially from a country who is so paranoid about backdoors from other country's operating systems that they have written their own: https://en.wikipedia.org/wiki/Kylin_(operating_system)

This is a Linux distro, not "their own OS". Many countries all over the world have had government-subsidized Linux distro projects, at national, state and city government levels. It's something that happens pretty quickly whenever and whereever a large deployment happens (e.g. LiMux).

For that matter, many a CS faculty at many a university have actually created their own OS. Nothing too sensational either.

Re: Making sense of the alleged Supermicro motherboard attack

#94

Post by acdha » Fri, Oct 05, 2018, 5:50 PM UTC

simplecomplex wrote: post #6

Where did all the boards in question go? Why wouldn’t a company notice any of the outbound traffic using firewalls? Two pieces of the story that don’t add up for me.

> Why wouldn’t a company notice any of the outbound traffic using firewalls?

This is telling you that your experience is limited, not that the story is wrong. Trying to do egress filtering at scale is extremely hard for all but the most basic threats. If they open a socket to data-collector.pla.cn, yes, probably a majority of large shops would notice that within a few months but what if it's just a connection to S3/EC2, buried in the noise of all of the legitimate use of those services?

Think about how hard it is if the attacker is smart enough to bundle that into other traffic: compromise your mail server and have it respond slightly differently to some spambots, have a webserver respond to the Baidu crawler with actual data encoded in the cookies it sets knowing that the Great Firewall can pick the data up (Baidu doesn't even have to be involved – just something which gets packets somewhere they can see them), etc. If it's on a network with people, that's especially easy – is that user-agent hitting sites in China a bot or just the staffer who keeps tabs on market news for that region? (But, you may say, our user and server networks are tightly segregated! Does that apply perfectly to your terminal servers? How would you know if your web proxy started making a few extra requests?)

The mention of seeing a problem first in a Siri data center was interesting to me because those data centers probably have very consistent network activity and it'd seem like the kind of place where the defense team would have the best chance.

Re: Making sense of the alleged Supermicro motherboard attack

#95

Post by alienreborn » Fri, Oct 05, 2018, 5:52 PM UTC

devoply wrote: post #87

uep wrote: post #65

I think the attacks are real. A year ago, Google announced their Titan firmware security chip[1], which would limit these kinds of attacks. I don't believe they designed and built this chip, and surrounding infrastructure, because of purely theoretical attacks. Besides that, over the last couple years there has also been a lot of work trying to neuter the Intel ME, because of how dangerous it is. Another example is t…

I think the attacks are real and if China is doing it then anyone else may be doing it as well including the US.

Anyone else literally can't because they don't have supply chain advantage that China has.

Re: Making sense of the alleged Supermicro motherboard attack

#96

Post by lozaning » Fri, Oct 05, 2018, 5:52 PM UTC

lern_too_spel wrote: post #85

wjnc wrote: post #71

Earlier quoted context omitted.

First guess: not being allowed to admit it due to national security reasons and it being an ongoing investigation. On the same day several Russians were exposed trying to attack OPCW. They were exposed by Dutch military intelligence. At the press briefing the UK ambassador was there. Same day US indicts several Russian spies. This to show that these are major, international events and that proper disclosure towards i…

If they are under a gag order, they would simply not comment on it. Lying about it is never required and puts them at risk for shareholder lawsuits.

I wonder if there isn't some level of national security super mega secret scenario situation where the government requires companies to do something and the government indemnifies them against all risks associated with the required action.

Re: Making sense of the alleged Supermicro motherboard attack

#97

Post by visarga » Fri, Oct 05, 2018, 5:52 PM UTC

PeterisP wrote: post #61

cryptonector wrote: post #33

Earlier quoted context omitted.

It's as hard to imagine as the NSA's surveillance systems. I.e., it's not. The lesson of the Snowden leaks is clearly this: if it can be imagined, and it can be useful, and they have the budget, and it's remotely doable, then it's been done. China almost certainly did this because they could. You only get one chance to do something like this, so you have to do it even if it risks losing the ability to do it in the fu…

It's not that you get one chance to do something like this, it's that there is one total chance to do something like this. After it's been discovered, it's much harder to do it again for everyone - so if you never do it, then you don't get the benefit and Russia or USA or someone else does that and gets the benefit and you still lose the ability to do it in the future.

It's so hard to detect that I doubt they will never do it again.

Re: Making sense of the alleged Supermicro motherboard attack

#98

Post by lovelearning » Fri, Oct 05, 2018, 5:54 PM UTC

crispyambulance wrote: post #58

lovelearning wrote: post #2

It was reported that the security auditor used during Elemental's acquisition detected this compromise. I assume they found it in a randomly selected board. Either they were very lucky, or hundreds of boards were compromised. Now, I think all motherboard manufacturers - and especially high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. Under what circumstances is i…

> ... high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. MFG test guy here (not supermicro!) Not necessarily. Automated production tests are there to configure and exercise the system and confirm it works as specified. Such tests are good at things like finding bad solder joints, pick-and-place mishaps, misconfiguration of firmware and weeding out product that fai…

Thank you for the insight. I was rather naively imagining that every board is subject to some kind of x-ray image matching with the original PCB design to find differences. Not that simple, I see.

Re: Making sense of the alleged Supermicro motherboard attack

#99

Post by mindslight » Fri, Oct 05, 2018, 5:54 PM UTC

> Let’s assume an implant was added to the motherboard at manufacture time. This needed modification of both the board design, and the robotic component installation process. It intercepts the SPI lines between the flash and the BMC controller

Circuit wise, you don't really need to "intercept" (place in series with) the SPI lines. Two parallel drivers [0] will generally fight it out quietly, and you can guarantee yours will win by designing your implant to have the beefier driver (and perhaps only changing 1's to 0's, as P-channel FETs are generally weaker).

If there already was a footprint for an extra chip (debugging, part flexibility, etc), then it would not require modification of the board design. And an extra component can easily be hand soldered afterwards outside of the standard robotic component placing.

[0] The standard topology of SPI, but in proper operation only one is active due to CS lines.

Re: Making sense of the alleged Supermicro motherboard attack

#100

Post by aswanson » Fri, Oct 05, 2018, 5:54 PM UTC

coolspot wrote: post #28

docker_up wrote: post #24

Is this really that hard to imagine? I am willing to bet that there are teams of spies who have infiltrated Google, Facebook, Amazon, etc. Spies from US, Russia, China, Britain, Israel, Germany, etc, must have dozens of spies working as engineers are getting access to all that data as we speak. To think that they aren't would be rather naive, in my opinion. If I were head of the spy agencies in any one of those count…

Especially if you: 1) happen to be country that makes all electronics 2) Company with a lot of ties to your country is happen to be top server supplier 3) Companies that use these servers happen to work for DoD, CIA and all major points of interest.

I wonder if China is making all these cheap wifi chips (esp8266, esp32) etc as backdoors into US infrastructure.