Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

bloomberg.com

Post reply on HN
Print view View original

61–70 of 379 posts

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#61

Post by busterarm »

roblabla wrote: post #34
mmastrac wrote: post #28

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

But if the story was entirely false, they'd have sued Bloomberg for libel already.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#62

Post by monocasa »

buserror wrote: post #41
jstanley wrote: post #27

Earlier quoted context omitted.

Elsewhere in this thread there is an actual link to an actual NSA device that does exactly this. I don't think it's in the realm of science fiction.

If you look at that illustration, you see that it's not just one ethernet connector, it's one of these massive connector stack with one ethernet and 2 USB, also, it adds quite a bit of depth to the connector; it must have been made with one particular brand/type of motherboard in mind. Still, if these are in the wild, then perhaps our chinese friends might have reduced the footprint even more to the size of one conne…

That's also at least a five year old implant since Snowden leaked it back in 2013.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#64

Post by educationdata »

dawhizkid wrote: post #43

If Bloomberg's reporting is/was, in fact, entirely false then why wouldn't Amazon/Apple/Supermicro immediately sue them for libel/defamation?

In the U.S., there is a very high bar to accuse defamation. You not only need to prove the report is false, you also need to prove the reporter knew it was false and had bad intention to cause damage.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#65

Post by mox1 »

ummonk wrote: post #31
pjc50 wrote: post #15

Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…

Yeah, particularly given it was against a US telecom company, the NSA would make sense as the source of the implant.

No that would make 0 sense. The NSA doesn't "attack" american companies with covert implants.

They get FISA court orders that force american companies to attach their equipment.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#66

Post by dkonofalski »

krn wrote: post #17

I find it hard to believe, that Bloomberg would publish an extremely detailed story involving some of the largest public companies in the world, knowing that it is entirely false. The cost of reputation is just too high.

Isn't that the question, though. I don't think anyone is accusing them of publishing information that they know to be false. It seems more likely that their sources are just not as good as believed and possibly have reinforced the details and information through an echo chamber. If these sources are within the same subsection of the industry and regularly exchange information, it may just be that they've been regurgitating information between themselves that somehow coalesced into a "real" story.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#67

Post by John_KZ »

mschuster91 wrote: post #35
pjc50 wrote: post #15

Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…

> The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... . Interesting. This one seems to rely on the presence of the USB connectors for powering. So, basically, any ethernet port with only Ethernet connectors should be safe from this kind of attack? The only powering option there should be PoE but I ha…

>but I have yet to see someone buy PoE switches for a datacenter

It was a small datacenter but we had a bunch for PoE KVMs.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#68

Post by pixl97 »

roblabla wrote: post #34
mmastrac wrote: post #28

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

>The US cannot force those companies to lie.

When it comes to companies like ATT/Verizon it seems like no forcing is necessary. They are complicit.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#69

Post by josefresco »

mmastrac wrote: post #28

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other altern…

What is the likelihood that #2 is correct?

I read a lot of (recent) American history books - #2 gets my vote.

Re: New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

#70

Post by late2part »

jacquesm wrote: post #42
pjc50 wrote: post #15

Finally a named source, but still no photos and the alleged hacked board is still not in the hands of a public security researcher. The "trojan ethernet connector" paragraph mentions similarity to an NSA implant, which appears to be this: https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS... I'm now wondering if someone found an NSA implant and misreported it as Chinese. We're going to end up in the stupid…

I've been looking in detail at three different Supermicro motherboards but so far have not been able to spot anything. Even against a backlight there is no sign of tampering between the layers.

The initial allegations from Bloomberg suggested ON the otherboard, not in, as I understand it.
Post reply on HN