Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making sense of the alleged Supermicro motherboard attack

lightbluetouchpaper.org

Post reply on HN
Print view View original

111–120 of 328 posts

Re: Making sense of the alleged Supermicro motherboard attack

#111

Post by XnoiVeX »

nerfhammer wrote: post #89
wyldfire wrote: post #10

Earlier quoted context omitted.

One of the bloomberg articles claimed that in some cases it was "thin enough that they’d been embedded between the layers of fiberglass" -- like as if it were a passive in a blind/buried via? This seems like a very sophisticated attack.

Passives don't have enough pins to do much of anything, unless it's an array of passives in a single package that happens to be on power, gnd and data lines at once. But, I'm not sure but it seems like a bit of a red herring. Reading the article the chip in question doesn't sound passive at all: "The Supermicro board here appears to have a QSPI chip, but also a space for an SPI chip as a manufacturing-time option. Th…

Did you see the comment above that QSPI boots up as SPI and then switches over to QSPI?

Re: Making sense of the alleged Supermicro motherboard attack

#112

Post by acdha »

romed wrote: post #80
acdha wrote: post #78

Earlier quoted context omitted.

Not just tiny – any place where you don't want work to be rate-limited by the time it takes to get a body in front of a server. The only scale where it's not a big win is when you're so large that you have rock-solid auto-recovery in your software stack and hardware failures are handled by disabling a server and leaving it in the rack until it's periodically reaped at a regular interval. Most businesses are in that g…

Remote office management can be handled by a KVM with remote access. These can be security hazards in their own right, but it’s a lot safer than having some vendor junk literally hard-wired to your PCI bus.

Now you have a second device to buy, secure and support, and it can't do everything that an ILOM can (most importantly, remote power management). Having had security updates for KVMs, I'm also not sure your assumption that it's safer is true in any meaningful sense.

Management engine vulnerabilities have gotten a lot of hype over the last year or two but most of it has been marketing for security companies rather than a serious risk (e.g. what percentage of bugs required local network access, which should not be easy to get on your management VLAN). During a similar period, we've also had Spectre/Meltdown and the usual slew of software vulnerabilities so I have trouble with the conclusion that the answer is to stop using a useful tool rather than continuing the industry-wide effort to improve the level of security competency among development teams.

Re: Making sense of the alleged Supermicro motherboard attack

#113

Post by baq »

aswanson wrote: post #100
coolspot wrote: post #28

Earlier quoted context omitted.

Especially if you: 1) happen to be country that makes all electronics 2) Company with a lot of ties to your country is happen to be top server supplier 3) Companies that use these servers happen to work for DoD, CIA and all major points of interest.

I wonder if China is making all these cheap wifi chips (esp8266, esp32) etc as backdoors into US infrastructure.

No more Chinese phones for me either way. It's enough that Google knows everything about me, PLA doesn't have to.

Re: Making sense of the alleged Supermicro motherboard attack

#114

Post by crispyambulance »

lovelearning wrote: post #98
crispyambulance wrote: post #58

Earlier quoted context omitted.

> ... high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. MFG test guy here (not supermicro!) Not necessarily. Automated production tests are there to configure and exercise the system and confirm it works as specified. Such tests are good at things like finding bad solder joints, pick-and-place mishaps, misconfiguration of firmware and weeding out product that fai…

Thank you for the insight. I was rather naively imagining that every board is subject to some kind of x-ray image matching with the original PCB design to find differences. Not that simple, I see.

Some manufacturers do X-ray boards.

Typically this is done to check that BGA devices (https://en.wikipedia.org/wiki/Ball_grid_array) are soldered properly. Usually not done on every board, but only if there's a problem suspected. When it happens they tend to focus only on particular BGA components or suspect copper traces rather than the whole PCB.

Re: Making sense of the alleged Supermicro motherboard attack

#115

Post by simondedalus »

simplecomplex wrote: post #23
radicalbyte wrote: post #19

Earlier quoted context omitted.

There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs) to control the controller.

The traffic has to travel over wire as TCP/IP, regardless of what device generated it. It has to travel over wire somewhere! The device can’t magically communicate with China. Any outbound firewall could detect that, especially traffic going to ports that aren’t even open/used.

i gave you the benefit of the doubt when i read your earlier comment, but this doubledown shows you're extremely naive / have no experience with the space. you realize there are entire industries (plural) premised off the fact that you can't just throw up "any firewall" and detect this kind of thing, no?

can you imagine how it would go down if a major corporation like apple experienced a hardware hacking based infrastructure breach, contracted a cybersecurity company, and the tech heading their case asked them like "well were you making sure to check which ports were open?"

Re: Making sense of the alleged Supermicro motherboard attack

#116

Post by devy »

Regardless this attack is real or not, this exposure and assessments (just like Charlie Miller and Chris Valasek did for exposing the car hacks) raised good awareness of how vulnerable BMCs are and hopefully the baseboard hardware security and firmware security will be securer in the future when they evolve.

Re: Making sense of the alleged Supermicro motherboard attack

#117

Post by netman21 »

fhood wrote: post #109

Can someone outline some reasons for me why nobody has come up with an actual physical example of a compromised board? I'm not trying to make a point, I just want to get a more complete picture of the issue, and the biggest thing that stands out to me is the lack of physical evidence.

Just wait. If they are out there they will be found. Of course you could ask why none of the ANT Catalog software implants have been found yet or why Juniper/Cisco/Fortinet have not (publicly) announced tools to detect them.

Re: Making sense of the alleged Supermicro motherboard attack

#118

Post by romed »

vajrabum wrote: post #92
romed wrote: post #66

I’m just going to throw this out there: BMCs and ILOMs are for tiny shops where “the IT guy” might have to do something from the beach at Cannes on their vacation. If you are a large operator like Apple you absolutely do not need BMCs.

Uh no. Having worked around those sorts of datacenters, the larger you are the more you're going to need the BMC and the iLO. Going to the server physically is almost never the answer at scale. The rack/data center guys generally don't know much at all.

I've spent many years working for the #1 and the #2 largest installations of computers on earth and neither of them use BMC or ILOMs. So there's definitely a disconnect here between your expectations and my reality.

Re: Making sense of the alleged Supermicro motherboard attack

#119

Post by romed »

acdha wrote: post #112
romed wrote: post #80

Earlier quoted context omitted.

Remote office management can be handled by a KVM with remote access. These can be security hazards in their own right, but it’s a lot safer than having some vendor junk literally hard-wired to your PCI bus.

Now you have a second device to buy, secure and support, and it can't do everything that an ILOM can (most importantly, remote power management). Having had security updates for KVMs, I'm also not sure your assumption that it's safer is true in any meaningful sense. Management engine vulnerabilities have gotten a lot of hype over the last year or two but most of it has been marketing for security companies rather tha…

For many BMCs the second network port is a figment of your imagination. The BMC is capable of intercepting and injecting network frames on the host's interfaces. Just because you have the management port wired to a different VLAN or even a separate physical LAN means nothing.
Post reply on HN