The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple • Hacker News Board

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#311

Post by AimForTheBushes » Thu, Oct 04, 2018, 2:51 PM UTC

Eridrus wrote: post #279

vezycash wrote: post #82

Earlier quoted context omitted.

You're right. One question though. Would a politically correct, by-the-book US president have had the balls to sanction China? Considering such sanctions could affect the US economy.

> Would a politically correct, by-the-book US president have had the balls to sanction China? Does Trump even have a goal in mind with his tariffs? It seems like he just wants to score political points, rather than achieve any actual outcomes.

Remove reliance from the Chinese supply chain?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#312

Post by bhauer » Thu, Oct 04, 2018, 2:54 PM UTC

As someone who has used a few SuperMicro boards in custom builds, I would like to know which motherboard models have been affected. It's not clear to me from the article whether that is even known at this time.

I'd also like to know of a recommended work-around. I have always had IPMI "disabled" as much as I can; assigned a non-routable IP address in the BIOS in case it flips to a failsafe mode by piggybacking on the main NICs. But is that sufficient? Is BMC ~= IPMI?

Has anyone found more technical details yet for system administrators who don't work at the thirty companies contacted?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#313

Post by knodi » Thu, Oct 04, 2018, 2:54 PM UTC

Couldn't the same be possible on routes?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#314

Post by sonnyblarney » Thu, Oct 04, 2018, 2:56 PM UTC

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

Maybe time to buy your financial hardware from somewhere not china?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#315

Post by MaupitiBlue » Thu, Oct 04, 2018, 2:56 PM UTC

Eridrus wrote: post #279

vezycash wrote: post #82

Earlier quoted context omitted.

You're right. One question though. Would a politically correct, by-the-book US president have had the balls to sanction China? Considering such sanctions could affect the US economy.

> Would a politically correct, by-the-book US president have had the balls to sanction China? Does Trump even have a goal in mind with his tariffs? It seems like he just wants to score political points, rather than achieve any actual outcomes.

Given that there’s video from 4 decades in which Trump advocates for tariffs, during which time he wasn’t a politician, it would seem that they are something he believes strongly in.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#316

Post by FourthProtocol » Thu, Oct 04, 2018, 2:59 PM UTC

baybal2 wrote: post #139

m_mueller wrote: post #96

Earlier quoted context omitted.

> Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems? I'd like to know this too. Has the West completely lost the ability to mass produce microchips at even a reasonable cost for financial applications?

America has fabs, both old and leading edge, but ask industry giants like Gemalto to even bother to manufacture chips anywhere outside of Taiwan, assemble the final product outside of China. They will never do that, because they look for the cheapest solution. The bigger the company, the less it cares about things other than cost. This is why Mediatek and Broadcom can usurp the market of network SoCs, while making pr…

Gemalto manufactures and assembles many, many products in Europe. The entire European security cluster won't use anything else. I know because I played a part in smart card development there. And all of that was from Europe. Wafers, chips, holograms, mag stripes...

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#317

Post by contingencies » Thu, Oct 04, 2018, 3:00 PM UTC

RL_Quine wrote: post #30

Narkov wrote: post #25

Earlier quoted context omitted.

Right so all the stars need to align for it to go unnoticed - compromised server, firewall and other alerting/monitoring tools. I would have thought one single unexpected packet in these high security environments would raise significant alarm bells and any anomaly would be found very quickly.

I've worked on systems deployed in the financial sector in high risk environments. This sort of monitoring doesn't happen in the real world.

It does. I've deployed systems that would not only notify staff when novel packets were observed but immediately isolate anomalous hardware through a combination of powerdown and network fabric reconfiguration.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#318

Post by Gravityloss » Thu, Oct 04, 2018, 3:01 PM UTC

lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

Why do you use those suppliers?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#319

Post by mfer » Thu, Oct 04, 2018, 3:01 PM UTC

Anyone remember the hack of Apple via Supermicro firmware.... https://arstechnica.com/information-technology/2017/02/apple...

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#320

Post by lmilcin » Thu, Oct 04, 2018, 3:02 PM UTC

whatshisface wrote: post #299

amluto wrote: post #280

Earlier quoted context omitted.

> We could not measure all possible angular momentums but it was possible to measure one or two that would not be known to the attacker. You mean moment of inertia, not angular momentum. You could measure all of them! Given the moments for the three principal axes at any point, you can use the parallel axis theorem to calculate all the rest. In general, there are 10 degrees of freedom: 3 for the position of the cente…

Another implication of the parallel axis theorem is that the attacker could perfectly mimic every moment of inertia by shaving plastic. They wouldn't have to know which two axes were being tested because there are only three real numbers worth of information in the system to begin with (once center of mass and total mass have been dealt with.) In the whole MOI tensor there are only six free numbers which sounds like…

I honestly did not know about that. I thought that if you move any mass (remove non zero mass and place it somewhere else) there must be at least one axis which you can use to detect the change in moment of inertia.