Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

bloomberg.com

Post reply on HN
Print view View original

471–480 of 818 posts

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#471

Post by kv85s »

baybal2 wrote: post #251
dogma1138 wrote: post #232

Earlier quoted context omitted.

That's not correct the QSA will validate that the device does not store PIN codes or the that the merchant does not store anything they are not allowed. Devices that accept cards need to comply with PED/PTS security requirements including very strict physical security requirements which are validated by PCI council approved laboratories and firms. You are not getting a device on the market or usable with any merchane…

About that, I can only say that Chinese android POSes do everything in software, for sure, without any hsm present. The question is, how Chinese banks coax Visa into allowing them using them.

Simple greed? As in: "play ball, and you get access to the gigantic Chinese market"

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#472

Post by adrr »

MrBingley wrote: post #246
zjfroot wrote: post #113

Statements from Amazon, Apple, Supermicro and Chinese government. https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... From Apple: "Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we h…

What liars. Apple has done this before as well, when they said they had "never heard" of PRISM, despite a Snowden leak showing the exact opposite. https://www.theguardian.com/world/2013/jun/06/us-tech-giants...

The event was probably classified as a national security incident which would compel the affected parties to not disclose the event.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#473

Post by repolfx »

TheRealPomax wrote: post #360
onepremise wrote: post #342

Earlier quoted context omitted.

Seriously, why are we still outsourcing chip manufacturing to other countries? Sure it's cheaper, but we sacrifice a lot to have a society of corporate slaves build our tech. Security, core domain knowledge, capability, corporate secrets, patent rewards and enforcement, etc... All of it you throw away the minute you ship your manufacturing out of the country. I've seen enough board printing machines out there to star…

Counterpoint: even if we ignored the fact that you cannot possibly produce the volumes of chips necessary at the price necessary in your country rather than in "we don't have to acknowledge all the human rights violations" countries, why would you believe this problem goes away if chip manufacturing were done in your own country, rather than another? The moment the option of taking control of a production line of som…

Not all societies are equally corrupt.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#474

Post by baybal2 »

hef19898 wrote: post #451
baybal2 wrote: post #324

Earlier quoted context omitted.

Not exactly, PCB assembly is super cheap everywhere thanks to propagation of chipshooters, what makes the cost go up is logistics - what do you do after you populate the board for your part? Ship it across the world, or to another factory behind the corner?

That largely depends on the size of your board and the total number you want to ship. As soon as you reach full truck loads or full container loads that additional shipping cost is marginal on a board level.

But still, that complicates the whole operation immensely in comparison to "just go next city block"

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#475

Post by retrogradeorbit »

BurningFrog wrote: post #430
zelon88 wrote: post #406

Earlier quoted context omitted.

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

This is also such a good anonymous story that I'd give decent odds it's made up.

Using the technically incorrect term "angular momentum" rather than the more correct term "moment of inertia" made me think the same thing. I would think a person tasked with building such a device would know their physics well enough to use the right term, but I may be wrong.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#476

Post by hinkley »

kumarvvr wrote: post #414
lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

This reminds me of a story about, IIRC, Soviet intelligence personnel determining that a photocopy machine at their consulate in the USA was bugged by the CIA by measuring it's weight and comparing that value to the standard value published by Xerox. Modern times, but same old methods of "debugging" The angular momentum stuff is innovative though.

Now I’m picturing a 300lbs photocopier being spun on three axes. How much tape would it take to keep doors and parts from flying off?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#477

Post by wyuenho »

sandebert wrote: post #309

"Two of Elemental’s biggest early clients were the Mormon church, which used the technology to beam sermons to congregations around the world, and the adult film industry, which did not." Well played, Bloomberg. Well played.

I LOL'ed when I read that line too

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#478

Post by itake »

hbosch wrote: post #404
jmull wrote: post #351

Earlier quoted context omitted.

Not at all. It would be quite damaging to their reputation if it came out later that they were affected by this, knew it, and lied about it. Especially since the privacy of customer data is a key part of their marketing message these days.

Damaging how? People will stop buying iPhones? Be realistic. Assuming the story is true, you lie lie lie until something bigger in the news happens then you quietly relent.

Personally I buy Apple because they are more private than android. I would look at alternatives if Apple was caught lying here.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#479

Post by danimal88 »

TazeTSchnitzel wrote: post #138
zjfroot wrote: post #113

Statements from Amazon, Apple, Supermicro and Chinese government. https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... From Apple: "Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we h…

Assuming Bloomberg's story is true, I wonder what reason Apple has to hide. Not wanting to upset relations with the PRC govt?

I can think of a trillion reasons...

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#480

Post by wolco »

joncrane wrote: post #369
lmilcin wrote: post #155

Earlier quoted context omitted.

This wasn't our device. There was a big, reputable company behind the device. We were ordering a number of those and they would be shipped to us directly from China. Also, we were basically locked in due to the magnitude of investment in the software we have developed for the device. Fortunately this only lasted for few months until it was dealt with. It was quite new back then (a decade ago) and it was a surprise fo…

How was it finally "dealt with?"

They got better at hiding and his company couldn't detect it. Problem solved.
Post reply on HN