Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

bloomberg.com

Post reply on HN
Print view View original

181–190 of 379 posts

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#181

Post by setquk »

jacquesm wrote: post #170
mediocrejoker wrote: post #143

Earlier quoted context omitted.

Where is the 6-terminal claim from?

There were quite a few pictures of what is supposed to be the device in the Bloomberg article. Knowing what they say it looks like and knowing roughly where to look I'm 99.9% sure that none of the boards I have here have that device on them.

I don't have the reference handy but someone claimed to be a source and they pointed to a generic item on digikey / mouser as an example. I imagine that it got extrapolated by Bloomberg into that.

They really have no idea what they are talking about at this time and it's probably fluff.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#182

Post by auganov »

resters wrote: post #79
mmastrac wrote: post #28

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…

My take on this is that it's been fairly obvious for a long time that these kinds of attacks are possible (if not easy) with today's technology. One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality. So why is this suddenly breaking news? It bears resemblance to most of the propaganda stories we have seen in rec…

   > China's leadership is calm and not prone to knee-jerk responses
Communist China is ruled by a genocidal mafia with a well-known penchant for sudden outbursts of violence. From its bloody inception, through the Great Leap Forward, the TianAnMen Massacre, the persecution of FaLunGong followers and recently Muslims — the regime has shown it's completely incapable of serving its people. When times get tough they invariably turn to intimidation and murder.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#183

Post by pishpash »

cm2187 wrote: post #107
roblabla wrote: post #34

Earlier quoted context omitted.

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

But they probably can force a handful of engineers to tell nothing to their employer, who would be vehemently denying in good faith.

Not only would they have to force the engineers to tell nothing, they'd have to force all capable engineers to vehemently deny it to their bosses who ask or ask them to look again.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#184

Post by passwordreset »

gargravarr wrote: post #78

Some real doublethink going on here, with Bloomberg continuing to insist that supply chain attacks are real, yet seemingly accepting the denials of each company involved. I am really not sure what to make of this.

This is just a suggestion, but it might be useful to stop thinking about news reports as "the news report says X is real and true", because that's not what most news reports actually say. The text used usually reads like: "An unnamed source says blah blah", and "Joe Smith, a retied auto-worker, says blah blah blah", or "In response, a spokesman for Large Company, Inc. says blah blah blah blah", and so forth. Bloomberg (probably) isn't insisting that the story or the denial is true or false. They repeat the facts that other people have said. Often those facts are true; often those facts are false.

Thinking about it this way helps me make sense of the topic. Maybe I'm weird.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#185

Post by roywiggins »

Karunamon wrote: post #98
educationdata wrote: post #64

Earlier quoted context omitted.

In the U.S., there is a very high bar to accuse defamation. You not only need to prove the report is false, you also need to prove the reporter knew it was false and had bad intention to cause damage.

That's defamation, but not libel. For clearing libel, all you have to prove is that the statement was presented as fact, was false, and caused harm. From my lay understanding, Supermicro has a slam dunk case given the impact on their stock price.

You either have to know the fact is false, or act with reckless disregard as to whether it's false or not. 17 sources suggests that they did care whether it was true; if they didn't care, they would not have gone to all the effort.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#186

Post by krn »

smurfysmurf wrote: post #116

I've seen several comments regarding whether or not Apple, Amazon etc. would deny the hacking if its true and if that is fraud or not. I work at Amazon now and previously was in the Navy, holding a TS/SCI. My firm belief is if such a hack happened, it would not be disclosed to anyone without a clearance, and the organizations that are denying it have no knowledge that it occurred. Furthermore if there truly was a com…

> Furthermore if there truly was a compromise by a foreign nation it would be classified as a national security threat and subsequently classified and kept from public knowledge.

This is exactly what I think. Anyone confirming such a case publicly could cause a huge international confrontation between two largest economies in the world. It's not about tech or business – it's about national security and international politics.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#187

Post by macintux »

ggggtez wrote: post #156
macintux wrote: post #87

Earlier quoted context omitted.

A public company issuing such strongly-worded denials that turn out to be untrue would be leaving themselves at risk of an investigation by the SEC and/or a shareholder lawsuit.

It would be pretty extraordinary for the government to sue a company for cooperating with the government. A company has to follow court orders. The government would have to sue itself.

The SEC prides itself on its independence; I don't think it would have any problem taking on a company that lied on behalf of some other agency of the federal government.

Now, a court order would indeed be something different, but I find it hard to conceive of a judge compelling a company to lie.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#188

Post by setquk »

Gokenstein wrote: post #56
cm2187 wrote: post #52

Earlier quoted context omitted.

Do you think the NSA manufactured their implants in China?

Plausible deniability. Wouldn't surprise me if China is getting the blame for a LOT of US hacking.

With the current political climate, that might be the intention. If you undermine international trade though marketing you don't have to fight a tariff war.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#190

Post by tyingq »

iforgotpassword wrote: post #172
pjc50 wrote: post #15

Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…

The lack of (publicly available) evidence is annoying, since there are a lot of people who'd love to check their own servers. As this is an attack directed at high profile targets it's unlikely the average size company will have ended up with one of those, but it's still a fun exercise IMO. It would also be great to know what the attribution is based on. Just the fact that they're manufactured in China? Who else migh…

"Who else might get their hands on these devices in the shipping chain?"

From the original Businessweek article:

"Supermicro has assembly facilities in California, the Netherlands, and Taiwan, but its motherboards—its core product—are nearly all manufactured by contractors in China."

Post reply on HN