Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Micro says review found no malicious chips in motherboards

reuters.com

Post reply on HN
Print view View original

291–300 of 355 posts

Re: Super Micro says review found no malicious chips in motherboards

#291

Post by ggggtez »

assblaster wrote: post #2

The question I have is: is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?

Could a TLA have silenced the real results? Sure, but that seems pretty unlikely. The US Government is not afraid to call out China for real or perceived threats right now (see tariffs). So the government itself silencing this would be pretty counter-intuitive.

I'd believe more that Super Micro is trying to save it's stock value, more than I'd believe government intervention. Of course, it could also just be faulty intelligence. Guess we'll have to wait and see what Bloomberg does with respect to whether they can get their sources on the record.

Re: Super Micro says review found no malicious chips in motherboards

#292

Post by kickopotomus »

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

This is pretty cool. I would also be interested in reading more about it if you made a blog post or some such. How did you manage to sync with SCL?

Re: Super Micro says review found no malicious chips in motherboards

#293

Post by jiveturkey »

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

> A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process.

please do elaborate on this uC that will be the size of an SMT resistor, in a 2 lead package.

Re: Super Micro says review found no malicious chips in motherboards

#294

Post by justtopost »

esmi wrote: post #286
catacombs wrote: post #192

Earlier quoted context omitted.

YUP. Unless SuperMicro hires an independent, third-party auditor, the ball is still in their court.

First sentance in the linked article. "Computer hardware maker Super Micro Computer Inc told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards." Further down "A person familiar with the analysis told Reuters it had been conducted by global firm Nardello & Co and that customers could ask for more detail on that company’s…

Does that firm have any technical acumen? Or just a supermicro contract for a result?

Re: Super Micro says review found no malicious chips in motherboards

#295

Post by lupire »

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

Hardware hacks are easy for anyone who works in that industry. What's hard is making software that runs on that hardware do anything useful -- it would need to communicate with external command&control and know how to read interesting data or send interesting effectful commands to the mainboard.

Making the main board fail arbitrarily would be easy, but controlling the board or exfiltrating data is hard.

Re: Super Micro says review found no malicious chips in motherboards

#296

Post by lupire »

CamperBob2 wrote: post #285
qaq wrote: post #268

Earlier quoted context omitted.

if you are a state actor implanting devices on your soil why would you care?

Ask Huawei or ZTE why. Corporations are state actors in China, and their actions have worldwide repercussions.

How are they relevant?

They are investigated for intentional business practices, not for secret hacks by unknown entities.

Re: Super Micro says review found no malicious chips in motherboards

#297

Post by lupire »

crispyambulance wrote: post #124
admax88q wrote: post #94

Earlier quoted context omitted.

> At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. That would be a mistake. Don't just throw your sources to the wolves if you couldn't prove their story. They should press their sources for proof, or stronger evidence. If they can't find any then they should issue a retraction.

The "should have" pressed the sources for hard proof, or found examples in the wild of adulterated servers before publishing the story. That ship has sailed, of course. But if what was reported was actually true the best thing that can happen now, for Bloomberg and the public, is for their sources to step forward voluntarily with proof. Admittedly, that will take a lot of courage in today's political climate, but if…

If the sources are willing to step forward now, why wouldn't they before?

Sometimes the reason for reporting evidence you have is to motivate other people to display evidence they have but don't know was interesting or useful until they saw your story. That's why so often a single public allegation leads to an avalanche of similar allegations.

Re: Super Micro says review found no malicious chips in motherboards

#298

Post by lupire »

aljones wrote: post #198
krn wrote: post #98

Earlier quoted context omitted.

Even if Bloomberg's story is completely true, Apple / Amazon / Super Micro might have no other choice, but to firmly deny it. Because in that case, it's United States vs. China, not just some publisher vs. a few publicly traded companies. When national security interests and international relationships between two largest economies in the world are at stake, it's not Tim Cook or Jeff Bezos, who get to decide, what ca…

You're claiming they can be compelled to lie.

Yes.

https://en.wikipedia.org/wiki/National_security_letter#Conte...

Re: Super Micro says review found no malicious chips in motherboards

#299

Post by lysp »

mtnGoat wrote: post #256

lets just say what bloomberg claims, was happening, really happened. this audit does nothing to disprove that. considering how many they sell and how many their mentioned clients have. picking a few at random to check is junk science. considering the adversary only needs one to be operating inside the datacenter.

That's exactly what I was thinking too.

Assuming it did happen, it would have focused on a small batch of servers to a small batch of clients.

They wouldn't have been installing this hack on every single server they produced.

So unless they pull every server for every major client and check, simply checking their warehouse stock proves nothing.

Re: Super Micro says review found no malicious chips in motherboards

#300

Post by CamperBob2 »

ghaff wrote: post #164
pstuart wrote: post #159

Earlier quoted context omitted.

> CBS Killian Papers pretty much Meh. I'm in the camp that believes Karl Rove pulled off one of his greatest dirty tricks of all time.

That would have been brilliant insofar as the Killian Papers pretty much blew up a legitimate news story, albeit one without quite such a visibly smoking gun. But I don't actually believe that.

Nothing out of the ordinary for people like Roger Stone or Karl Rove. That's what they did for a living for decades, and they were (are?) very good at it.
Post reply on HN