Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

bloomberg.com

Post reply on HN
Print view View original

81–90 of 379 posts

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#81

Post by andai »

RL_Quine wrote: post #29
carapace wrote: post #22

So does it really matter if it's true or not? Isn't the sane response to assume it's all true and verify your system integrity? Even if you find nothing you would then have a pile of strong evidence for the null case, eh?

You've got to be kidding. There's no way of validating anything about modern hardware, it's packed with independent systems running various firmware, software that's decades old, parts nobody can even identify unless you're the OEM. You can get to "that probably does this" level easily, but that doesn't tell you anything about its actual security or authenticity.

Is this a desirable state of affairs?

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#82

Post by late2part »

close04 wrote: post #24
maxden wrote: post #11

Earlier quoted context omitted.

This seems different than the extra chip attack according to the article. "subsequent physical inspection revealed an implant built into the server’s Ethernet connector"

This feels like piling some more to cover up the weak premise of the previous article. It doesn't mean it's false, it just means Bloomberg already cried wolf and couldn't show it. At this point it feels more like taking shots at Supermicro than professional reporting.

totally seems like this is the case to me.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#83

Post by macintux »

busterarm wrote: post #61
roblabla wrote: post #34

Earlier quoted context omitted.

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

But if the story was entirely false, they'd have sued Bloomberg for libel already.

Well, the story just came out a few days ago. I wouldn't rule it out in the future, nor would I leap to the conclusion that an absence of such a move means there's truth to the story.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#84

Post by late2part »

krn wrote: post #17

I find it hard to believe, that Bloomberg would publish an extremely detailed story involving some of the largest public companies in the world, knowing that it is entirely false. The cost of reputation is just too high.

They don't have to know it is false. They just have to find their sources credible.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#85

Post by akiselev »

jacquesm wrote: post #42
pjc50 wrote: post #15

Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…

I've been looking in detail at three different Supermicro motherboards but so far have not been able to spot anything. Even against a backlight there is no sign of tampering between the layers.

The most compelling explanation I've heard is that the BMC chip could be programmed by two distinct flash chips, one for factory programming and one for some other purpose. In some SKUs, the latter isn't populated but it has a higher priority than the first chip.

Since there are many flash chips fitting the same pin out, all it took was soldering a compromised flash chip (with firmware for the BMC chip) onto pads that are already part of the design to compromise the whole system without any obvious sign that the board was tampered with (because in some SKUs, both chips were populated).

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#86

Post by resters »

Gokenstein wrote: post #56
cm2187 wrote: post #52

Earlier quoted context omitted.

Do you think the NSA manufactured their implants in China?

Plausible deniability. Wouldn't surprise me if China is getting the blame for a LOT of US hacking.

I think it's totally plausible. See my other comment in this thread for my conspiracy theory :)

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#87

Post by macintux »

394549 wrote: post #44
roblabla wrote: post #34

Earlier quoted context omitted.

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

> The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud. Would the US government have to force these companies to lie? It's quite possible that the denials were the result of voluntary cooperation.

A public company issuing such strongly-worded denials that turn out to be untrue would be leaving themselves at risk of an investigation by the SEC and/or a shareholder lawsuit.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#88

Post by module0000 »

busterarm wrote: post #61
roblabla wrote: post #34

Earlier quoted context omitted.

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

But if the story was entirely false, they'd have sued Bloomberg for libel already.

There could be other arrangements made with Bloomberg that would be jeopardized by that course of action. EG... you find a serious piece of news that can destroy me, so I pay you or make another arrangement to prevent that. If I later turn around and sue you, our backroom deal could blow up in my face. Too much is unknown right now.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#89

Post by wyldfire »

detaro wrote: post #57

Could be due to losses in "translation", but this paragraph seems odd: > Three security experts who have analyzed foreign hardware implants for the U.S. Department of Defense confirmed that the way Sepio's software detected the implant is sound. One of the few ways to identify suspicious hardware is by looking at the lowest levels of network traffic. Those include not only normal network transmissions, but also analo…

If you look at the activity in the frequency domain, you might find a clock that's present in adulterated hardware that's missing in the nominal hardware.

> exposed power consumption of random periphery parts

Sampling these analog signals is done outside of the computer itself. Even if it were exposed via i2c, you couldn't trust anything that it would tell you.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#90

Post by yayana »

ummonk wrote: post #31
pjc50 wrote: post #15

Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…

Yeah, particularly given it was against a US telecom company, the NSA would make sense as the source of the implant.

I find these attempts to distinguish between different state sponsored criminals to be a diversion and subterfuge.

Whether China or the US re-allocates your IP, you can expect a competing product made in China. That you might have a relationship with one of them probably doesn't change anything unless they actually think your firm is the best one for the job of maximizing the results on their tax base.

I mean maybe I'm wrong; would it make any sense that these Republics take private corporate property more seriously other parts of their Constitutions they have violated at least until caught?

The US makes the claim China does not and former president and CIA head George Bush floated corporate espionage as THE plan for handling the absurd costs of "intelligence" criminals after the cold war..

I'm always astounded that working in a competitive market seems to blind people to significant stated facts of the environment their market is operating in.

In nature, it might make sense to just outrun the weakest, after all, a bear has a limited appetite. But superpowers have unlimited apetites and will collapse like the USSR if they should ever expand slower than cancer.

Post reply on HN