Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Micro says review found no malicious chips in motherboards

reuters.com

Post reply on HN
Print view View original

251–260 of 355 posts

Re: Super Micro says review found no malicious chips in motherboards

#251

Post by pwthornton »

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

It's difficult to sue a news organization, but you can sue them for false reporting if you prove two things A) actual malice occurred and B) you suffered economic damages.

If companies didn't lose money over this report, this is pretty moot. It's just embarrassing for Bloomberg.

If companies did lose money, the next step is proving that they knowingly went with a poorly-sourced story. That would require discovery, which may be fruitful.

Re: Super Micro says review found no malicious chips in motherboards

#252

Post by kayamon »

dragontamer wrote: post #199
pjc50 wrote: post #172

Earlier quoted context omitted.

A lot of people got hung up on the photos, but did the text actually state what they were or were they just "for illustrative purposes" like stock photos?

The source material is still on Bloomberg's website. Look at it, its a 0402 Decoupling Capacitor: https://www.bloomberg.com/toaster/v2/charts/85c4e100b7ab4a8b... The full article here: https://www.bloomberg.com/news/features/2018-10-04/the-big-h... ------- As for what that thing is... its this (or something like this): https://www.digikey.com/product-detail/en/avx-corporation/W2... That's an 8-pin decoupling capacito…

It literally says, in the very picture you linked to, that the chips were built to disguise as coupling capacitors.

Re: Super Micro says review found no malicious chips in motherboards

#253

Post by threeseed »

freeflight wrote: post #223
na85 wrote: post #162

Earlier quoted context omitted.

Regarding the five eyes sources, are we really expecting that intelligence agencies will give sources/proof?

If they want their claims to be taken seriously, then they really should. Without that, it's just hearsay, hearsay by agencies who have deceit as part of their job description and as such should be taken with a massive grain of salt. Imho they've also become shy about openly sharing sources because it allows them plausible deniability, they don't want an Iraq style curveball [0] all over again, where the attribution…

This argument is illogical.

They don’t share sources because simply it would reveal the sources. It has nothing to do with plausible deniability because they don’t care whether you believe them or not. The governments do and that’s all that matters.

Re: Super Micro says review found no malicious chips in motherboards

#255

Post by trhway »

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

>A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process.

And sandwich it between the PCB layers. No way to find even upon close up inspection without Xraying the board itself, and even interpreting the Xray image of modern multilayer board would be a nontrivial task. I dont think Supermicro did it, at least for statistically meaningful set of boards.

Re: Super Micro says review found no malicious chips in motherboards

#256

Post by mtnGoat »

lets just say what bloomberg claims, was happening, really happened. this audit does nothing to disprove that. considering how many they sell and how many their mentioned clients have. picking a few at random to check is junk science. considering the adversary only needs one to be operating inside the datacenter.

Re: Super Micro says review found no malicious chips in motherboards

#257

Post by phire »

trhway wrote: post #255
exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

>A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process. And sandwich it between the PCB layers. No way to find even upon close up inspection without Xraying the board itself, and even interpreting the Xray image of modern multilayer board would be a nontrivial task. I dont think Supermicro did it, at least for statistically mea…

Or just replace one of the existing chips on the i2c bus with an identical but malicious one.

I don't know how you would even detect that, short of decapping and scanning the die in.

Re: Super Micro says review found no malicious chips in motherboards

#258

Post by stupidbird »

usefulcat wrote: post #89
stupidbird wrote: post #80

Earlier quoted context omitted.

If newspapers were in it for the money they wouldn't be newspapers. It's not an incredibly lucrative business.

Correlation != causation. The fact that most newspapers aren't lucrative doesn't mean they don't value profit.

Sure, but they let everyone read this specific story for free. They could have easily kept it behind their paywall.

Overall Bloomberg as a company does not sustain itself on news revenue.

Re: Super Micro says review found no malicious chips in motherboards

#259

Post by stupidbird »

admax88q wrote: post #94
stupidbird wrote: post #77

There has to be more to this story that we don't know. Bloomberg has a lot to lose by publishing such a harsh claim that's not extremely fact-checked. Reliable newspapers generally don't throw around anonymous government sources without doing background checks on these people. I have little doubt that they got the information from who they say they did. At this point I wonder if they should stop protecting their sour…

> At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. That would be a mistake. Don't just throw your sources to the wolves if you couldn't prove their story. They should press their sources for proof, or stronger evidence. If they can't find any then they should issue a retraction.

Yeah that's fair, and an avenue they should take first.

Re: Super Micro says review found no malicious chips in motherboards

#260

Post by stupidbird »

aljones wrote: post #198
krn wrote: post #98

Earlier quoted context omitted.

Even if Bloomberg's story is completely true, Apple / Amazon / Super Micro might have no other choice, but to firmly deny it. Because in that case, it's United States vs. China, not just some publisher vs. a few publicly traded companies. When national security interests and international relationships between two largest economies in the world are at stake, it's not Tim Cook or Jeff Bezos, who get to decide, what ca…

You're claiming they can be compelled to lie.

If it's a national security risk they might not have needed to be compelled to lie at all, but decided to do so themselves. This would be big enough to damage their entire supply chain if they did publicly verify it as truth.
Post reply on HN