Making sense of the alleged Supermicro motherboard attack • Hacker News Board

Re: Making sense of the alleged Supermicro motherboard attack

#171

Post by nineteen999 » Fri, Oct 05, 2018, 7:30 PM UTC

auslander wrote: post #59

nineteen999 wrote: post #54

Earlier quoted context omitted.

Rubygems for everybody! Or arbitrary docker containers. My current deployments allow outbound SMTP only. All software packages (rpm or whatever) get pushed in via rsync from the outside, or are built in an adjacent lab behind the firewalls and pushed across.

It may affect the very source box you are using for package downloads. I bet it is allowed to go outside unrestricted. Funny you mentioned Docker, it is a security nightmare in itself.

Indeed, although it is connected via rather restrictive corporate proxy. I'd rather have one box on my network exposed where I can monitor it than a thousand instances with unrestricted outbound access in AWS though.

Oh yeah - docker. I thought this one was pretty funny:

https://threatpost.com/malicious-docker-containers-earn-cryp...

Re: Making sense of the alleged Supermicro motherboard attack

#172

Post by DenisM » Fri, Oct 05, 2018, 7:31 PM UTC

A decade ago when I worked at Microsoft I shopped around the idea of using XBox as a basis for secure computing.

XBox was designed to function in the hands of the adversary, to be robust against peripheral attacks and even motherboard mods. Even the main memory was encrypted by the on-CPU controller. Obviously, no open JTAGs. A lot of expertise there.

In my fantasies it would form the basis of the DoD infrastructure and then trickle down to finance. It was deemed to be not solving any practical problems, so it didn't go anywhere. Oh well, I found other fun thins to do in my life.

Re: Making sense of the alleged Supermicro motherboard attack

#173

Post by coolspot » Fri, Oct 05, 2018, 7:31 PM UTC

uep wrote: post #65

I think the attacks are real. A year ago, Google announced their Titan firmware security chip[1], which would limit these kinds of attacks. I don't believe they designed and built this chip, and surrounding infrastructure, because of purely theoretical attacks. Besides that, over the last couple years there has also been a lot of work trying to neuter the Intel ME, because of how dangerous it is. Another example is t…

Also interesting that Apple recently started to switch from Qualcomm to Intel modems.

> The modem represents a milestone for Intel in a couple of ways; it is the first chip to be manufactured solely in-house and it is Intel’s first chip to support CDMA and GSM.

> Apple’s original plan for the 2018 iPhones, via Nikkei, was for Intel to have exclusivity on modem orders for the first time — amidst its legal disputes with Qualcomm.

Re: Making sense of the alleged Supermicro motherboard attack

#174

Post by ochoseis » Fri, Oct 05, 2018, 7:33 PM UTC

docker_up wrote: post #24

Is this really that hard to imagine? I am willing to bet that there are teams of spies who have infiltrated Google, Facebook, Amazon, etc. Spies from US, Russia, China, Britain, Israel, Germany, etc, must have dozens of spies working as engineers are getting access to all that data as we speak. To think that they aren't would be rather naive, in my opinion. If I were head of the spy agencies in any one of those count…

It's probably a lot easier to just blackmail or bribe existing employees, probably similar to how the supply chain hack worked.

Re: Making sense of the alleged Supermicro motherboard attack

#175

Post by PeterisP » Fri, Oct 05, 2018, 7:33 PM UTC

alienreborn wrote: post #95

devoply wrote: post #87

Earlier quoted context omitted.

I think the attacks are real and if China is doing it then anyone else may be doing it as well including the US.

Anyone else literally can't because they don't have supply chain advantage that China has.

Not anyone else, but there certainly are other nations with similar capabilities.

USA is one of them - China is best suited for inserting "extra hardware" on a board as in this example, but if you'd want to insert similar functionality as some extra stuff in an existing chip, then USA could arguably do it easier than China.

Also, South Korea and Taiwan have immense role in the supply chain and can do similar large scale things as China.

However, yes, the lack of supply chain influence does make similar attacks much more difficult for a bunch of actors which are otherwise active in tech security area - Russia, Israel, North Korea, UK, etc.

Re: Making sense of the alleged Supermicro motherboard attack

#176

Post by gerwitz » Fri, Oct 05, 2018, 7:38 PM UTC

zaroth wrote: post #77

The fact that cursory examination finds the attack is not only entirely feasible, and completely undefended against, but that the hardware shown in the Bloomberg animation is precisely the hardware which would be required to pull off the attack is quite astonishing. Whose “law” is it that the closer you are to an event the more you can see that the reporting on the event is desperately flawed? This has almost always…

I'm voting for false flag because it's the most interesting hypothesis to imagine. Especially with the NCSC statement.

Re: Making sense of the alleged Supermicro motherboard attack

#177

Post by avip » Fri, Oct 05, 2018, 7:39 PM UTC

amoshi wrote: post #168

stephenr wrote: post #106

Earlier quoted context omitted.

Apple specifically states that they are not under any form of gag/confidentiality order/conditions: > Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.

And if they were, you think they would admit it?

They would not have blatantly lied about it in an official statement. That could not have passed legal.

Re: Making sense of the alleged Supermicro motherboard attack

#178

Post by dboreham » Fri, Oct 05, 2018, 7:40 PM UTC

romed wrote: post #119

acdha wrote: post #112

Earlier quoted context omitted.

Now you have a second device to buy, secure and support, and it can't do everything that an ILOM can (most importantly, remote power management). Having had security updates for KVMs, I'm also not sure your assumption that it's safer is true in any meaningful sense. Management engine vulnerabilities have gotten a lot of hype over the last year or two but most of it has been marketing for security companies rather tha…

For many BMCs the second network port is a figment of your imagination. The BMC is capable of intercepting and injecting network frames on the host's interfaces. Just because you have the management port wired to a different VLAN or even a separate physical LAN means nothing.

BMC NIC is generally capable of being bridged to one of the main NICs, although it is possible to disable that feature, but also possible to override the disabling if you control the hardware.

Re: Making sense of the alleged Supermicro motherboard attack

#179

Post by pasbesoin » Fri, Oct 05, 2018, 7:41 PM UTC

blattimwind wrote: post #151

pasbesoin wrote: post #137

Earlier quoted context omitted.

It's just my opinion, and so I held off saying, yesterday, but: The immediate economic outfall (co-morbid with institutional panic) would be so severe that this aspect alone would represent a national security issue.

Supermicro stock dipped down to 50 % or so (20->10).

I'm not talking about any effect specifically upon Supermicro.

And... it's just a hypotheses, assuming news of such an exploit is indeed being suppressed.

Re: Making sense of the alleged Supermicro motherboard attack

#180

Post by dboreham » Fri, Oct 05, 2018, 7:43 PM UTC

romed wrote: post #80

acdha wrote: post #78

Earlier quoted context omitted.

Not just tiny – any place where you don't want work to be rate-limited by the time it takes to get a body in front of a server. The only scale where it's not a big win is when you're so large that you have rock-solid auto-recovery in your software stack and hardware failures are handled by disabling a server and leaving it in the rack until it's periodically reaped at a regular interval. Most businesses are in that g…

Remote office management can be handled by a KVM with remote access. These can be security hazards in their own right, but it’s a lot safer than having some vendor junk literally hard-wired to your PCI bus.

Last time I looked all the SM motherboards could be ordered sans BMN (saves $50 or so). Parts with -F have the BMC. So you'd think Apple, Amazon et al would order the BMC-less SKU.