Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making sense of the alleged Supermicro motherboard attack

lightbluetouchpaper.org

Post reply on HN
Print view View original

241–250 of 328 posts

Re: Making sense of the alleged Supermicro motherboard attack

#241

Post by [deleted] »

paulmd wrote: post #74
creeble wrote: post #13

Earlier quoted context omitted.

Or even why two SPI roms? Why not just one with special code? It's not like anyone is routinely reverse engineering the BMC boot code. It seems like an awful lot of provable trouble to go through (note that there is no physical evidence in the public eye yet) when you could do the same thing, at the factory, with just software.

it's pretty easy to dump an SPI chip and some vendors/customers routinely do so. In this model, the implant basically contains a binary patch that is injected at boot time over a segment of the BMC binary - counter overflows, chip cuts out the SPI and transmits its payload instead. After the payload is injected the implant goes dormant again/resumes passing through the SPI, so dumping the ROM after boot, or even phys…

[deleted]

Re: Making sense of the alleged Supermicro motherboard attack

#242

Post by ocschwar »

ryanmarsh wrote: post #213
wjnc wrote: post #71

Earlier quoted context omitted.

First guess: not being allowed to admit it due to national security reasons and it being an ongoing investigation. On the same day several Russians were exposed trying to attack OPCW. They were exposed by Dutch military intelligence. At the press briefing the UK ambassador was there. Same day US indicts several Russian spies. This to show that these are major, international events and that proper disclosure towards i…

not being allowed to admit it due to national security reasons Came here to say this. When I read Amazon’s rebuttal my gut said “what if these folks had to respond but weren’t allowed to tell the truth?”. If the allegations went unanswered it could be damaging to Amazon and tip the hand of the spooks. If they answered and said they did find the devices the story could run away from them, the internet mob is good at w…

Amazon Web Services is the one branch of AMZN that is actually profitable.

And the make or break for AWS is the assurance that when you're runnign stuff on one Amazon pizza box, your data are safe even from other users on that same box.

You HAVE to get your assurance from Amazon if you're a corporate customer, for due diligence reasons. If that assurance is established to be a lie, every single corporate customer they have would be obliged to migrate to MSFT/RHAT/GOOG or elsewhere. AWS would be dead.

I would say it's a calculated leak that happens to be materially false, meant to pressure CHina and kicj Bezos in the shin.

Re: Making sense of the alleged Supermicro motherboard attack

#243

Post by mindslight »

TickleSteve wrote: post #229
mindslight wrote: post #156

Earlier quoted context omitted.

You need two lines - data/ground, or data/Vdd. Probably whichever gives you voltage when idle. You harvest power when data is idle. CS is irrelevant. The rough clock speed is fixed, and you can match the precise timing from the data line. QSPI actually gets you access to data in both directions with the tradeoff of only getting one quarter of the bits. Logically, you likely only need to recognize a few patterns that…

CS isn't irrelevant if there are multiple devices on the bus, we havent seen a schematic.

Yes it is - a tap doesn't need to be 100% sure that a given chip is selected like how we think when designing a circuit - it just needs to key off patterns that look like memory reads of interest. If you've got ambiguity you don't need to pull in more parallel bits, just record a longer serial history.

In fact I would think the most stealthy and robust way of bugging code would be to just ignore addresses and look for a context-free stream of instructions that does some security-sensitive initialization (either of the platform or of the application code). Turn off some flag that's supposed to be on, causing the code to continue running as normal but silently skipping certain checks.

Now that you mention other devices on the bus - those in fact would be a great chip to subvert with such a backdoor. Why bother fitting everything into a two terminal hack package when you could just have a malicious temperature sensor sourced from the "lowest bidder" that does the attack and jumps to its own ROM? (I think those are usually I2C but you get the point). Bonus points for only being triggered through some sidechannel - recruit a low level employee at the target, while they retain plausible deniability.

Re: Making sense of the alleged Supermicro motherboard attack

#244

Post by PeterisP »

robryk wrote: post #160
zaroth wrote: post #88

Earlier quoted context omitted.

The attacker and target have VMs on the same hardware. The attacker has a fake presence serving cat pics which is constantly sending “valid” logging traffic to an S3 bucket. The chip passes the stolen data between the VM instances by DMA. The stolen data hitches a ride inside an otherwise innocuous TCP packet storing log entries in that S3 bucket. Logs are routine backed up off site. There would be absolute nothing a…

It seems that you're arguing for a different functionality of the implanted chip than the original article. Original article supposes that the implanted chip was used to modify the boot process of the BMC in such a way that the BMC loaded its software over the network. The question is why this network activity wasn't easily detectable and firewalled off by default. It seems that you suppose that the chip can be direc…

Not the parent poster, but the chip can indirectly used for such an escalation - the chip would have the capacity to modify BMC software as it's loaded from a nearby memory chip; and BMC has direct access to main memory that enables all kinds of interesting escalation scenarios.

Re: Making sense of the alleged Supermicro motherboard attack

#245

Post by frankharv »

frankharv wrote: post #203
bsder wrote: post #185

Earlier quoted context omitted.

Apple cannot do anything bad to China or their manufacturing stops. Apple would have to move tens of thousands of highly specific CNC machines from China to somewhere else, set them up, and get their line moving again. This is why I find the idea that Apple phones are "secure" to laughable on its face. China could kill years of Apple revenue if they ever did something truly offensive to the ruling party. Apple would…

You could move every CNC machine from the manufacturing line and it would not matter. These sneaky chips were embedded in the PCB. So this is a supplier trust issue. Plus they probably did not implant every board, So somebody inside FoxConn had to slip in these 'special' pcb's in known Apple mobo orders..

I am assuming that the PCB's are contracted out. It would be interesting to see where the PCB's came from.

One side of me feels real bad for SuperMicro. The have always been there for the small guys that like to build our own servers and for small OEM shops.

Who else are the real server mobo competitors?

Gigabyte and AsrockRack from my view and they are a very distant second and third place.

If SuperMicro goes down we all lose and IBM, HPE and Dell gains.

Re: Making sense of the alleged Supermicro motherboard attack

#246

Post by golem14 »

alienreborn wrote: post #95
devoply wrote: post #87

Earlier quoted context omitted.

I think the attacks are real and if China is doing it then anyone else may be doing it as well including the US.

Anyone else literally can't because they don't have supply chain advantage that China has.

5 eyes/Taiwan/some others could do in on the chip level I guess. Who knows what’s in the me or really all the SOCs...

Re: Making sense of the alleged Supermicro motherboard attack

#248

Post by blattimwind »

duskwuff wrote: post #162
blattimwind wrote: post #151

Earlier quoted context omitted.

Supermicro stock dipped down to 50 % or so (20->10).

Supermicro has been dealing with some accounting irregularities for the last year or so. This news certainly hasn't helped , but they were already in a shaky position. https://www.marketwatch.com/story/super-micros-stock-set-to-...

That drop happened in the last two days, just after the story was published.

https://www.bloomberg.com/quote/SMCI:US

Re: Making sense of the alleged Supermicro motherboard attack

#249

Post by pasbesoin »

pasbesoin wrote: post #179
blattimwind wrote: post #151

Earlier quoted context omitted.

Supermicro stock dipped down to 50 % or so (20->10).

I'm not talking about any effect specifically upon Supermicro. And... it's just a hypotheses, assuming news of such an exploit is indeed being suppressed.

"hypothesis" -- sigh
Post reply on HN