i call bs. again. one source, to many technical inaccuracies imo
New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
51–60 of 379 posts
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#52OK so this is a different hack than Bloomberg reported before: ethernet jack piggyback instead of bmc. I'm not sure this adds credibility to the allegations in the other story. The details that Bloomberg related previously are so different that this couldnt be what they originally were reporting on. This adds to the China hacking server board narrative, but it does nothing to prove the Bloomberg reporting actually tr…
Read it more carefully. The ethernet jack is a tactic used by US intelligence years ago. That was mentioned in the story to explain the history of supply chain attacks.
Do you think the NSA manufactured their implants in China?
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#53It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…
The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.
Is it really so clear-cut what the US can do? Maybe this so significant (it may well be if the allegations are correct) that they're running a campaign to really try to make people believe that this story is false.
The companies may have a strong incentive to cooperate in this campaign too, both to save face and government relations.
Unfortunately all of Bloomberg's allegations don't hold much water either, even though it'd be so easy for them to make the story credible with some details.
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#54So it is a compromised ethernet adapter. Nobody question the ability of Chinese spies to plant such a thing, but the "Big Hack" story implies that this is used as a mass infiltration tool, which I still find very improbable and lacks any evidence.
Did they say "mass"? I thought it was a handful or large companies.
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#55Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…
Yeah, particularly given it was against a US telecom company, the NSA would make sense as the source of the implant.
China is just as interested in US' communications.
Huawei & ZTE have been alleged with these exact type of attacks, by the US government
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#56Earlier quoted context omitted.
Read it more carefully. The ethernet jack is a tactic used by US intelligence years ago. That was mentioned in the story to explain the history of supply chain attacks.
Do you think the NSA manufactured their implants in China?
Plausible deniability. Wouldn't surprise me if China is getting the blame for a LOT of US hacking.
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#57Could be due to losses in "translation", but this paragraph seems odd:
> Three security experts who have analyzed foreign hardware implants for the U.S. Department of Defense confirmed that the way Sepio's software detected the implant is sound. One of the few ways to identify suspicious hardware is by looking at the lowest levels of network traffic. Those include not only normal network transmissions, but also analog signals -- such as power consumption -- that can indicate the presence of a covert piece of hardware.
Ideas what they mean? I'd be surprised if mainboards etc exposed power consumption of random periphery parts. Maybe sleep/link states of the actual NIC that get influenced?
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#58Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…
I've been looking in detail at three different Supermicro motherboards but so far have not been able to spot anything. Even against a backlight there is no sign of tampering between the layers.
Same here. I have four different Supermicro motherboards purchased in May for servers in my home. I'm sure there exist people and organizations in the world capable of putting malicious hardware on one of these such that I can't detect them. But insofar as I've personally examined them and the available evidence from Bloomberg, color me skeptical...
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#59Earlier quoted context omitted.
and if it is correct?
If it's correct, it's highly likely that most cloud vendors are in the same boat. Imagine Google or AWS, who each have multiple millions of servers: even if they build their own motherboards, there are so many 3rd party components there's no way to vet all the boards. Their IDS will catch some, but not all. One might imagine a cloud vendor is constantly the target from multiple state actors, foreign and domestic, all…
I can't imagine the cost of x-ray-ing all motherboards on an AWS scale.
Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom
#60It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…
The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.
What case law exists for not being able to force a company to lie? Particularly non-press.