Supermicro boards were so bug ridden, why would hackers ever need implants? • Hacker News Board

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#61

Post by vel0city » Fri, Oct 12, 2018, 9:09 PM UTC

qaq wrote: post #3

I would guess that large companies are refreshing with known good firmware before deploying servers? So while described approach is easier prob will not get attacker as much.

Most BMC updates are handled in software on the BMC. You're giving the BMC a new image file to write and trusting the BMC to actually write it. Who's to say the BMC is dutifully writing that image to the flash memory? Who's to say it doesn't re-infect the image before writing?

Even if you do directly connect to the flash module and directly write to it through SPI, if the attack is being loaded by an additional module between the flash memory and the BMC, it could still inject additional data into the BMC's boot. If you're not physically listening to the SPI data being transmitted or knew what to look for in the final environment of the BMC, you wouldn't know it had happened.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#62

Post by fulafel » Fri, Oct 12, 2018, 9:20 PM UTC

rayiner wrote: post #10

I feel like this article reflects some significant technical confusion. The BMC is supposed to be on a trusted network inaccessible from the outside. I've always viewed authentication on the BMC as being like the numeric lock on luggage--it's designed to keep honest people honest, not for real security. Being able to bypass the BMC security is really not a big deal. What the Bloomberg article says about the hardware…

It's quite incompetent and negligent to put network connectors on servers that cause spectacular failures when exposed to a network.

A valid conclusion might indeed be to stop them being accessible from the outside, by installing such server boards in a network-topologically secure location such as a landfill.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#63

Post by zelon88 » Fri, Oct 12, 2018, 9:58 PM UTC

Not saying I believe in one side or the other, but from a standpoint of avoiding detection I think firmware hacking goes out the window.

A deep-pocketed attacker isn't going to risk flashing the firmware with a non-oem one on a brand new board leaving the factory. That probably gets quality inspected somehow later on anyway whereas a visual inspection is just a rubber stamp (IE: OK if the box isn't crushed or wet).

Not to mention a customer in the field who experiences problems is likely to report their firmware version to Supermicro support, whose poking around could expose the entire project.

There was an article recently about how hardware is "magic" and the IT world mostly takes it for granted. Putting an extra chip on the board but making it completely transparent to software debugging techniques is the best way to go. The board is almost certainly going to be flashed at least once and probably audited several times in it's lifespan by IT, but the hardware is never going to get more than some compressed air blown on it. Nobody repairs these things at the component level on a scale that matches how frequently firmware gets flashed or checked out.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#64

Post by eridius » Fri, Oct 12, 2018, 10:16 PM UTC

zelon88 wrote: post #63

Not saying I believe in one side or the other, but from a standpoint of avoiding detection I think firmware hacking goes out the window. A deep-pocketed attacker isn't going to risk flashing the firmware with a non-oem one on a brand new board leaving the factory. That probably gets quality inspected somehow later on anyway whereas a visual inspection is just a rubber stamp (IE: OK if the box isn't crushed or wet). N…

Maybe for smaller companies, but Apple is very paranoid and AIUI does indeed inspect the hardware to make sure it hasn't been tampered with. I know less about Amazon in this regard but I would expect Amazon to do at least some level of hardware inspection to detect tampering as well.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#65

Post by jacquesm » Fri, Oct 12, 2018, 10:41 PM UTC

rayiner wrote: post #19

stephengillie wrote: post #15

Earlier quoted context omitted.

BMCs like DRAC or iLO are invaluable when you have hundreds or thousands of fresh servers with no OS. The BMC lets you mount an OS or hypervisor ISO in a way reminiscent of DaemonTools et al. , and update bios and other firmware from a shared network folder. I'm pretty sure there's even an API to develop against.

BMC's are great--all my home builds have them because I'm too old to be fiddling around trying to figure out why a computer won't boot an installer from a USB key. But even on my home network the BMC's are on a separate switch on a subnet that doesn't have internet access except through a VPN gateway.

> except

There's your problem.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#66

Post by gcb0 » Fri, Oct 12, 2018, 10:41 PM UTC

gvb wrote: post #24

mhjas wrote: post #13

I don't really see why everyone is calling this implausible. Modchips have been around for at least 15 years. The idea of the clipper chip is 25 years old. At every hacker conference there are people "hacking" devices by various buses or interfaces. If there is anything working against the Bloomberg story it is that it is too plausible. Often reality clashes with imagination, but the Bloomberg story contains almost e…

It isn't implausible because of it being difficult and expensive, its implausible because there already exist much easier, cheaper, and (arguably) harder to detect ways of subverting SuperMicro motherboards. As a bonus, subverting the BMC firmware is much harder to trace to the source since it could be injected by in so many ways by so many different people. Why use a thermonuclear device when a hand grenade accompli…

the very arguments the article gives to shun off this attack is what i think makes it very possible and the best option. Scale.

NSA demand backdoor on CPUs. other States figure out how the backdoor works and how access to it is allowed on the silicon. Instead of attacking ever changing firmware and whatnot, just develop something that will work on that authentication component of the always-present backdoor. The backdoor interface won't change so often as it is dictated by the NSA and likely designed by a committee.

Done. Now the economies of scale allow you to just place that one component, which will work all over the place, for a very low price/complexity (all you really have to do is to place it in the input signal for the CPU and all it have to do is to filter a very specific pattern. the rest is just visual and camouflage).

This also gives you the benefit of not having to work a payload for your attack depending on capabilities. You will always have the same capabilities. It makes perfect sense. And makes it extremely cheap!

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#67

Post by csours » Fri, Oct 12, 2018, 10:44 PM UTC

BMC bug story time: I was working on automating health checks, and I needed some information from a BMC. The information was provided in XML format... fixed width. It's like something produced the document, and then output it to console, then copied from console to web service output.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#68

Post by vermilingua » Fri, Oct 12, 2018, 10:51 PM UTC

eridius wrote: post #64

zelon88 wrote: post #63

Not saying I believe in one side or the other, but from a standpoint of avoiding detection I think firmware hacking goes out the window. A deep-pocketed attacker isn't going to risk flashing the firmware with a non-oem one on a brand new board leaving the factory. That probably gets quality inspected somehow later on anyway whereas a visual inspection is just a rubber stamp (IE: OK if the box isn't crushed or wet). N…

Maybe for smaller companies, but Apple is very paranoid and AIUI does indeed inspect the hardware to make sure it hasn't been tampered with. I know less about Amazon in this regard but I would expect Amazon to do at least some level of hardware inspection to detect tampering as well.

Forgive my ignorance, but what hardware does Amazon sell?

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#69

Post by xyzzy123 » Fri, Oct 12, 2018, 11:12 PM UTC

jacquesm wrote: post #65

rayiner wrote: post #19

Earlier quoted context omitted.

BMC's are great--all my home builds have them because I'm too old to be fiddling around trying to figure out why a computer won't boot an installer from a USB key. But even on my home network the BMC's are on a separate switch on a subnet that doesn't have internet access except through a VPN gateway.

> except There's your problem.

I think the parent meant, you have them on a subnet with no default route, but have a vpn / management system with one interface pointing in to the management network. You can get in via the vpn but they can’t get out.

It’s a pretty common configuration.

Re: Supermicro boards were so bug ridden, why would hackers ever need implants?

#70

Post by tracker1 » Fri, Oct 12, 2018, 11:50 PM UTC

stevehawk wrote: post #26

saudioger wrote: post #8

Earlier quoted context omitted.

I can't cite this case specifically, but normally it would be incredibly difficult to impersonate a government official as a source. In my experience verifying a source means weeding out that possibility before publishing... e.g, cross-checking data from a third party (background checks, employment history, social media accounts, public records), then photos of credentials, video chats, etc. Then you cross-reference…

What has truly surprised me in all of this is the skepticism expressed about this being plausible. Most nerd sites are rife with thoughts on how insecure things are and hypothetical ideas on how something could be compromised but all of a sudden this one isn't possible? We know the US Gov't has done it in transit but it's ridiculous to think a state owned manufacturer wouldn't do it on the factory line? We know this…

I think that most rational people hold a state of natural disbelief to conspiracies in general. For example, 10 years ago, the thought of a government slurping up all network communications into large collections of data storage for later analysis seemed so unlikely. The cost of storage, the expanse, the inability to make any effective querying against the data... just made it seem highly unlikely.

Then you come to find out it's actually happening. It just seems like such a huge thing that's hard to comprehend. I, personally believe it's entirely plausible.