Does this mean I can get some great deals on Supermicro boards now? :)
Making sense of the alleged Supermicro motherboard attack
121–130 of 328 posts
Re: Making sense of the alleged Supermicro motherboard attack
#122Hey OP, call it what the article was and nix the "Alleged" it spills your bias.
Re: Making sense of the alleged Supermicro motherboard attack
#123Earlier quoted context omitted.
> ... high end server manufacturers like SM - use sophisticated automated tests and quality control on boards. MFG test guy here (not supermicro!) Not necessarily. Automated production tests are there to configure and exercise the system and confirm it works as specified. Such tests are good at things like finding bad solder joints, pick-and-place mishaps, misconfiguration of firmware and weeding out product that fai…
Thank you for the insight. I was rather naively imagining that every board is subject to some kind of x-ray image matching with the original PCB design to find differences. Not that simple, I see.
It's not uncommon at all to do AOI on all or a percentage of the PCBs. X-ray is more useful to identify solder issues or defects in the raw PCB itself.
Re: Making sense of the alleged Supermicro motherboard attack
#124QSPI has 4 data lines, a clock and a chip-select line.
In order to intercept a QSPI bus, you would therefore need 4+1+1+2xpower lines = 8 pins.
This is not sufficient for QSPI.
Single SPI on the other hand requires Clock, Data, ChipSelect, Ground & Power = 5 lines, so that would be plausible.
(Yes, I know you can potentially get rid of the CS line, but that depends on what else is on the bus).
Re: Making sense of the alleged Supermicro motherboard attack
#125Is this really that hard to imagine? I am willing to bet that there are teams of spies who have infiltrated Google, Facebook, Amazon, etc. Spies from US, Russia, China, Britain, Israel, Germany, etc, must have dozens of spies working as engineers are getting access to all that data as we speak. To think that they aren't would be rather naive, in my opinion. If I were head of the spy agencies in any one of those count…
It's not at all hard to imagine, especially from a country who is so paranoid about backdoors from other country's operating systems that they have written their own: https://en.wikipedia.org/wiki/Kylin_(operating_system)
Paranoid like Germany, France, Spain, Austria, Venezuela, Thailand, Turkey, etc...?
They all have Linux distros, sponsored nationally.
https://en.wikipedia.org/wiki/Category:State-sponsored_Linux...
Re: Making sense of the alleged Supermicro motherboard attack
#126Earlier quoted context omitted.
Thank you for the insight. I was rather naively imagining that every board is subject to some kind of x-ray image matching with the original PCB design to find differences. Not that simple, I see.
Some manufacturers do X-ray boards. Typically this is done to check that BGA devices ( https://en.wikipedia.org/wiki/Ball_grid_array ) are soldered properly. Usually not done on every board, but only if there's a problem suspected. When it happens they tend to focus only on particular BGA components or suspect copper traces rather than the whole PCB.
Usually you scan boards at a percentage determined by statistics (SPC can get complex).
However the checks are automated, so you would have to perform the checks in a different trust zone (eg: different country).
Re: Making sense of the alleged Supermicro motherboard attack
#127Can someone outline some reasons for me why nobody has come up with an actual physical example of a compromised board? I'm not trying to make a point, I just want to get a more complete picture of the issue, and the biggest thing that stands out to me is the lack of physical evidence.
It's not like these boards are found in every living room. I would assume that if somebody found a suspicious board at their org, they would kick off internal processes first.
Re: Making sense of the alleged Supermicro motherboard attack
#128Earlier quoted context omitted.
AOI would miss the chip if it were buried between layers or look exactly like a part it was replaced for.
I wonder how the auditing team detected it. X-rays?
They might have noted an anomaly in the SMC given the acknowledged SMC firmware exploits (maybe a beta test run?) and investigated the SPI lines to the SMC as a response.
Re: Making sense of the alleged Supermicro motherboard attack
#129Earlier quoted context omitted.
Depends on where it was added. Doing it as part of the assembly process would require having access to the pick and place software along with being able to load reels of the implant into the machine. A well placed insider may be able to make that happen, and automated optical inspections would be fed by the modified pick and place program, so checks would pass as the new component is part of the build.
Thanks for that info. I assumed that once the boards came back to SM's US premises, a second level of optical and other tests are done by SM employees. But perhaps that's not - or was not - their actual workflow.
Would be pretty wasteful to wait until the hardware was shipped to the US to look for manufacturing defects.
Re: Making sense of the alleged Supermicro motherboard attack
#130> Let’s assume an implant was added to the motherboard at manufacture time. This needed modification of both the board design, and the robotic component installation process. It intercepts the SPI lines between the flash and the BMC controller Circuit wise, you don't really need to "intercept" (place in series with) the SPI lines. Two parallel drivers [0] will generally fight it out quietly, and you can guarantee you…
Post author here. That was what I was thinking of - simply overdriving the lines to drag them high or low in opposition to the 'official' driver. That's pretty much all you can do with 6 pins. I was trying not to overcomplicate the explanation, since the material is already complicated enough!
Fair point about hand soldering, however it would be more obvious to the manufacturing employees for an entire production batch to be diverted to have parts added manually than to simply sneak in another reel to the hundred on the pick and place machine.