Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Micro says review found no malicious chips in motherboards

reuters.com

Post reply on HN
Print view View original

331–340 of 355 posts

Re: Super Micro says review found no malicious chips in motherboards

#331

Post by kw71 »

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

I am having trouble understanding and believing.

How did you get an ostensible power terminal (for pull up) and two terminals for MiTM (input and output) from two terminals? Assuming a situation where there are other pullups on the wire, how did you assert the low state (short to ground) without a connection to ground?

Re: Super Micro says review found no malicious chips in motherboards

#332

Post by dang »

creeble wrote: post #127
ryanmercer wrote: post #22

People worry about malicious chips in instances like this and I mean it's a valid concern but one method of attack I've always thought would be effective and extremely dangerous is strategic placing a component in a circuit that, if it fails, disables the entire device then you simply need a way to activate it. Radio. Design a circuit, or better something that appears to be a capacitor and functions as a capacitor bu…

Dude I think you need to understand more about radio before writing about it.

This comment breaks the site guidelines. We ban accounts that do that, so please review https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here.

Re: Super Micro says review found no malicious chips in motherboards

#333

Post by dang »

ryanmercer wrote: post #134
creeble wrote: post #127

Earlier quoted context omitted.

Dude I think you need to understand more about radio before writing about it.

Care to actually point out a flaw instead of replying with a low-value comment that serves no purpose other than stroking your own ego? Yes, another user has already established ELF would be bad. Microwave would work completely fine however. A 34.9 mm x 9 mm strip antenna would work more than adequately. Transmission from a geostationary satellite, or better a passing aircraft, could penetrate most non-metal structur…

Please stop posting comments with nasty swipes or other flamebait in them, regardless of how bad some other comment is.

https://news.ycombinator.com/newsguidelines.html

Re: Super Micro says review found no malicious chips in motherboards

#334

Post by setquk »

exoesquitur wrote: post #233

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude a…

You can buy a $10 aliexpress logic analyser and lift data off a high speed bus easily. I've got a rather nice oscilloscope that actually does this.

However there's a massive disparity between that and actually modifying the bus data, pattern matching data going across it, delivering a payload effectively (watch how flakey serial busses get at high speeds), miniaturising and packaging the entire exploit, compromising supply chains and board reviews and inspection.

For an analogy, it's like donning a yellow jacket, necking half a bottle of whisky then carrying a bazooka across the whitehouse lawn.

I don't and never will buy this attack vector. They could have easily infiltrated the chipset manufacturer, but no they went through a huge number of difficult steps which leave thousands if not million of smoking guns around which are all traceable back to the source. Hmm...

Re: Super Micro says review found no malicious chips in motherboards

#335

Post by cbzbc »

shard wrote: post #321
kickopotomus wrote: post #289

Earlier quoted context omitted.

The distinction there is the type of device. Caps are not used on data lines. The parent comment is talking particularly about how the Bloomberg article kept referencing the attack vector as a disguised cap. The comment that you are referring to used a 2-pin device in place of the pull-up resistor on the SDA line of an I2C bus. That does seem fascinating and I would like to read more about it but I still have a lot o…

Caps can be used on data lines to filter out high frequency noise, as it forms an RC lowpass filter with the source impedence (see here for an example: https://jretest.com/understanding-data-signals/ ), although I do not know enough about motherboard design to know whether these caps are needed on any of the data lines.

On a motherboard the data is being carried at high frequency.

Re: Super Micro says review found no malicious chips in motherboards

#336

Post by [deleted] »

dang wrote: post #333
ryanmercer wrote: post #134

Earlier quoted context omitted.

Care to actually point out a flaw instead of replying with a low-value comment that serves no purpose other than stroking your own ego? Yes, another user has already established ELF would be bad. Microwave would work completely fine however. A 34.9 mm x 9 mm strip antenna would work more than adequately. Transmission from a geostationary satellite, or better a passing aircraft, could penetrate most non-metal structur…

Please stop posting comments with nasty swipes or other flamebait in them, regardless of how bad some other comment is. https://news.ycombinator.com/newsguidelines.html

[deleted]

Re: Super Micro says review found no malicious chips in motherboards

#337

Post by ryanmercer »

acct1771 wrote: post #221
ryanmercer wrote: post #10

Earlier quoted context omitted.

>is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? Absolutely possible, even somewhat plausible but unlikely. Conspiracies are hard to maintain "2 can keep a secret if 1 of them is dead". You could outright threaten someone with any number of means to get them to comply with your wishes, this is how espionag…

> Conspiracies are hard to maintain An oft repeated trope that holds no place in the repertoire of someone that's read history. Look as recently as the Manhattan Project for an example starkly to the contrary of your assertion. Large groups of people can conspire. It does happen, more than we can ever know.

>Look as recently as the Manhattan Project'

It didn't stay too secret, Soviet atomic spies penetrated the program.

Emil Julius Klaus Fuchs for example was convicted of supplying information from the American, British, and Canadian Manhattan Project to the Soviet Union during and shortly after the Second World War https://www.wikiwand.com/en/Klaus_Fuchs

https://www.wikiwand.com/en/Atomic_spies has other info about the spying attempts during the time.

Re: Super Micro says review found no malicious chips in motherboards

#338

Post by lawnchair_larry »

krn wrote: post #98
stupidbird wrote: post #77

There has to be more to this story that we don't know. Bloomberg has a lot to lose by publishing such a harsh claim that's not extremely fact-checked. Reliable newspapers generally don't throw around anonymous government sources without doing background checks on these people. I have little doubt that they got the information from who they say they did. At this point I wonder if they should stop protecting their sour…

Even if Bloomberg's story is completely true, Apple / Amazon / Super Micro might have no other choice, but to firmly deny it. Because in that case, it's United States vs. China, not just some publisher vs. a few publicly traded companies. When national security interests and international relationships between two largest economies in the world are at stake, it's not Tim Cook or Jeff Bezos, who get to decide, what ca…

Not correct. Instead of denying it, they could either confirm it, or non-denial deny it. They would not knowingly issue specific and categorical denials that are lies.
Post reply on HN