Making sense of the alleged Supermicro motherboard attack • Hacker News Board

Re: Making sense of the alleged Supermicro motherboard attack

#251

Post by sho_hn » Fri, Oct 05, 2018, 10:26 PM UTC

briatx wrote: post #226

sho_hn wrote: post #93

Earlier quoted context omitted.

This is a Linux distro, not "their own OS". Many countries all over the world have had government-subsidized Linux distro projects, at national, state and city government levels. It's something that happens pretty quickly whenever and whereever a large deployment happens (e.g. LiMux). For that matter, many a CS faculty at many a university have actually created their own OS. Nothing too sensational either.

Pedantry aside, it is the reasoning behind building their own OS distro that is relevant here: > In 2009, a report presented to the US-China Economic and Security Review Commission stated that the purpose of Kylin is to make Chinese computers impenetrable to competing countries in the cyberwarfare arena. The Washington Post reported that: > China has developed more secure operating software for its tens of millions o…

Sounds perfectly sensible, rather than "paranoid".

Re: Making sense of the alleged Supermicro motherboard attack

#252

Post by 394549 » Fri, Oct 05, 2018, 10:27 PM UTC

joshstrange wrote: post #184

DenisM wrote: post #172

A decade ago when I worked at Microsoft I shopped around the idea of using XBox as a basis for secure computing. XBox was designed to function in the hands of the adversary, to be robust against peripheral attacks and even motherboard mods. Even the main memory was encrypted by the on-CPU controller. Obviously, no open JTAGs. A lot of expertise there. In my fantasies it would form the basis of the DoD infrastructure…

Are you referring to the original Xbox? Modchips hit the scene for that in ~ 2 years after release. It's not exactly what I would consider a basis for secure computing. Or maybe you are just referencing the procedures "main memory was encrypted by the on-CPU controller. Obviously, no open JTAGs" should be ratified to create a basis for secure computing, a checklist of things to do/prevent before considering a device…

IIRC, the original XBox made the assumption that the main bus was secure due to its high-speed, which turned out to be false. That was one of the few things that was unencrypted, and it offered a way in.

Re: Making sense of the alleged Supermicro motherboard attack

#253

Post by neffy » Fri, Oct 05, 2018, 10:27 PM UTC

coolspot wrote: post #32

JohnJamesRambo wrote: post #18

Earlier quoted context omitted.

That’s my main takeaway from all of this- Elemental is great at their job and didn’t just do a half assed attempt at an audit. They actually did what they were hired to do. I wonder how rare that is.

You perhaps meant not Elemental, but Elemental's auditors is great at their job. > ... In late spring of 2015, Elemental’s staff boxed up several servers and sent them to Ontario, Canada, for the third-party security company to test, the person says. Nested on the servers’ motherboards, the testers found a tiny microchip ...

There used to be a Nortel Division up there that had an electro scanning microscope for this sort of thing - I imagine they´re still there under a different name.

Re: Making sense of the alleged Supermicro motherboard attack

#254

Post by ABCLAW » Fri, Oct 05, 2018, 10:27 PM UTC

avip wrote: post #177

amoshi wrote: post #168

Earlier quoted context omitted.

And if they were, you think they would admit it?

They would not have blatantly lied about it in an official statement. That could not have passed legal.

You don't need to blatantly lie to author a rebuttal that doesn't actual rebut the claims against you.

You accuse me of selling pink and purple unicorns to gangsters. I reply that "I have no knowledge of any contracts or agreements relating to the sale of unicorns, horses or horse-related animals from my firm, regardless of the colour, breed or condition of the animals. I categorically also deny having any business dealings with any entity which has been charged on racketeering or any other gang related offenses.

The reality being that I 'rent' pink and purple unicorns to Don Corleone for absurd amounts, then don't revendicate when payments stop.

My rebuttal looks sweeping. I put in language to make it look like the scope of my denial is wide ranging and complete. In fact, I intentionally disclaim things you didn't claim to make it look like the moat of propriety surrounding me is vast.

But it isn't. I did what was claimed. And I didn't lie in my rebuttal.

Re: Making sense of the alleged Supermicro motherboard attack

#255

Post by femto » Fri, Oct 05, 2018, 10:29 PM UTC

baybal2 wrote: post #146

wyldfire wrote: post #140

Earlier quoted context omitted.

Sorry, I didn't mean to suggest that the attack was with a passive. Clearly, this package is shown to have logic. But it was meant to look as if it were a passive. In some cases surface mount, but in truly devious ones it's much better hidden.

Well my own idea was along the lines - if they can burry passives, burying a small IC should also be possible

SD cards have the raw IC die buried in the PCB. If you crack open a cheap SanDisk card, you will see that it is a marvel of engineering. Instinctively one thinks of advanced manufacturing as being reserved for high end goods, but in reality it is used widely in cheap mass produced things to bring the cost down.

Re: Making sense of the alleged Supermicro motherboard attack

#256

Post by kpil » Fri, Oct 05, 2018, 10:33 PM UTC

eridius wrote: post #234

ryanmarsh wrote: post #215

Earlier quoted context omitted.

Could they say if they were?

No. But gag orders do not require the recipient to lie about it. Someone who is under a gag order simply doesn't comment one way or the other about it. FWIW this is the principle behind warrant canaries. A warrant canary is the practice of putting a statement such as "we have not received any NSLs" in a regular report, and then omitting it once you have received an NSL. Because you've conditioned people to expect its…

I'm pretty sure that this strategy won't hold up in court.

If you have a sign that indicates that a secret event have not happened, the intent of removing the sign is to indicate that the secret event did happen.

The intent is particularly obvious to the originator of the secret event, so you won't be able to argue in the court that it was entirely coincidental.

Re: Making sense of the alleged Supermicro motherboard attack

#257

Post by chris_mc » Fri, Oct 05, 2018, 10:39 PM UTC

DenisM wrote: post #172

A decade ago when I worked at Microsoft I shopped around the idea of using XBox as a basis for secure computing. XBox was designed to function in the hands of the adversary, to be robust against peripheral attacks and even motherboard mods. Even the main memory was encrypted by the on-CPU controller. Obviously, no open JTAGs. A lot of expertise there. In my fantasies it would form the basis of the DoD infrastructure…

Anything the government uses that needs to be hardware-secure (like Secret or Top Secret network devices) are either manufactured in small batches in a secure location or it's totally airgapped so that any "additions" don't matter. Let the Chinese have their extra chip installed anywhere they want and you wouldn't get anything out of it anyways, in that situation.

The real problem is for stuff connected to the non-secure internet, like banks, industry, personal info, healthcare, etc.

Re: Making sense of the alleged Supermicro motherboard attack

#258

Post by ATsch » Fri, Oct 05, 2018, 10:46 PM UTC

cimi_ wrote: post #250

> But there’s another trick a bad BMC can do — it can simply read and write main memory once the machine is booted. Doesn't ASLR[0] mitigate this? [0] https://en.wikipedia.org/wiki/Address_space_layout_randomiza...

I don't see how it would. ASLR only really helps making it harder for attackers to gain full control when they manage to execute some instructions in your process via memory corruption. It relies on the memory layout being hard to guess, however, the BMC can already just read from arbitrary memory, so it can just look it up. What would help here is isolating PCIe devices with the IOMMU, but this is currently rarely enabled, only for virtualization, apparently due to it's relatively high overhead.

Re: Making sense of the alleged Supermicro motherboard attack

#259

Post by ispiansclsda » Fri, Oct 05, 2018, 10:49 PM UTC

ChuckMcM wrote: post #73

Ok, that finally makes a bit of sense about "if" this is true, how it might be carried out. And I agree with the author that the simplest action for a chip on the SPI bus would be to hold the MISO line low during power on to suggest to the BMC chip that its QSPI flash isn't programmed (note that QSPI starts up as 'regular' SPI and then switches over[1]). I would guess that the next thing the BMC would do is assume it…

> the simplest action for a chip on the SPI bus would be to hold the MISO line low during power on

MISO is master-in, slave-out for anyone not familiar with serial peripheral interface jargon. Usually, the slave quad-SPI memory would send the configuration over this line, so pulling it low should dump the real data to ground.

Re: Making sense of the alleged Supermicro motherboard attack

#260

Post by dawnerd » Fri, Oct 05, 2018, 10:49 PM UTC

joshstrange wrote: post #184

DenisM wrote: post #172

A decade ago when I worked at Microsoft I shopped around the idea of using XBox as a basis for secure computing. XBox was designed to function in the hands of the adversary, to be robust against peripheral attacks and even motherboard mods. Even the main memory was encrypted by the on-CPU controller. Obviously, no open JTAGs. A lot of expertise there. In my fantasies it would form the basis of the DoD infrastructure…

Are you referring to the original Xbox? Modchips hit the scene for that in ~ 2 years after release. It's not exactly what I would consider a basis for secure computing. Or maybe you are just referencing the procedures "main memory was encrypted by the on-CPU controller. Obviously, no open JTAGs" should be ratified to create a basis for secure computing, a checklist of things to do/prevent before considering a device…

Didn't even need a modchip. There was a technique where you could softmod by simply unplugging the ide harddrive right after boot and hot plugging it into a desktop.

https://www.reddit.com/r/originalxbox/wiki/hotswap