Identifying Risky Counterfeit Intel Gigabit CT Network Adapters • Hacker News Board

Re: Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

#21

Post by jaclaz » Fri, Jul 12, 2019, 4:34 PM UTC

kube-system wrote: post #20

jaclaz wrote: post #17

Earlier quoted context omitted.

>If you accept that running random binaries is a security risk, than running counterfeit hardware that runs arbitrary software is a greater risk! Undoubtedly, what is IMHO missing is any proof that the counterfeit hardware (besides being likely of inferior quality) is actually running arbitrary software.

A good risk assessment starts by evaluating possible attack vectors before they’re exploited. If you wait until they’re actively exploited, you might find yourself dealing with an incident response instead. Another big component of risk is trustworthiness. You might evaluate a vendor’s reputation, test/qa processes, support channels, and the legal environment they operate in. If you don’t even know who the vendor is,…

In other words, don't buy on Amazon, particularly by third-party marketplace.

Re: Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

#22

Post by kube-system » Fri, Jul 12, 2019, 5:20 PM UTC

jaclaz wrote: post #21

kube-system wrote: post #20

Earlier quoted context omitted.

A good risk assessment starts by evaluating possible attack vectors before they’re exploited. If you wait until they’re actively exploited, you might find yourself dealing with an incident response instead. Another big component of risk is trustworthiness. You might evaluate a vendor’s reputation, test/qa processes, support channels, and the legal environment they operate in. If you don’t even know who the vendor is,…

In other words, don't buy on Amazon, particularly by third-party marketplace.

Not necessarily. Validating the authentication labels on a device might give someone enough confidence they can trust it for their particular threat model. While resellers add a definite uncertainty to the security of the supply chain, I think most people would find them to be more trustworthy than a counterfeiting manufacturer.

Re: Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

#23

Post by blackflame7000 » Fri, Jul 12, 2019, 6:23 PM UTC

LUmBULtERA wrote: post #13

rasz wrote: post #10

Earlier quoted context omitted.

>authentication Where? Intel sells network chips to OEMs, one of the more shady ones decided to directly clone Intel PCB.

In this case, are you saying the answer is "Yes, official Intel drivers will work on a counterfeit card," and it is not possible for Intel to include anything in the driver or hardware that can perform authentication? I was asking because I don't know.

They could but its simply too expensive to add something like a secure enclave to a device this cheap. Maybe on your high-end 10-100 GBe adapters that sell for 100s of dollars, it makes sense. I just don't think they are aware of the problem to the degree that they would make such big changes.

Re: Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

#24

Post by blackflame7000 » Fri, Jul 12, 2019, 6:29 PM UTC

w3rhn2j34oh5o wrote: post #19

jaclaz wrote: post #17

Earlier quoted context omitted.

>If you accept that running random binaries is a security risk, than running counterfeit hardware that runs arbitrary software is a greater risk! Undoubtedly, what is IMHO missing is any proof that the counterfeit hardware (besides being likely of inferior quality) is actually running arbitrary software.

And thats the challenge, you can't ever really know that the firmware, or even the logic implemented in silicon is identical. You don't need evidence that it is different, it is impossible to know, one must assume it could be, thus a security risk.

Yes, you can, that's what driver signing is for on the OS side. An authentic driver can then tell if it's talking to a counterfeit firmware. In the early days of the Xbox 360, the first hack was to modify the DVD drive firmware so that it would disable the security check that validates authentic Xbox discs and you could play burned games. After a while, Microsoft figured this out and started banning consoles. How did they do this? They simply compared the firmware images and detected a different checksum. There's no real good way to hide this because different code produces different binaries which is what firmware is. If you can flash the drive then you can read its memory and see it's not original.

To give an analogy, if we are both running a calculator app that should be identical, but your call stack looks vastly different after we do identical operations, something is fishy.

Re: Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

#25

Post by kube-system » Sat, Jul 13, 2019, 12:29 AM UTC

blackflame7000 wrote: post #24

w3rhn2j34oh5o wrote: post #19

Earlier quoted context omitted.

And thats the challenge, you can't ever really know that the firmware, or even the logic implemented in silicon is identical. You don't need evidence that it is different, it is impossible to know, one must assume it could be, thus a security risk.

Yes, you can, that's what driver signing is for on the OS side. An authentic driver can then tell if it's talking to a counterfeit firmware. In the early days of the Xbox 360, the first hack was to modify the DVD drive firmware so that it would disable the security check that validates authentic Xbox discs and you could play burned games. After a while, Microsoft figured this out and started banning consoles. How did…

I doubt intel is doing that in this case, as we’re talking about a NIC and not a DRM enforcement mechanism.

...but even if they are, checking a firmware checksum only mitigates risk if you otherwise trust the hardware.

Counterfeit silicon could report back whatever your driver wants to hear. And even the presence of a a genuine intel chipset with genuine firmware doesn’t mean there isn’t a malicious component elsewhere on the board.

There’s tons of counterfeit silicon out there.

Most of them are just cheap approximations or copies of premium components with the motive to make a profit on their sale, but there’s not much preventing any of them from intentionally or unintentionally compromising their hardware.

The popularity of programmable silicon and the standardization of silicon package sizes make this super cheap and easy to do as well.

Re: Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

#26

Post by neilv » Sat, Jul 13, 2019, 3:16 AM UTC

Doxin wrote: post #15

neilv wrote: post #6

Earlier quoted context omitted.

A different article, linked by the HN post one, shows much better quality screen-printing logos on a counterfeit card than on the counterfeit in the immediate article: https://forums.servethehome.com/index.php?threads/comparison... Though I can't see an FCC logo in the different article's photos. (I also can't see an FCC logo on the different model of supposedly-Intel quad-gigabit PCIe card of mine I just looked at.)

It's a general quick way to check, it'll not always work. A bodged FCC logo means it's almost certainly a counterfeit. A proper or missing FCC logo means near nothing. I just noticed the bodged FCC logo in the original article, that's all. sometimes you can spot similar shenanigans based on the CE logo but that's more rare.

Thanks. Sometimes, with counterfeits of various kinds of electronics products, I've wondered whether there was ever an intentional telltale indicator. So that country or other entity never accidentally got a counterfeit into a supply chain where they really didn't want it to be. (For example, not into the parts supply chain of a high-profile device manufactured there. Nor to ruin domestic markets for prestige luxury brand products, or other products for domestic consumption for which quality/integrity is considered very important.)