3 ms·
Placing it on a low speed SPI read/write trace to the flash chip containing the BMC firmware is entirely plausible, and in no way would require "dozens (possibl
by throwaway2048 8y ago
Placing it on a low speed SPI read/write trace to the flash chip containing the BMC firmware is entirely plausible, and in no way would require "dozens (possibly hundreds) of engineers."
EDIT: https://news.ycombinator.com/item?id=18138638 https://news.ycombinator.com/item?id=18138638
- akiselev 8y agoIt's entirely plausible as long as no one is inspecting the final product. The hard part isn't connecting the traces, it's doing so without immediately arousing suspicion when a tech open the server and sees a ghetto engineered chip hanging off the PCB at a weird angle. I hadn't read the detail about the second flash chip. Obviously, if they're just putting compromised flash into a footprint left empty by the manufacturer on purpose for recovery, it's much easier, cleaner, and can be done with a small group.
- calandoa 8y agoSimilar attacks on the BMC firmware have been described here, with the same AST2400 BMC chip: https://blog.eclypsium.com/2018/09/06/insecure-firmware-updates-in-server-management-systems/ https://blog.eclypsium.com/2018/09/06/insecure-firmware-upda... https://blog.eclypsium.com/2018/06/07/firmware-vulnerabilities-in-supermicro-systems/ https://blog.eclypsium.com/2018/06/07/firmware-vulnerabiliti...