Super Micro says review found no malicious chips in motherboards • Hacker News Board

Re: Super Micro says review found no malicious chips in motherboards

#141

Post by ineedasername » Tue, Dec 11, 2018, 4:05 PM UTC

Evaluating this is tricky. On the one hand, Bloomberg claims it's a well sourced article, not a single person's unsubstantiated claim. On the other, Super Micro claims an audit showed nothing, but then they have an incentive to be less than honest, or to have performed a very superficial check. And couldn't an audit simply miss the issue if the malicious functionality were embedded in an otherwise legitimate chip?

Either way, it seems like Bloomberg really should have pushed for a particular example, e.g. "look at this on model X boards for confirmation"

Re: Super Micro says review found no malicious chips in motherboards

#142

Post by thetricia » Tue, Dec 11, 2018, 4:08 PM UTC

dijit wrote: post #41

thetricia wrote: post #33

So correct me if I'm wrong, but the most sinister part of the story in how some might assume SuperMicro is a Chinese or a MainlandChinese-founded company. It came right around the time ZTE, Huawei and others were facing renewed scrutiny. So you can imagine how easy it is to read the story and just think "oh, another Chinese company got busted".

It's also easy to read this as a smear campaign against Chinese companies.

Well the big difference is it's reasonable to assume a Mainland Chinese company could get banned or sanctioned in some manner.

Now just to be fair, from what I read, there was a lot of Super Micro drama going on beforehand which likely magnified the pessimism.

Btw if you search for 'supermicro "is a chinese"' you will find some people that do think that.

Re: Super Micro says review found no malicious chips in motherboards

#143

Post by danso » Tue, Dec 11, 2018, 4:08 PM UTC

deadbunny wrote: post #23

jamesholden wrote: post #6

Has Bloomberg even replied to the "Uhm, WTF you talking about Willis" responses from Apple/Amazon? I don't recall seeing one. I wonder what they will say now.. How can they just make up a story like this and it can slide?

To be super cynical: They got their ad revenue from the story, why would they care?

It’s doubtful that the ad revenues on even a highly-clicked story outweighed the cost of paying the reporters for the year they worked on this story, nevermind the costs of the editors and lawyers who pitched in over that year, or the reporting expenses (e.g. travel). Also, it’s well-known that Bloomberg’s news division is heavily subsidized by Bloomberg’s terminal customers.

Re: Super Micro says review found no malicious chips in motherboards

#144

Post by danso » Tue, Dec 11, 2018, 4:09 PM UTC

fallingfrog wrote: post #114

Not sure I believe this. Would anything bad happen to them if they just lied about it? Probably not. Unless they stepped on some politician's foot somehow.

Who is “they”?

Re: Super Micro says review found no malicious chips in motherboards

#145

Post by vertline3 » Tue, Dec 11, 2018, 4:13 PM UTC

jancsika wrote: post #135

vertline3 wrote: post #57

Earlier quoted context omitted.

If they are wrong about this, they can be wrong about anything. Gell-Mann Amnesia Effect.

You've been identified by Napier's "Black Rooster." In order to figure out which servant was stealing from him, Napier instructed each to go in the shed and pet a magic rooster that he claimed could reveal to him who the thief was. In reality, Napier covered the rooster in soot. Thus he could identify the culprit-- it was the only servant who exited the shed without soot on their hands. Here, you correctly applied on…

By saying I did not pet the rooster you are saying that I misapplied it in way that was lying. This is odious. They published a story not considering the feasability of it. People who knew better called them out.

Crichton himself noted the irony of it by using the famous name to attach greater importance to it. Yet he noted it is true that we will quickly forget when reading other stories and himself has called for turning away from media.

Finally Overton's Window for me is about framing debate and can be applied over broad areas.

Re: Super Micro says review found no malicious chips in motherboards

#146

Post by occamrazor » Tue, Dec 11, 2018, 4:14 PM UTC

atoav wrote: post #132

admax88q wrote: post #97

Earlier quoted context omitted.

That doesn't seem like a bad goal. It incentivizes stories that are important to their target market, and provides an easy way to measure that.

The thing is – if you have such an incentive and you are faced with the choice between reporting a boring truth or a spiced up lie, you will go for the later. And that has nothing to do with journalism anymore. It _could_ work – if the editors are espeically on the hunt for bogus stories.

This was the opening story on their homepage. There us no way the editors (and the legal department) did not scrutinize it thoroughly.

Re: Super Micro says review found no malicious chips in motherboards

#147

Post by John_KZ » Tue, Dec 11, 2018, 4:14 PM UTC

assblaster wrote: post #2

The question I have is: is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?

Looking back at this after the Huawei scandal, it seems very likely it was a preliminary step to create a negative impression regarding Chinese manufacturing. Bloomberg could have been lied to, or been chosen to deliver false stories for propaganda. Of course it could be irrelevant (there were tensions regardless) but given how everything looks weird, it probably wasn't.

Because no matter what the audits say, this article caused a widespread feeling of mistrust towards Chinese-manufactured electronics.

Re: Super Micro says review found no malicious chips in motherboards

#148

Post by Karunamon » Tue, Dec 11, 2018, 4:16 PM UTC

jessaustin wrote: post #139

Karunamon wrote: post #95

Earlier quoted context omitted.

The general case of hardware being backdoored is believable, but the problems come down to, not just the lack of any kind of corroborating evidence, but the nature of these specific claims themselves having some hard-to-believe holes in them. https://www.servethehome.com/investigating-implausible-bloom... Basic informational hygiene is that the claim is garbage until proven otherwise, "credibility" notwithstanding. T…

Haha, "credibility". A thing which does not exist. Seriously, though, it seems that your idea of "basic informational hygiene" conflicts with a basic security posture in this case. We don't have to assume Super Micro has never been hacked, so I don't know why we would assume that. More in keeping with the topic of this thread, we don't have to assume the State Department (or whoever) has never caused a story to be pu…

Hence the scare quotes :)

We're on the internet, a medium in which information can be trivially exchanged. Easily-defeated heuristics like "authority" and "credibility" are meaningless, if not harmful, when individual claims can (and should!) be evaluated on their own merits.

Basic security posture, sure, but nobody's arguing that we should change that and pretend that Supermicro is completely safe. Nothing is ever completely safe.

..but we're talking about a very specific claim which already has a number of gaping holes blown into it.

Re: Super Micro says review found no malicious chips in motherboards

#149

Post by meowface » Tue, Dec 11, 2018, 4:20 PM UTC

jancsika wrote: post #135

vertline3 wrote: post #57

Earlier quoted context omitted.

If they are wrong about this, they can be wrong about anything. Gell-Mann Amnesia Effect.

You've been identified by Napier's "Black Rooster." In order to figure out which servant was stealing from him, Napier instructed each to go in the shed and pet a magic rooster that he claimed could reveal to him who the thief was. In reality, Napier covered the rooster in soot. Thus he could identify the culprit-- it was the only servant who exited the shed without soot on their hands. Here, you correctly applied on…

I agree with your point, but that seems like a really weird and strained analogy.

Re: Super Micro says review found no malicious chips in motherboards

#150

Post by BooneJS » Tue, Dec 11, 2018, 4:22 PM UTC

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

I presume Bloomberg will release their raw data and pay for the audit. I’ve been wrong before.