4 ms·

They attacked the Base Management Controller. There's an article by Bruce Schneier from 2013 warning about exactly this attack. Quoting: "Basically, it's a per

They attacked the Base Management Controller. There's an article by Bruce Schneier from 2013 warning about exactly this attack. Quoting: "Basically, it's a perfect spying platform. You can't control it. You can't patch it. It can completely control your computer's hardware and software. And its purpose is remote monitoring. At the very least, we need to be able to look into these devices and see what's running on them." https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html https://www.schneier.com/blog/archives/2013/01/the_eavesdrop...

TorKlingberg 8y ago
> They attacked the Base Management Controller. Do you know this, or are you speculating?
- wbc 8y ago
  It's in the article: "The illicit chips could do all this because they were connected to the baseboard management controller..."
  - techntoke 8y ago
    Can you quote a single source from that article, or is it all anonymous?
    - enraged_camel 8y ago
      That is also in the article... "17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."
      - techntoke 8y ago
        So not a single source. Might as well be going to war over invisible weapons of mass destruction. Also, Apple and Amazon both has said they do not agree with these claims. So far this is nothing more than propaganda.
        bsaul 8y ago
        so you prefer to believe official corporate statements saying they didn’t have security leaks, rather than a news agency with 17 independent sources confirming they had ?? That’s an interesting choice.
        techntoke 8y ago
        17 independent sources doesn't mean anything. Again, this is the same as the sources that said their were weapons of mass destruction in Iraq. Companies and government use propaganda all the time, so until you have more information confirming these claims, then it is best to hold off before trying to say that Apple and Amazon denying the claims str proof that they are real.
        roywiggins 8y ago
        Are you saying Bloomberg made the sources up, or that they exist but are all lying, because they won't go on the record?
        techntoke 8y ago
        Def possible they are lying. There are a lot of companies competing with white box manufacturers. If you can't name a single source, and you have two major companies saying these claims aren't accurate... then maybe you should hold off before making judgments.
craftyguy 8y ago
> You can't patch it. Sure you can. OEMs regularly release patches for platform BMCs.
- erichocean 8y ago
  Not sure about you, but I'm not an "OEM".
  - craftyguy 8y ago
    Well, you cannot patch the vast majority of the software in your computer (assuming you are like the vast majority of users using proprietary crap for everything). That does not mean it is all unpatchable. If supermicro care, they could release a BMC update, for example.

TorKlingberg 8y ago

> They attacked the Base Management Controller. Do you know this, or are you speculating?

wbc 8y ago
It's in the article: "The illicit chips could do all this because they were connected to the baseboard management controller..."
- techntoke 8y ago
  Can you quote a single source from that article, or is it all anonymous?
  - enraged_camel 8y ago
    That is also in the article... "17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."
    - techntoke 8y ago
      So not a single source. Might as well be going to war over invisible weapons of mass destruction. Also, Apple and Amazon both has said they do not agree with these claims. So far this is nothing more than propaganda.
      - bsaul 8y ago
        so you prefer to believe official corporate statements saying they didn’t have security leaks, rather than a news agency with 17 independent sources confirming they had ?? That’s an interesting choice.
        techntoke 8y ago
        17 independent sources doesn't mean anything. Again, this is the same as the sources that said their were weapons of mass destruction in Iraq. Companies and government use propaganda all the time, so until you have more information confirming these claims, then it is best to hold off before trying to say that Apple and Amazon denying the claims str proof that they are real.
      - roywiggins 8y ago
        Are you saying Bloomberg made the sources up, or that they exist but are all lying, because they won't go on the record?
        techntoke 8y ago
        Def possible they are lying. There are a lot of companies competing with white box manufacturers. If you can't name a single source, and you have two major companies saying these claims aren't accurate... then maybe you should hold off before making judgments.

craftyguy 8y ago

> You can't patch it. Sure you can. OEMs regularly release patches for platform BMCs.

erichocean 8y ago
Not sure about you, but I'm not an "OEM".
- craftyguy 8y ago
  Well, you cannot patch the vast majority of the software in your computer (assuming you are like the vast majority of users using proprietary crap for everything). That does not mean it is all unpatchable. If supermicro care, they could release a BMC update, for example.