Super Micro says review found no malicious chips in motherboards • Hacker News Board

Re: Super Micro says review found no malicious chips in motherboards

#311

Post by dsl » Wed, Dec 12, 2018, 2:23 AM UTC

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

I don't know why anyone is doubting this is possible in the first place. From the Snowden leaks we know in 2008 the NSA had an _entire computer_ complete with CPU RAM and an FPGA smaller than the size of a dime [1] that they implanted inside other devices.

The NSA was also actively using COTTONMOUTH II [2] which was a USB header for a motherboard that could be inserted into the supply chain and provided a long range transceiver for software implants to bypass airgapped networks.

Ten years on I would not be surprised that the Chinese have a similar tool in an even smaller form factor. People seem to be treating this like a futuristic sci-fi plot.

1. https://upload.wikimedia.org/wikipedia/commons/c/cc/NSA_MAES... 2. https://leaksource.files.wordpress.com/2013/12/nsa-ant-cotto...

Re: Super Micro says review found no malicious chips in motherboards

#312

Post by macintux » Wed, Dec 12, 2018, 2:25 AM UTC

ksec wrote: post #88

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

SuperMicro, Apple, Amazon, and others could sue Bloomberg. But they didn't. I guess if you sue every news outlet for Rumours then Apple would be basically suing everyone. My problem is, why Apple and Amazon has such as "restrained" action to Bloomberg. May be the story isn't true, but something do smells fishy to me.

This is the same logic Musk applied to “pedo guy” and it was just as ridiculous then. A lack of legal action is in no way an admission that the story was accurate.

Re: Super Micro says review found no malicious chips in motherboards

#313

Post by pstuart » Wed, Dec 12, 2018, 2:31 AM UTC

ufmace wrote: post #200

pstuart wrote: post #159

Earlier quoted context omitted.

> CBS Killian Papers pretty much Meh. I'm in the camp that believes Karl Rove pulled off one of his greatest dirty tricks of all time.

Presuming it was him, the story would go like "I'll create a blatantly forged document that confirms a narrative that CBS wants to push and send it to them. I expect they will publish it immediately with no fact checking whatsoever, double down when called out on it, and the entire rest of the mainstream media will stick behind them." Now if that's the story... I'm not saying Karl Rove is an angel or anything, but th…

The genius of what I'm accusing him of is this: the story itself was real (Bush going AWOL; taking advantage of his father's position).

Why not make a document that ostensibly validates that and bake in the fact that it was a forgery to be revealed so that all focus is on the forgery and not the facts that Bush shirked his service?

It's a brilliantly devious move and exactly the type of thing Rove would do (e.g., bugging his own office and then accusing his opponent of the misdeed, etc. etc)

https://theintercept.com/2015/10/27/george-w-bush-was-awol-b...

https://www.seattlepi.com/local/opinion/article/Rove-s-dirty...

Re: Super Micro says review found no malicious chips in motherboards

#314

Post by gdy » Wed, Dec 12, 2018, 2:45 AM UTC

Symmetry wrote: post #78

scarhill wrote: post #49

Earlier quoted context omitted.

WRT the how could they get it so wrong question, I guess it's time for the obligatory link to Michael Crichton's essay "Why Speculate?" and his discussion of the "Murray Gell-Mann Amnesia Effect" [1] Money quote: "You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either t…

There really are some publications where you can read an article on a topic you're familiar with and they get it right. For instance I have a subscription to The Economist and sometimes their coverage is a bit shallow. And sometimes it repeats an expert consensus I disagree with. But most of the time the coverage is as good as it can be in the number of paragraphs allotted and sometimes it's downright excellent[1]. Y…

Except for almost any article about Russia.

Re: Super Micro says review found no malicious chips in motherboards

#315

Post by kryogen1c » Wed, Dec 12, 2018, 2:49 AM UTC

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

The argument that Bloomberg's claim doesn't pass the smell test never originated from the fact that aftermarket out of band management controllers aren't possible, but that it's extremely unlikely that no one ever noticed at any stage.

Some hack targets multiple megacorporations that also lead the technical revolution and all those companies go out of their way to explicitly deny anything ever happened? Undetected arbitrary code execution is one thing, but what was the exfil plan that also avoids a totally separate detection system?

On top of that, these authors are known publishers of bad technical stories?

Possible was never the problem, but the total lack of evidence and massive unlikeliness just doesn't add up.

Re: Super Micro says review found no malicious chips in motherboards

#316

Post by ksec » Wed, Dec 12, 2018, 3:00 AM UTC

macintux wrote: post #312

ksec wrote: post #88

Earlier quoted context omitted.

SuperMicro, Apple, Amazon, and others could sue Bloomberg. But they didn't. I guess if you sue every news outlet for Rumours then Apple would be basically suing everyone. My problem is, why Apple and Amazon has such as "restrained" action to Bloomberg. May be the story isn't true, but something do smells fishy to me.

This is the same logic Musk applied to “pedo guy” and it was just as ridiculous then. A lack of legal action is in no way an admission that the story was accurate.

Accusing two Trillion dollar company with allegation on a national security level from a reasonably respected Business Journal is not the same as Mush calling another guy pedo.

Although I do agree A lack of legal action is in no way an admission that the story was accurate, I just thought they should do something more.

Re: Super Micro says review found no malicious chips in motherboards

#317

Post by aljones » Wed, Dec 12, 2018, 3:02 AM UTC

stupidbird wrote: post #260

aljones wrote: post #198

Earlier quoted context omitted.

You're claiming they can be compelled to lie.

If it's a national security risk they might not have needed to be compelled to lie at all, but decided to do so themselves. This would be big enough to damage their entire supply chain if they did publicly verify it as truth.

You're claiming they'd commit fraud.

Re: Super Micro says review found no malicious chips in motherboards

#318

Post by asimpletune » Wed, Dec 12, 2018, 3:24 AM UTC

trhway wrote: post #255

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

>A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process. And sandwich it between the PCB layers. No way to find even upon close up inspection without Xraying the board itself, and even interpreting the Xray image of modern multilayer board would be a nontrivial task. I dont think Supermicro did it, at least for statistically mea…

I don’t think they have to use xrays. I heard that they spin the boards and measure the angular momentum with very sensitive equipment. I don’t know how you could get around that.

Re: Super Micro says review found no malicious chips in motherboards

#319

Post by Spooky23 » Wed, Dec 12, 2018, 3:30 AM UTC

Symmetry wrote: post #78

scarhill wrote: post #49

Earlier quoted context omitted.

WRT the how could they get it so wrong question, I guess it's time for the obligatory link to Michael Crichton's essay "Why Speculate?" and his discussion of the "Murray Gell-Mann Amnesia Effect" [1] Money quote: "You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either t…

There really are some publications where you can read an article on a topic you're familiar with and they get it right. For instance I have a subscription to The Economist and sometimes their coverage is a bit shallow. And sometimes it repeats an expert consensus I disagree with. But most of the time the coverage is as good as it can be in the number of paragraphs allotted and sometimes it's downright excellent[1]. Y…

The Economist is good, but tiring. They are sort of like an old school “chamber of commerce” republican version of NPR.

The writing is good and interesting, until to read for a year and realize that formula is pretty much the same, and you can predict the arc of the article after reading a paragraph.

Re: Super Micro says review found no malicious chips in motherboards

#320

Post by Spooky23 » Wed, Dec 12, 2018, 3:42 AM UTC

thetricia wrote: post #33

So correct me if I'm wrong, but the most sinister part of the story in how some might assume SuperMicro is a Chinese or a MainlandChinese-founded company. It came right around the time ZTE, Huawei and others were facing renewed scrutiny. So you can imagine how easy it is to read the story and just think "oh, another Chinese company got busted".

Which makes the idea that a US intelligence agency is setting up Supermicro really dumb on its face. The reality is that the company is poorly run and has a lot of resources and background in Taiwan.

If there’s a nefarious nation-state plot, it’s more likely a Chinese one intended to demonstrate their ability to disrupt commerce. Any of the big vendors (HP[E], Lenovo, Dell, etc) are toast without their offshore partners.