Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

bloomberg.com

Post reply on HN
Print view View original

191–200 of 379 posts

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#191

Post by wil421 »

smurfysmurf wrote: post #134
wil421 wrote: post #124

Earlier quoted context omitted.

I can see where the Navy/Military/Government could compartmentalize a hack like this. How could a company like Apple or Amazon keep this under wraps? How could they keep the knowledge of such a hack within the TS/SCI employees?

The cleared department is handled the same way as in the military in terms of security. Amazon has SCIF's etc. So unless a disgruntled employee steps forward who doesn't care about there life, I imagine its easily contained (and symptoms of an employee being disgruntled are highly monitored when they hold a clearance)

I’m thinking about the non cleared data center folk, the sys admins and developers who use the servers for their applications.

How do a bunch of Supermicro servers vanish wintout anyone noticing? I’d expect quite a few people would be involved that do not have any clearances. Apple is known for their secrecy but a few other companies named are not.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#192

Post by jlgaddis »

djsumdog wrote: post #169
phil_folrida wrote: post #140

Earlier quoted context omitted.

Ok now try to patch the BMC, you can actually talk to it with openipmi on local host.

I really want to see someone on here with access to one of their recent boards try and report on this. I'd try it, but I sold my last Supermicro board years ago.

Try what? Updating the firmware? I do it every time a new firmware version is released.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#193

Post by adayIwillforget »

resters wrote: post #79
mmastrac wrote: post #28

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…

My take on this is that it's been fairly obvious for a long time that these kinds of attacks are possible (if not easy) with today's technology. One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality. So why is this suddenly breaking news? It bears resemblance to most of the propaganda stories we have seen in rec…

>One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality.

Don't you think it's going to be suspicious when you see a capacitor with 6 pins? Don't you think anyone that inspects the motherboard is going to wonder why a capacitor has 4 additional lines going to a critical flash chip? Seriously.... The entire article here is around replacing entire components. Adding new traces to a finished PCB is impossible without using wire that will be suspicious to anyone doing a visual inspection. Most sabotage will probably just program the flash chips with malicious software without changing the hardware or swap big components that use standardised footprints like QFN with a nearly identical part. Adding a small capacitor sized micro controller where it doesn't belong and on top of that connect it to existing chips in comparison is extremely hard. At that point you might as well design the backdoor into the PCB itself and embed it between the individual layers of the PCB.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#194

Post by jlgaddis »

jacquesm wrote: post #175
colechristensen wrote: post #77

Earlier quoted context omitted.

Isn't the idea that the boards weren't tampered with but manufactured by contractors including extras?

Well, that depends on your definition of tampering, but if you want to exclude manufacturing something that is not what was specced then I am fine with that but please do supply a new term. I would definitely spot that device if it were on these boards because it was described in detail and there were some pictures of what it supposedly looked like. A device like that is not on either side of the board and it isn't i…

> I would definitely spot that device if it were on these boards because it was described in detail and there were some pictures of what it supposedly looked like.

In case you missed it, there is an article posted today [0] that has this quote from "Hardware security expert Joe Fitzpatrick", one of the Bloomberg sources, regarding "the supposed spy chip":

> In September when he asked me like, “Okay, hey, we think it looks like a signal amplifier or a coupler. What’s a coupler? What does it look like?” […] I sent him a link to Mouser, a catalog where you can buy a 0.006 x 0.003 inch coupler. Turns out that’s the exact coupler in all the images in the story.

[0]: https://9to5mac.com/2018/10/09/bloomberg/

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#195

Post by gowld »

hannasanarion wrote: post #139
endorphone wrote: post #122

Earlier quoted context omitted.

Wasn't PRISM all about attacking American companies with covert implants? For instance tapping into Google region to region data transfers, after which Google started encrypting everything.

I thought PRISM wasn't covert. Companies were compelled to allow them to install their sniffing hardware, it was all above-board. Snowden even leaked an internal slideshow with a nice timeline of when each tech company joined the program.

PRISM was an overt program (to the data stewards, not to the public) for processing FISA warrants and the like.

Other NSA programs that Snowden revealed were covert hacks. https://en.wikipedia.org/wiki/Global_surveillance_disclosure...

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#196

Post by gowld »

mox1 wrote: post #163
late2part wrote: post #74

Earlier quoted context omitted.

You don't know that. We do know that the USG covertly intercepted fiber communications. https://www.washingtonpost.com/news/the-switch/wp/2013/11/04...

The story literally quotes the general of the NSA, saying they go though the FBI to get a FISA court order to compel the company.. Additionally, the story quoted talks about how the UK obtained the data and gave it to the NSA. Nowhere is the NSA installing covert implants. They just don't do that. The CIA does that :)

That's not correct. https://en.wikipedia.org/wiki/Global_surveillance_disclosure...

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#197

Post by eridius »

kevin_thibedeau wrote: post #132
monocasa wrote: post #110

Earlier quoted context omitted.

You would recognize what looks like an extra resistor?

The supposed infiltrated part is a six terminal RF device. Not something that would ordinarily show up on a server motherboard. In any case, Joe Fitzpatrick has already disclosed that he used the part merely as an example and Jordan Robertson expanded that into a work of fiction.

I hadn't seen this before, but searching for "Joe Fitzpatrick Jordan Robertson" finds https://appleinsider.com/articles/18/10/08/security-research... which seems to be what you were referring to?

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#198

Post by gowld »

geezerjay wrote: post #166
ummonk wrote: post #31

Earlier quoted context omitted.

Yeah, particularly given it was against a US telecom company, the NSA would make sense as the source of the implant.

> the NSA would make sense as the source of the implant. That doesn't make sense based on the assumption that US telecom companies already cooperate extensively with US inteligence agencies.

"Extensively" is not 100%

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#199

Post by robotrout »

late2part wrote: post #70
jacquesm wrote: post #42

Earlier quoted context omitted.

I've been looking in detail at three different Supermicro motherboards but so far have not been able to spot anything. Even against a backlight there is no sign of tampering between the layers.

The initial allegations from Bloomberg suggested ON the otherboard, not in, as I understand it.

There was mention of one being discovered buried inside the FR4 PCB material.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#200

Post by mindcrime »

zby wrote: post #127
jacquesm wrote: post #42

Earlier quoted context omitted.

I've been looking in detail at three different Supermicro motherboards but so far have not been able to spot anything. Even against a backlight there is no sign of tampering between the layers.

Maybe you are not a high value target?

That raises an interesting question about just how targeted this kind of attack could be. At manufacture time, do the folks on the assembly line (so to speak) know who a particular board is going to? If not, they would have to add the extra chip to all outgoing boards, which means there should be plenty of them in the wild, no?
Post reply on HN