42 ms·

Nothing adds up here. Supermicro boards have "designed in the USA" proudly stamped all over them. This means that either: (a) the design process was infiltrate

by setquk 8y ago

Nothing adds up here. Supermicro boards have "designed in the USA" proudly stamped all over them. This means that either: (a) the design process was infiltrated, which would have been done US side thus the nationality of the actors is debatable. (b) the manufacturing process was infiltrated, which SHOULD have been picked up during design validation and production sampling. (c) this whole thing is a load of rubbish. Lots of questions here. This is not a tinfoil hat measure as well; genuine questions from someone who HAS worked in the EE side of things. I wonder if this is a bunch of pre-emptive finger pointing and ass covering for an implant closer to home? I don't trust either side of the fence if I'm honest.

ceejayoz 8y ago
The article alleges (b), and give indications of why it wouldn't necessarily be picked up: > In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. That generation of chips was smaller than a sharpened pencil tip, the person says. (Amazon denies that AWS knew of servers found in China containing malicious chips.) There's plenty of precedent for missing things hidden away in stuff: https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
- setquk 8y ago
  That is possible but unlikely. Firstly you'd have to do this at the PCB fab phase as this can't be retrospectively applied, so you'd have to have infiltrated two times as many companies and add complex manufacturing exceptions to their workflow. Secondly you'd have to get it through AXI process which is used on these larger boards (Automated X-ray Inspection) which is used by the larger companies for manufacturing AND design validation. So you'd have to infiltrate another company. Also stuff like this tends to show up on boundary scans. It's not that easy to cock around with signal integrity on these sorts of boards and get away with it. I find the whole thing infeasible from a cost and logic perspective. The SMbus firmware and Aspeed sub-vendor are so much easier to hit and don't leave any corpses around to find after the fact.
  - ceejayoz 8y ago
    I'm not sure "infiltrated" is the right word when discussing a state-level actor in a totalitarian country.
    - setquk 8y ago
      That's fair.
  - abrichr 8y ago
    I'll accept that it may seem infeasible. But so did something like Stuxnet [1] seem infeasible, until it was discovered. Perhaps the lesson is not to underestimate the resources of a determined nation state with an economy the size of the USA's (or China's). [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
jnbiche 8y ago
They're designed in the USA, but manufactured overseas (although in some cases the components are assembled in the US).
- setquk 8y ago
  Yeah I did say that. I covered both vectors.
abvdasker 8y ago
I think the article is implying that the implanted chips might not have been detected due to their low profile design. Given that the bad manufacturers were subcontractors it's likely only a fraction of all the boards manufactured were compromised. It's either that or someone at Supermicro was in on it.
- setquk 8y ago
  See my comment here: https://news.ycombinator.com/item?id=18139739 https://news.ycombinator.com/item?id=18139739 I don't find that method feasible. Infiltration of supermicro IS but then you have to ask the question: who really did it as they are on US soil.

by setquk 8y ago

ceejayoz 8y ago

The article alleges (b), and give indications of why it wouldn't necessarily be picked up: > In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. That generation of chips was smaller than a sharpened pencil tip, the person says. (Amazon denies that AWS knew of servers found in China containing malicious chips.) There's plenty of precedent for missing things hidden away in stuff: https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)

setquk 8y ago
That is possible but unlikely. Firstly you'd have to do this at the PCB fab phase as this can't be retrospectively applied, so you'd have to have infiltrated two times as many companies and add complex manufacturing exceptions to their workflow. Secondly you'd have to get it through AXI process which is used on these larger boards (Automated X-ray Inspection) which is used by the larger companies for manufacturing AND design validation. So you'd have to infiltrate another company. Also stuff like this tends to show up on boundary scans. It's not that easy to cock around with signal integrity on these sorts of boards and get away with it. I find the whole thing infeasible from a cost and logic perspective. The SMbus firmware and Aspeed sub-vendor are so much easier to hit and don't leave any corpses around to find after the fact.
- ceejayoz 8y ago
  I'm not sure "infiltrated" is the right word when discussing a state-level actor in a totalitarian country.
  - setquk 8y ago
    That's fair.
- abrichr 8y ago
  I'll accept that it may seem infeasible. But so did something like Stuxnet [1] seem infeasible, until it was discovered. Perhaps the lesson is not to underestimate the resources of a determined nation state with an economy the size of the USA's (or China's). [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet

jnbiche 8y ago

They're designed in the USA, but manufactured overseas (although in some cases the components are assembled in the US).

setquk 8y ago
Yeah I did say that. I covered both vectors.

abvdasker 8y ago

I think the article is implying that the implanted chips might not have been detected due to their low profile design. Given that the bad manufacturers were subcontractors it's likely only a fraction of all the boards manufactured were compromised. It's either that or someone at Supermicro was in on it.

setquk 8y ago
See my comment here: https://news.ycombinator.com/item?id=18139739 https://news.ycombinator.com/item?id=18139739 I don't find that method feasible. Infiltration of supermicro IS but then you have to ask the question: who really did it as they are on US soil.