Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supermicro boards were so bug ridden, why would hackers ever need implants?

arstechnica.com

Post reply on HN
Print view View original

51–60 of 81 posts

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#51

Post by kickopotomus »

bdamm wrote: post #48
kickopotomus wrote: post #36

Earlier quoted context omitted.

This is why I am skeptical. I will not presume to know how Supermicro and Elemental operate but I find it unlikely that this would go unnoticed by both of them. The guys I work with raise hell if CRCs on firmware images don't match, much less a BOM change. There are a lot of QA breakdowns that have to happen after manufacturing for this sort of attack to be successful. Could it happen? Sure, but there should be some…

Eh... it's not quite that simple. Checking the firmware before it goes into the device is not the issue. It's after the firmware is in the (integrated) device that it's an issue. How do you check that? You have to boot the device to calculate the CRC. Now assume that the device's bootloader is compromised and that the device actually has more internal storage than you thought. Now what? Ensuring correctness of firmwa…

I just brought up the CRCs as an example of due diligence. This attack, as I understand it, hinges on a design and BOM change to the board. So my question is how did that change manage to make it past both Supermicro and Elemental?

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#52

Post by gvb »

mhjas wrote: post #43
gvb wrote: post #24

Earlier quoted context omitted.

It isn't implausible because of it being difficult and expensive, its implausible because there already exist much easier, cheaper, and (arguably) harder to detect ways of subverting SuperMicro motherboards. As a bonus, subverting the BMC firmware is much harder to trace to the source since it could be injected by in so many ways by so many different people. Why use a thermonuclear device when a hand grenade accompli…

I just don't think the relationship between those two things you are describing exists. If the Chinese government approaches a Chinese manufacturer with the goal of compromising US software companies adding some sort of chip that reconfigured the hardware would be the most straight forward thing for them to do. If anything I think the idea that a Chinese manufacturer with complete access to the hardware having to exe…

The "chip that reconfigured the hardware" is already built in; it's the BMC.

All the Chinese government has to do is go to the factory and tell them "flash the BMC firmware with this image" where the image is subverted (but operationally indistinguishable) BMC firmware. It doesn't get much more straight forward than that.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#53

Post by trhway »

mhjas wrote: post #13

I don't really see why everyone is calling this implausible. Modchips have been around for at least 15 years. The idea of the clipper chip is 25 years old. At every hacker conference there are people "hacking" devices by various buses or interfaces. If there is anything working against the Bloomberg story it is that it is too plausible. Often reality clashes with imagination, but the Bloomberg story contains almost e…

> Often reality clashes with imagination

Often reality follows [somebody's] imagination - i mean you have those think tanks where people sit and imagine things, and the sponsoring agencies like CIA/Pentagon/NSA or their foreign equivalents take many of that and implement. Many people everywhere had the thought of full remote control of the computers - Intel implemented it as Intel ME feature of CPU because Intel controls CPU. China controls motherboards, so they did on the motherboards.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#54

Post by amelius »

rayiner wrote: post #10

I feel like this article reflects some significant technical confusion. The BMC is supposed to be on a trusted network inaccessible from the outside. I've always viewed authentication on the BMC as being like the numeric lock on luggage--it's designed to keep honest people honest, not for real security. Being able to bypass the BMC security is really not a big deal. What the Bloomberg article says about the hardware…

> The BMC is supposed to be on a trusted network inaccessible from the outside.

After it left the factory. But can't the firmware be installed by someone while the board is in the testing phase?

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#55

Post by stephengillie »

joshgachnang wrote: post #25
stephengillie wrote: post #15

Earlier quoted context omitted.

BMCs like DRAC or iLO are invaluable when you have hundreds or thousands of fresh servers with no OS. The BMC lets you mount an OS or hypervisor ISO in a way reminiscent of DaemonTools et al. , and update bios and other firmware from a shared network folder. I'm pretty sure there's even an API to develop against.

There's definitely an API. It's a core part of OpenStack Ironic, which lets you automate bootstrapping them like you described (for example, to put the rest of your OpenStack cloud on top of).

The name is probably a reference to bare metal devices - "Iron-ic", but seems oddly apropos here.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#56

Post by vel0city »

gvb wrote: post #52
mhjas wrote: post #43

Earlier quoted context omitted.

I just don't think the relationship between those two things you are describing exists. If the Chinese government approaches a Chinese manufacturer with the goal of compromising US software companies adding some sort of chip that reconfigured the hardware would be the most straight forward thing for them to do. If anything I think the idea that a Chinese manufacturer with complete access to the hardware having to exe…

The "chip that reconfigured the hardware" is already built in; it's the BMC. All the Chinese government has to do is go to the factory and tell them "flash the BMC firmware with this image" where the image is subverted (but operationally indistinguishable) BMC firmware. It doesn't get much more straight forward than that.

There are attacks where flashing a malicious firmware on to the device prevents real firmware flashing (just updates version numbers, re-infects the flashing payload on write, etc). However, those attacks can be mitigated by physically connecting to the flash module and writing to the device directly through SPI. If you've got a chip between the BMC and the flash memory as the report suggests, it can re-infect the memory even when you're done. You could even read the contents of the flash memory directly and find no evidence of the attacker, as the attack code might never actually write to the memory and may only load when the BMC boots and attempts to read from the flash memory.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#57

Post by stevehawk »

kickopotomus wrote: post #51
bdamm wrote: post #48

Earlier quoted context omitted.

Eh... it's not quite that simple. Checking the firmware before it goes into the device is not the issue. It's after the firmware is in the (integrated) device that it's an issue. How do you check that? You have to boot the device to calculate the CRC. Now assume that the device's bootloader is compromised and that the device actually has more internal storage than you thought. Now what? Ensuring correctness of firmwa…

I just brought up the CRCs as an example of due diligence. This attack, as I understand it, hinges on a design and BOM change to the board. So my question is how did that change manage to make it past both Supermicro and Elemental?

Simply put, they never checked?

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#58

Post by mhjas »

gvb wrote: post #52
mhjas wrote: post #43

Earlier quoted context omitted.

I just don't think the relationship between those two things you are describing exists. If the Chinese government approaches a Chinese manufacturer with the goal of compromising US software companies adding some sort of chip that reconfigured the hardware would be the most straight forward thing for them to do. If anything I think the idea that a Chinese manufacturer with complete access to the hardware having to exe…

The "chip that reconfigured the hardware" is already built in; it's the BMC. All the Chinese government has to do is go to the factory and tell them "flash the BMC firmware with this image" where the image is subverted (but operationally indistinguishable) BMC firmware. It doesn't get much more straight forward than that.

It is straight forward to compromise the BMC, it isn't straight forward to hide a backdoor in the BMC in front of some of the best security researchers in the world. Especially with such attack being well known and seemingly trivial to check for.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#59

Post by vel0city »

kickopotomus wrote: post #36
creeble wrote: post #30

Earlier quoted context omitted.

I don't hear skepticism on plausibility. I just hear skepticism based on lack of actual evidence, as there has been, to date, exactly zero. For a hardware back that could only have been done at a large scale.

This is why I am skeptical. I will not presume to know how Supermicro and Elemental operate but I find it unlikely that this would go unnoticed by both of them. The guys I work with raise hell if CRCs on firmware images don't match, much less a BOM change. There are a lot of QA breakdowns that have to happen after manufacturing for this sort of attack to be successful. Could it happen? Sure, but there should be some…

Depending on what the chip did, the CRC on a firmware image may not actually change. If the chip was just listening to the SPI lines to the BMC's load, it could just inject additional data into the stream. The flash chip on the board could be 100% legit, but the final image loaded on to the BMC might be malicious. Do you really CRC the entire BMC environment after boot, or just check the image when you go to update the BMC?

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#60

Post by csours »

justinjlynn wrote: post #23
rayiner wrote: post #10

I feel like this article reflects some significant technical confusion. The BMC is supposed to be on a trusted network inaccessible from the outside. I've always viewed authentication on the BMC as being like the numeric lock on luggage--it's designed to keep honest people honest, not for real security. Being able to bypass the BMC security is really not a big deal. What the Bloomberg article says about the hardware…

> a trusted network inaccessible from the outside There is no such practical network which remains such a network for long. All networks must be assumed to be byzantine as they certainly will be compromised at some point, if they're not already.

I think this is the first time I've seen byzantine used like this - I assume you are referring to the Byzantine Generals problem.
Post reply on HN