Super Micro says review found no malicious chips in motherboards • Hacker News Board

Re: Super Micro says review found no malicious chips in motherboards

#131

Post by vidarh » Tue, Dec 11, 2018, 3:52 PM UTC

ghaff wrote: post #63

stareatgoats wrote: post #56

Earlier quoted context omitted.

No, they shouldn't just walk away. They should apply sound journalistic principles to investigate exactly how they came to the conclusion, and then publish that investigation with full disclosure. Not sure if I've ever seen a news organization do that though (minimal retractions in a place no-one looks doesn't count).

CBS Killian Papers pretty much. There have been some significant examples but there actually aren’t that many cases of a major pub running a “scoop” that no other major pub runs with as well that turns out to be flat out wrong. There are certainly examples of mainstream media as a whole getting behind a story like lead-up to Iraq War but this is something different.

I think that's in large part because often many others will pile in by referring to the newspaper that ran it. I wouldn't count that in same class, as they're often "technically" not wrong in that they're reporting that "according to X, Y happened" rather than making the false claim that "Y happened".

The fake Hitler diaries would be one of the really major examples of this, where Stern, Newsweek and the Sunday Times ran the primary stories, and lots of other publications ran stories about the stories in those three.

And that's also a major example of the main sources taking a lot of flack afterwards, with firings, lawsuits, and books and movies about it afterwards, but it's not clear if it actually harmed the newspapers themselves. E.g. Murdoch has suggested the Sunday Times actually profited from it in the long run as Stern paid them back what they paid for access, and it boosted their subscription numbers even after the hoax was revealed.

Re: Super Micro says review found no malicious chips in motherboards

#132

Post by atoav » Tue, Dec 11, 2018, 3:53 PM UTC

admax88q wrote: post #97

bob_theslob646 wrote: post #55

Earlier quoted context omitted.

Their reporters are compensated based off of whether or not they move markets. Did you know that? ( https://www.businessinsider.com/bloomberg-reporters-compensa... )

That doesn't seem like a bad goal. It incentivizes stories that are important to their target market, and provides an easy way to measure that.

The thing is – if you have such an incentive and you are faced with the choice between reporting a boring truth or a spiced up lie, you will go for the later. And that has nothing to do with journalism anymore.

It _could_ work – if the editors are espeically on the hunt for bogus stories.

Re: Super Micro says review found no malicious chips in motherboards

#133

Post by danso » Tue, Dec 11, 2018, 3:56 PM UTC

crunchlibrarian wrote: post #46

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

When the state department tells you to write a story you write the story, or face the real prospect of the end of access which will be the end your journalism career. Not an ideal system for anyone, except the state department.

These reporters cover tech and ostensibly do not need access to the State Department. Nevermind the fact that the reporters who do cover the State Dept still enjoy access despite continuing to publish unflattering stories about the govt.

Re: Super Micro says review found no malicious chips in motherboards

#134

Post by ryanmercer » Tue, Dec 11, 2018, 3:56 PM UTC

creeble wrote: post #127

ryanmercer wrote: post #22

People worry about malicious chips in instances like this and I mean it's a valid concern but one method of attack I've always thought would be effective and extremely dangerous is strategic placing a component in a circuit that, if it fails, disables the entire device then you simply need a way to activate it. Radio. Design a circuit, or better something that appears to be a capacitor and functions as a capacitor bu…

Dude I think you need to understand more about radio before writing about it.

Care to actually point out a flaw instead of replying with a low-value comment that serves no purpose other than stroking your own ego?

Yes, another user has already established ELF would be bad. Microwave would work completely fine however.

A 34.9 mm x 9 mm strip antenna would work more than adequately. Transmission from a geostationary satellite, or better a passing aircraft, could penetrate most non-metal structures (at least into the outer rooms) and would work.

You could easily fit the entire circuit into capacitors used in many power supplies, taking out a power supply is enough to take out hardware long enough to begin an attack (especially if combined with digital attacks on the grid and other critical infrastructure) or to simply cause some sort of economic damages.

And actually, there's a certain type of Atari power brick that is prone to destroying Atari computers as they are highly prone to failure which causes excess voltage being pumped into the machine as the last act of the power supply. The dreaded 'ingot' power supply (part number C061982). Do you know how many people open up wall warts/power bricks? Basically zero and many are actually un-serviceable as they are epoxied shut.

Re: Super Micro says review found no malicious chips in motherboards

#135

Post by jancsika » Tue, Dec 11, 2018, 3:59 PM UTC

vertline3 wrote: post #57

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

If they are wrong about this, they can be wrong about anything. Gell-Mann Amnesia Effect.

You've been identified by Napier's "Black Rooster."

In order to figure out which servant was stealing from him, Napier instructed each to go in the shed and pet a magic rooster that he claimed could reveal to him who the thief was. In reality, Napier covered the rooster in soot. Thus he could identify the culprit-- it was the only servant who exited the shed without soot on their hands.

Here, you correctly applied one sense of the Gell-Mann amnesia effect-- a novelist's speculation about experts' inability/refusal to generalize their criticism of a news item within their field to the entire newspaper that contains it. In practice, however, "Gell-Mann amnesia effect" is a gambit that giving a proper name to rank speculation will cause the speculation to propagate as if it were an insight gleaned from a robust research project. If you had understood that part you would have used the rank speculation only an entry point for a comment that provided greater insight (or at least further rank speculation), rather than an insightful phenomenon unto itself.

Edit: In other words, you've emerged from the shed without anything other than someone's rank speculation masquerading as research. This makes it clear you've fallen for the 2nd-order effect of the term.

Also be wary of: Overton window

Re: Super Micro says review found no malicious chips in motherboards

#136

Post by wl » Tue, Dec 11, 2018, 3:59 PM UTC

makomk wrote: post #112

mtgx wrote: post #47

Earlier quoted context omitted.

The companies/shareholders being affected by this are free to sue the paper over defamation. Something tells me they won't.

They're free to sue the paper, but it'd be futile because the standard for such lawsuits to succeed in the US basically requires Bloomberg to have known that the claims were false. Just (say) completely ignoring normal journalistic practices to get a juicy scoop would not be enough.

Well, Rolling Stone settled over the UVA rape story. Then again, that settlement is rather small in the grand scheme of things. Given the nature of the case, maybe it was cheaper than going to trial.

https://www.nytimes.com/2017/06/13/business/media/rape-uva-r...

Edit: I forgot about this case, where they lost at trial. https://www.nytimes.com/2016/11/08/business/media/in-rolling...

Re: Super Micro says review found no malicious chips in motherboards

#137

Post by ineedasername » Tue, Dec 11, 2018, 4:01 PM UTC

assblaster wrote: post #2

The question I have is: is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?

Or could an auditor simply miss it? If the functionality were part of another legitimate chip?

Re: Super Micro says review found no malicious chips in motherboards

#138

Post by paganel » Tue, Dec 11, 2018, 4:01 PM UTC

albedoa wrote: post #86

Symmetry wrote: post #58

Earlier quoted context omitted.

It apparently wasn't the first time these reporters had gone off the rails.[1] [1] https://twitter.com/RobertMLee/status/1049617855396933632

One was also the author of the fake NSA Heartbleed exploit story, which Bloomberg stood by: https://twitter.com/nicoleperlroth/status/104901890298483507...

Any good sources on the NSA Heartbleed exploit story? A very quick search only gives me he said (Bloomberg) - he said (NSA) stories.

Re: Super Micro says review found no malicious chips in motherboards

#139

Post by jessaustin » Tue, Dec 11, 2018, 4:01 PM UTC

Karunamon wrote: post #95

jessaustin wrote: post #82

Earlier quoted context omitted.

I personally have learned more about the supply chain for various big tech firms. I have learned that something like what the original story described is possible , in that USA-based firms have no reliable way to prevent such hacking. That doesn't mean I believe Bloomberg's version, but then again I rarely do. I'm just not in such a hurry to believe SuperMicro's version either... We don't have to act as if we know wh…

The general case of hardware being backdoored is believable, but the problems come down to, not just the lack of any kind of corroborating evidence, but the nature of these specific claims themselves having some hard-to-believe holes in them. https://www.servethehome.com/investigating-implausible-bloom... Basic informational hygiene is that the claim is garbage until proven otherwise, "credibility" notwithstanding. T…

Haha, "credibility". A thing which does not exist.

Seriously, though, it seems that your idea of "basic informational hygiene" conflicts with a basic security posture in this case. We don't have to assume Super Micro has never been hacked, so I don't know why we would assume that. More in keeping with the topic of this thread, we don't have to assume the State Department (or whoever) has never caused a story to be published or discredited, so I don't know why we would assume that.

Re: Super Micro says review found no malicious chips in motherboards

#140

Post by ghaff » Tue, Dec 11, 2018, 4:01 PM UTC

joshstrange wrote: post #129

ghaff wrote: post #121

Earlier quoted context omitted.

TBH if you’re talking to a reporter, thats a bad way to answer a question. “It’s technically possible” is the sort of sound bite someone will grab while ignoring the 5 minute spiel on IPMI and bus interfaces etc. that follows. Be very careful about giving short quotable statements in plain English that you don’t want to see in print.

That's fair, I think it's also fair to point out that the people with the technical know-how about these things aren't often talked to by the press. I mean how many stories do you see about hardware tampering like this? They might not be very well versed in how to communicate with them. Also I know that I have a tendency to enjoy talking through possibilities and scenarios and so could see myself (I'm not a hardware…

It’s definitely a skill. I’ve caught myself saying something juicy that was off on a tangent or a bit misleading. Usually I’ll realize it and ask the reporter not to use it and they’ll honor that.

But, yes, even reporters that you know want to write a story that will be interesting to readers. As a source, feel free to provide educational background but be really careful about speculating about things if you don’t want that speculation in print.

An on the record conversation isn’t the same as an informal background chat with the same person over drinks. And I’m a bit careful even then.