The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

Post by bsaul » Thu, Oct 04, 2018, 10:00 PM UTC

techntoke wrote: post #667

enraged_camel wrote: post #370

Earlier quoted context omitted.

That is also in the article... "17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."

So not a single source. Might as well be going to war over invisible weapons of mass destruction. Also, Apple and Amazon both has said they do not agree with these claims. So far this is nothing more than propaganda.

Post by lmilcin » Thu, Oct 04, 2018, 10:02 PM UTC

joe_the_user wrote: post #609

koffiezet wrote: post #252

Earlier quoted context omitted.

Certification. Worked in the same industry, and there were very strict both hardware and software requirements for POS software. Having gone trough credit-card audits, early EMV certification programs, and certification to place non-payment software next to payment software on such systems, I can tell you - it's no joke :)

Certification [...] I can tell you - it's no joke :) I'm not so sure. "And then initial supplier inserted hardware that thwarted all those pressing considerations" sounds a punchline to me. :(.

Post by shaklee3 » Thu, Oct 04, 2018, 10:09 PM UTC

bubblethink wrote: post #528

detaro wrote: post #72

Earlier quoted context omitted.

To be clear, this is only for the ability to update the BIOS over the BMC interface, not for BIOS updates in general. (unlike some other vendors, where you need a support contract to be even able to download the updates) At least on some boards you can boot the USB drive image containing the BIOS updater through the BMC and do a remote update that way.

Supermicro doesn't publish changelogs for their BIOSes. Their disclaimer on their BIOS download page says, "don't update the BIOS unless you have to". It's a ridiculous stance for a server company. You buy Supermicro over Dell for the price. That's pretty much it.

Post by [deleted] » Thu, Oct 04, 2018, 10:18 PM UTC

_9vzr wrote: post #178

jsjohnst wrote: post #122

Earlier quoted context omitted.

> as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag You didn’t specify what type of anti-tamper was used, but I wanted to jump in and say usually that means nothing. The US government intercepted packages [0] and put in back doors (removing and replacing the seals), so I’m not sure why you were so quick…

You can just buy counterfeit anti-tamper stickers but if there is a switch inside the unit that flips a bit in some sort of write-once memory, then that would require removal of an entire chip and replacing it with another that may not be 100% the same. You can have a chain of trust in the system where chips will only talk to each other if they all spit out the right hash. Bury the SPI/I2C lines you use for this trus…

Post by close04 » Thu, Oct 04, 2018, 10:18 PM UTC

astrange wrote: post #653

close04 wrote: post #257

Earlier quoted context omitted.

Procedures change, as attacks get more sophisticated the next step could be disposable devices. But an attack like the one described in this article won't be mitigated by having a disposable device. On the other hand having your laptop "hijacked" while on a business trip will most likely involve some extra PCB or components that are a little more obvious that something that's "built in". Then again many companies or…

Does the security team have any motivation to reduce waste? Unless you're finding hacks in your devices already I see no reason to think they aren't just making you jump through hoops because it's funny.