Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Happened with Supermicro?

hackaday.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: What Happened with Supermicro?

#81

Post by ksec »

patorjk wrote: post #9
lsc wrote: post #2

Huh. so shortly after the story broke, I bought a bunch of SMCI. (It's actually the first OTC stock I've ever bought. It was easier than I thought, too... I had to call vanguard to enable OTC trading, but after that? super easy.) I sold it months later, at a pretty good profit, mostly 'cause while I think the bloomburg accusations are clearly false, there are huge accounting irregularities surrounding supermicro; get…

When Tim Cook came out against the story, I did the same thing. It just didn't seem plausible that he would be lying. Then add to that Joe Fitzpatrick's (one of the named sources) discomfort about the story, and something seemed wrong. Time seems to have validated this idea somewhat, but it is interesting that Bloomberg has stood by the story.

Tim Cook lies about there were no settlement talk between Qualcomm and Apple. Although one could argue he spoke of it in January and the Settlement were in April, so may be they did all that negotiation in three months. Although I highly doubt it, I am siding with Steve Mollenkopf on this one, out of all the evidence given in court I think Qualcomm were extremely professional.

There were bunch of other things where I caught Tim Cook lying. Steve Jobs uses to be very deceptive when he needs to, his wording weren't clear cut and leads you to wrong assumption. Tim Cook doesn't have that talent.

And once you have been caught lying, you lose trust.

While I do have doubt on Bloomberg story, I am not going to trust sold on Tim Cook's word.

Re: What Happened with Supermicro?

#82

Post by tru3_power »

twblalock wrote: post #59
chipotle_coyote wrote: post #45

Earlier quoted context omitted.

Well, around $200-300K, based on checking prices on Zillow for what sure appear to be spaces in that mobile home park (around Oakland Road in San Jose, ZIP code 95131). I don't think I've ever seen a mobile home listed for a half-million even in this area, although I've seen ones the mid-$300s. (Granted, this is still nuts, given that in Sacramento or Tampa, the other places I've idly priced homes, these would be und…

What's amazing to me is that people are willing to pay high prices for a manufactured home in Silicon Valley even though the likelihood of the mobile home park's land being sold to developers is higher than anywhere else. This has already happened in a few places in the area. In Sunnyvale there are massive developments of million-dollar condos literally next door to mobile home parks. How much longer can those places…

Why is there such a disparity in quality of life for tech workers in SV? It seems like the housing crisis there will eventually stifle productivity (no one can afford to move there for entry level roles without giving up a ton). Are there some special dynamics that cause these types of scenarios except for the fact that a lot of people got rich quickly in one place?

Re: What Happened with Supermicro?

#83

Post by derefr »

ikeboy wrote: post #66
derefr wrote: post #37

Earlier quoted context omitted.

> it is interesting that Bloomberg has stood by the story My guess as to why: one of their reporters was misled by a trusted source, or multiple trusted sources (who were maybe actually catspaws of some-group-or-other who would benefit from getting this story out.) So now, although Bloomberg would like to speak truth by issuing a retraction, such a move would likely severely damage the original reporter's career; and…

In that scenario, the obvious solution is to publish a new story and name names of all the people who lied to get the story published. If you lie to a newspaper to get fake news published, you no longer have any right to remain off the record. That's what a newspaper with integrity would do.

Two scenarios:

Cynical scenario: the trusted-source catspaws have been reliable sources in the past, and will seemingly continue to be reliable sources in the future. This is their “price” for giving up reliable information for free—the ability to be used as a mouthpiece by their organization. Bloomberg accepts this deal, because they’re so useful otherwise.

Noble scenario: the sources didn’t want to transmit this information any more than Bloomberg wanted to receive it, but they were forced to (by, perhaps, a National Security Letter; or just generic “we’ll hurt your family” coercion); Bloomberg knows this, and doesn’t want to hurt the sources either, when it isn’t their fault (and either don’t know who coerced them; or do know, but know that it’s an actor powerful enough that they know that reporting the source’s coercion would just mean the source’s untimely death. It’s not like a newspaper is a government that can offer witness protection.)

Re: What Happened with Supermicro?

#84

Post by ikeboy »

derefr wrote: post #83
ikeboy wrote: post #66

Earlier quoted context omitted.

In that scenario, the obvious solution is to publish a new story and name names of all the people who lied to get the story published. If you lie to a newspaper to get fake news published, you no longer have any right to remain off the record. That's what a newspaper with integrity would do.

Two scenarios: Cynical scenario: the trusted-source catspaws have been reliable sources in the past, and will seemingly continue to be reliable sources in the future. This is their “price” for giving up reliable information for free—the ability to be used as a mouthpiece by their organization. Bloomberg accepts this deal, because they’re so useful otherwise. Noble scenario: the sources didn’t want to transmit this in…

Cynical version rings truer to me. But the number of different sources they claimed is surprising.

Re: What Happened with Supermicro?

#85

Post by notfromhere »

tru3_power wrote: post #82
twblalock wrote: post #59

Earlier quoted context omitted.

What's amazing to me is that people are willing to pay high prices for a manufactured home in Silicon Valley even though the likelihood of the mobile home park's land being sold to developers is higher than anywhere else. This has already happened in a few places in the area. In Sunnyvale there are massive developments of million-dollar condos literally next door to mobile home parks. How much longer can those places…

Why is there such a disparity in quality of life for tech workers in SV? It seems like the housing crisis there will eventually stifle productivity (no one can afford to move there for entry level roles without giving up a ton). Are there some special dynamics that cause these types of scenarios except for the fact that a lot of people got rich quickly in one place?

density restrictions and human greed

Re: What Happened with Supermicro?

#86

Post by closeparen »

tru3_power wrote: post #82
twblalock wrote: post #59

Earlier quoted context omitted.

What's amazing to me is that people are willing to pay high prices for a manufactured home in Silicon Valley even though the likelihood of the mobile home park's land being sold to developers is higher than anywhere else. This has already happened in a few places in the area. In Sunnyvale there are massive developments of million-dollar condos literally next door to mobile home parks. How much longer can those places…

Why is there such a disparity in quality of life for tech workers in SV? It seems like the housing crisis there will eventually stifle productivity (no one can afford to move there for entry level roles without giving up a ton). Are there some special dynamics that cause these types of scenarios except for the fact that a lot of people got rich quickly in one place?

Entry level roles are for fresh graduates. A converted living room is a step up from college and compatible with aggressive savings on a big-co wage. Entry level engineers willing to run smaller savings rates can even afford to live alone, though it can be a stretch.

Re: What Happened with Supermicro?

#87

Post by ikeboy »

derefr wrote: post #83
ikeboy wrote: post #66

Earlier quoted context omitted.

In that scenario, the obvious solution is to publish a new story and name names of all the people who lied to get the story published. If you lie to a newspaper to get fake news published, you no longer have any right to remain off the record. That's what a newspaper with integrity would do.

Two scenarios: Cynical scenario: the trusted-source catspaws have been reliable sources in the past, and will seemingly continue to be reliable sources in the future. This is their “price” for giving up reliable information for free—the ability to be used as a mouthpiece by their organization. Bloomberg accepts this deal, because they’re so useful otherwise. Noble scenario: the sources didn’t want to transmit this in…

The flip side is that on a story this big, they shouldn't publish if they won't be able to burn their sources if it turns out they're being played. If a source is too valuable to challenge, they're not worth enough to publish.

Spin is one thing, outright lies is another.

Re: What Happened with Supermicro?

#88

Post by lsc »

cantrevealname wrote: post #28
lsc wrote: post #2

Huh. so shortly after the story broke, I bought a bunch of SMCI. (It's actually the first OTC stock I've ever bought. It was easier than I thought, too... I had to call vanguard to enable OTC trading, but after that? super easy.) I sold it months later, at a pretty good profit, mostly 'cause while I think the bloomburg accusations are clearly false, there are huge accounting irregularities surrounding supermicro; get…

> I mean, people were tearing these boards apart, looking for anything. There's no way they could keep that quiet, even if they were willing to disappear people. Without commenting on whether or not I believe the Bloomberg story, I very much doubt that "people were tearing these boards apart", doing reverse hardware-level engineering looking for an unknown. Even in the case of open-source software, with full source c…

so by my reading of the article, it was extra chips... as I recall, it looked like some of them were hidden in the power supply (totally possible, if you can find some exploit on the I2C interface, but also probably fairly easy to detect)

(the story was that it was a Chinese subcontractor. Remember that SuperMicro is a Taiwanese company; I'm pretty sure that SuperMicro has less Chinese made content than any of the other major manufacturers of commodity server kit. )

I did know people cutting open power supplies, cutting open capacitors (a place chips have been hidden in the past) and otherwise examining the systems at the macro level.

I also knew people who managed networks of these things... and one of the bloomburg stories, as I recall, claimed that the hack was discovered via looking at the network as the BMC tried to phone home.

I mean, yes, you could do something more clever than that, replace a chip with one that looks identical, which uses the same traces that did something different, but the article certainly implied it was a more simple sort of thing.

I mean, if I was trying to compromise a BMC in that way, I'd just flash it with firmware that did what I needed (and this has happened before... to many different vendors) - my understanding of the bloomburg story was that there was some bit of hardware to re-flash the firmware to the compromised version after the user upgraded to a non-compromised version.

Re: What Happened with Supermicro?

#89

Post by lsc »

cantrevealname wrote: post #28
lsc wrote: post #2

Huh. so shortly after the story broke, I bought a bunch of SMCI. (It's actually the first OTC stock I've ever bought. It was easier than I thought, too... I had to call vanguard to enable OTC trading, but after that? super easy.) I sold it months later, at a pretty good profit, mostly 'cause while I think the bloomburg accusations are clearly false, there are huge accounting irregularities surrounding supermicro; get…

> I mean, people were tearing these boards apart, looking for anything. There's no way they could keep that quiet, even if they were willing to disappear people. Without commenting on whether or not I believe the Bloomberg story, I very much doubt that "people were tearing these boards apart", doing reverse hardware-level engineering looking for an unknown. Even in the case of open-source software, with full source c…

>Without commenting on whether or not I believe the Bloomberg story, I very much doubt that "people were tearing these boards apart", doing reverse hardware-level engineering looking for an unknown. Even in the case of open-source software, with full source code and documentation available, the number of people who analyze code is miniscule.

I can tell you people were literally tearing them apart; cutting open capacitors and the like (common place to hide extra components) pulling apart power supplies (as I recall, one of the bloomburg illustrations implied that something was in a power supply; I remember a long discussion of how you could compromise something over i2c from a chip actually in the psu) - I mean, sure, these things could be better hidden to the point where such techniques would be ineffective, but my reading of the bloomburg article was that they weren't particularly well-hidden, and that therefore they were discovered. Hiding that sort of thing from another EE who designs that sort of thing seems like it's probably pretty difficult.

(I mean, it is common to have compromised firmware; that's way easier. but that's also not what the bloomburg article was about)

But... yeah, I guess a lot of my assumption was based on my reading of the bloomburg article implying that this hardware was something tacked on in a detectible way; the sort of thing that could be done by some third-tier subcontractor. I acknowledge that if your attacker has the capability to produce ASICs that look just like the real thing and act just like the real thing out the same I/O pins, except in some rare case? yeah, that's not going to fall to this level of examination. but that wasn't my reading of the bloomburg story.

Furthermore, if an attacker went through that level of effort, they'd probably not just do it for supermicro. Most motherboards of the same generation are pretty similar; pretty heavily based on reference designs. If you were going to do something that sophisticated, that's where you'd attack.

If you were going to attack just one particular rev of one particular brand of a motherboard? well, something tacked on seems a lot more feasible.

Re: What Happened with Supermicro?

#90

Post by lsc »

cantrevealname wrote: post #28
lsc wrote: post #2

Huh. so shortly after the story broke, I bought a bunch of SMCI. (It's actually the first OTC stock I've ever bought. It was easier than I thought, too... I had to call vanguard to enable OTC trading, but after that? super easy.) I sold it months later, at a pretty good profit, mostly 'cause while I think the bloomburg accusations are clearly false, there are huge accounting irregularities surrounding supermicro; get…

> I mean, people were tearing these boards apart, looking for anything. There's no way they could keep that quiet, even if they were willing to disappear people. Without commenting on whether or not I believe the Bloomberg story, I very much doubt that "people were tearing these boards apart", doing reverse hardware-level engineering looking for an unknown. Even in the case of open-source software, with full source c…

>Even in the case of open-source software, with full source code and documentation available, the number of people who analyze code is miniscule.

I think... we might just live in different worlds? I'm a sysadmin and I maintain computers, but I am surrounded by serious programmers (I mean, kernel and system verilog types, not frontend people)

I have worked places where it was just me and the frontend folks, and in that case? yeah, It's kinda lonely when you need help on anything serious. But even then, with my social life being what it is now, I'd have people to ask if I was in that situation again at work.

I... usually don't have any trouble getting someone qualified to look at my backtraces when I have kernel panics, and I usually don't have trouble getting those people to give me patches. that requires analyzing the code.

I mean, sure, people don't spend a lot of time reading random code for no reason... but you give them a clue that something interesting is somewhere, and my experience? you can get plenty of help.

Post reply on HN