Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Micro says review found no malicious chips in motherboards

reuters.com

Post reply on HN
Print view View original

281–290 of 355 posts

Re: Super Micro says review found no malicious chips in motherboards

#281

Post by lulwot »

reissbaker wrote: post #247
Drdrdrq wrote: post #224

Earlier quoted context omitted.

Can't open the link because of rate limiting - hn effect? Anyway, is any phone-home spying? What if it phones US servers, say Google's? Unfortunately I can't think of a popular brand that doesn't spy on its users (no matter what the reasons are).

It's not just a phone-home. It's sending your entire browsing history (unencrypted!): every web request you make gets sent back to servers in China.

thats not entirely true, while isp's do get a copy of your plain text data if its not end to end encrypted(and likely offsell it), bgp routes would likely need to hijacked or somehow compromised while the data was in transit for a chinese server to get a copy of that data

Re: Super Micro says review found no malicious chips in motherboards

#282

Post by mirashii »

dragontamer wrote: post #270
kayamon wrote: post #252

Earlier quoted context omitted.

It literally says, in the very picture you linked to, that the chips were built to disguise as coupling capacitors.

I'm not sure if you understand my point then. Decoupling capacitors perform a very specific, and very easy to see function. They have two pins: C+ and C-, and the capacitor tries to keep C+ and C- at roughly the same voltage level across time. In particular, Decoupling capacitors are fully passive (non-powered) devices. Ex: If the C+ and C- pins are 3V (on the average), then a decoupling capacitor will help keep the…

> I haven't thought about it much, but its instinctively obvious that the 2-pins of a decoupling capacitor is insufficient to do any kind of hacking.

Your instincts seem to have deceived you. There's a top-level comment with a variety of replies that discusses a 2-pin device to snoop or modify data to an I2C device, and plenty of other literature documenting the feasibility of such devices.

Re: Super Micro says review found no malicious chips in motherboards

#283

Post by drak0n1c »

lioeters wrote: post #191
indigochill wrote: post #179

Earlier quoted context omitted.

c) report it as what it is: unsubstantiated hearsay. A story can be interesting and relevant but impossible to prove, and you can still report it honestly by simply making it clear what came from an anonymous source and what is verifiable fact. But it's very easy (and appears to have happened all over the place in this particular article) to cite what someone tells you as fact without making it clear you're just repo…

Regarding this last point, I'd call it a "dark pattern" in journalism - it's intentionally designed to trick readers.

This common dark pattern has a name for those interesting in reading news critically: https://en.wikipedia.org/wiki/Weasel_word

Re: Super Micro says review found no malicious chips in motherboards

#284

Post by fraudsyndrome »

ineedasername wrote: post #141

Evaluating this is tricky. On the one hand, Bloomberg claims it's a well sourced article, not a single person's unsubstantiated claim. On the other, Super Micro claims an audit showed nothing, but then they have an incentive to be less than honest, or to have performed a very superficial check. And couldn't an audit simply miss the issue if the malicious functionality were embedded in an otherwise legitimate chip? Ei…

Super Micro didn't perform the audit of themselves (that would be silly), it was done by Nardello & Co as per the article.

Re: Super Micro says review found no malicious chips in motherboards

#285

Post by CamperBob2 »

qaq wrote: post #268
4684499 wrote: post #265

Earlier quoted context omitted.

> Just saying it's a great (black hat) idea, and it works. How good is the idea while you could be caught with physical evidence?

if you are a state actor implanting devices on your soil why would you care?

Ask Huawei or ZTE why.

Corporations are state actors in China, and their actions have worldwide repercussions.

Re: Super Micro says review found no malicious chips in motherboards

#286

Post by esmi »

catacombs wrote: post #192
balthasar wrote: post #103

We have investigated ourselves and found nothing wrong.

YUP. Unless SuperMicro hires an independent, third-party auditor, the ball is still in their court.

First sentance in the linked article.

"Computer hardware maker Super Micro Computer Inc told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards."

Further down

"A person familiar with the analysis told Reuters it had been conducted by global firm Nardello & Co and that customers could ask for more detail on that company’s findings."

Re: Super Micro says review found no malicious chips in motherboards

#287

Post by qaq »

CamperBob2 wrote: post #285
qaq wrote: post #268

Earlier quoted context omitted.

if you are a state actor implanting devices on your soil why would you care?

Ask Huawei or ZTE why. Corporations are state actors in China, and their actions have worldwide repercussions.

There is no reason to impact domestic companies you can implant in US companies devices

Re: Super Micro says review found no malicious chips in motherboards

#288

Post by mrb »

esmi wrote: post #280
exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

This is very interesting. Can you be a bit more specific about the design? When you say you created a two terminal device; do you mean you have a PCB (or equivalent) with two IO pads which you soldered to the pads which would normally be occupied by I2C pull-up R, but on a different PCB. Basically, I'm wondering how the attiny85 was powered. Given your description, I'm guessing you made a local power well which float…

«Basically, I'm wondering how the attiny85 was powered»

You guys are overthinking this. Server motherboard PCBs are usually 4-8 layers with GND and VCC planes available near any component. The hackers, according to Bloomberg, modified the motherboards, so presumably they would simply add vias to the GND and VCC planes to power their rogue chip. You don't gain much by going the trouble of making the chip self-powered by leeching current from the SPI line... The vias that bring power to the chip can be hidden within layers (it's a standard thing to do) It would not even be detectable by a visual inspection. You would have to x-ray the PCB to detect it.

I'm with the GP. I've said it before (https://news.ycombinator.com/item?id=18146566): the presumed hack described by Bloomberg is actually not that hard, and perfectly doable. All the attacker has to do is compromise the PCB manufacturer. Actually not even that. He would swap a box of legit PCBs with a box of compromised PCBs when they are in transit from the PCB manufacturer to the assembler. The assembler (the one who solders components on the PCB) wouldn't suspect a thing because normally PCBs are just passive things. No chip. No logic. No firmware. Just stupid layers of copper that either work (conduct electricity) or don't. That's why no one pays attention to PCB manufacturers and instead supply chain security is focused on everything higher in the chain: the providers of components, the assemblers, the distributors, etc.

This Supermicro rogue chip story is in fact an attack much less advanced than some real-world attacks we have seen, like Stuxnet which exploited four(!) zerodays...

Re: Super Micro says review found no malicious chips in motherboards

#289

Post by kickopotomus »

mirashii wrote: post #282
dragontamer wrote: post #270

Earlier quoted context omitted.

I'm not sure if you understand my point then. Decoupling capacitors perform a very specific, and very easy to see function. They have two pins: C+ and C-, and the capacitor tries to keep C+ and C- at roughly the same voltage level across time. In particular, Decoupling capacitors are fully passive (non-powered) devices. Ex: If the C+ and C- pins are 3V (on the average), then a decoupling capacitor will help keep the…

> I haven't thought about it much, but its instinctively obvious that the 2-pins of a decoupling capacitor is insufficient to do any kind of hacking. Your instincts seem to have deceived you. There's a top-level comment with a variety of replies that discusses a 2-pin device to snoop or modify data to an I2C device, and plenty of other literature documenting the feasibility of such devices.

The distinction there is the type of device. Caps are not used on data lines. The parent comment is talking particularly about how the Bloomberg article kept referencing the attack vector as a disguised cap.

The comment that you are referring to used a 2-pin device in place of the pull-up resistor on the SDA line of an I2C bus. That does seem fascinating and I would like to read more about it but I still have a lot of reservations about real-world applications.

Re: Super Micro says review found no malicious chips in motherboards

#290

Post by kickopotomus »

jorblumesea wrote: post #158

Is anyone at all surprised that a company investigated itself and found nothing wrong? It might be true, it might be false, but there's an obvious conflict of interest here.

They did not investigate themselves. The audit was performed by Nardella & Co as stated in the article.
Post reply on HN