6 ms·

The Norwegian National Security Authority (https://nsm.stat.no/english/ https://nsm.stat.no/english/) is quoted in a norwegian paper today saying they knew abou

The Norwegian National Security Authority (https://nsm.stat.no/english/ https://nsm.stat.no/english/) is quoted in a norwegian paper today saying they knew about problems with Super Micro since at least june. https://www.vg.no/nyheter/i/xRkLep/storavis-hevder-kina-installerte-spionverktoey-i-maskinvare https://www.vg.no/nyheter/i/xRkLep/storavis-hevder-kina-inst...

Jerry2 8y ago
What exactly did they know? Did they check anything themselves or did they hear the same story from the US IC that Bloomberg also heard? Supermicro servers are extremely popular in data centers. Yet no one has noticed anything and no one has found any malicious chips in them. Unless the Chinese secret services also hacked all of the firewalls, someone would have picked up some outgoing packets that are going to Chinese C&C servers. And those would have been scrutinized and chased down. A company I interned at this past summer was scrutinizing every client on their internal network. They would have easily detected a machine that was connecting to an IP outside the subnet, for example. This whole story is just fishy and every company mentioned in that Bloomberg piece is not only denying it, but strongly denying it ever happened. And Bloomberg reporters have zero evidence... except for some stories from "anonymous sources".
- cm2187 8y ago
  The article suggested the chips were hidden under components. You would have to tear apart the motherboard and know what to expect exactly. The number of companies who do this kind of audit must be in the single digit if any. Now the article may or may not be a hoax, but a few years ago the NSA was exposed doing exactly that. So at the very least it is credible. As for detection, I’d rather expect this devices to be activated on demand, like creating a backdoor, rather than sending streams of data from all servers, most of which (per the article) will be owned by an adult website or a mormon church which aren’t exactly strategic activities.
  - rickycook 8y ago
    well, the article said that amazon noticed pings to c&c servers in its beijing datacentre. it did also say that these were more sophisticated hardware attacks but didn’t make it clear if these chips were also found
    - cm2187 8y ago
      Yes, sorry, agree. On stealthness, the article mentioned that “In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached” but also says that the chips came in different sizes so some could have been easier to detect.
- Arn_Thor 8y ago
  My translation of the part pertaining to the national security authorities in Norway. Direct quotes from the authorities are shown as such: --- NSM is aware of the issues with Supermicro. "- We know about this, but can neither deny nor confirm it is correct. We register that this is being denied by the companies", says Monica Strom Arnoy, communication director in NSM to VG. NSM has, however, been aware that Supermicro may have been compromised, long before Bloomberg's article. "- We have known about this since June", says Strom Arnoy, who does not wish to further explain from where they have this information. --- My reading is that they suspect Supermicro. Further, that they are familiar with the claims about Apple and Amazon but won't confirm or deny whether they are correct. Damming for Supermicro, less clear for Apple and Amazon
- antpls 8y ago
  If it's real, it could be part of a bigger persistent threat. Maybe those chips would react to some signals, start to heat and fry the motherboard. In case of military war, it could DoS many servers at once from the inside. It could also be used to prematurely break the motherboards, and sell new ones. There could just be there to ping C&C upon activation in order to locate datacenters, including military ones maybe (information that could be useful in that case of war too). We can think of a few use cases than just spying on network packets.
- alwayseasy 8y ago
  That's not how journalism works, "Anonymous sources" are not anonymous to the journalists and editor of Bloomberg. Evidence can be vetted but not published.
Tor3 8y ago
What they said in the interview was that they "knew" about the story, as in "We've heard it", but they also say that they can neither deny nor confirm it. So that's not much.
hef19898 8y ago
It is an interessting story indeed, espiacially with third country sources more or less confirming the general story but not the specific details. I personally have a hard time to believe Bloomberg went public with it without a thourough due dilligence. They should be totally aware of the consequences if they did. At least for Amazon, having jepardiced servers, this goes strait to the core of their business namely customer trust. Until now Amazon did not have any data breaches of customer data which they did pride themselves a lot for. If the Bloomberg story is true, this ould be at risk. So, yeah, a strong denial is exactly what one could expect. I'm curious to see that story unfold.
_red 8y ago
This is completely anecdotal, but I'm on several mailing list for bulk buyers of off-lease server equipment. Typically these list are 90% Dell, HP, IBM. About 6 months ago I started to notice a huge percentage of SuperMicros being sold. Sometimes the whole list was nothing but SM servers. Obviously could be many factors, but does strike me as odd.
- the_duke 8y ago
  Any of those public or easy to get in to? Would be nice to quantify this.

Jerry2 8y ago

What exactly did they know? Did they check anything themselves or did they hear the same story from the US IC that Bloomberg also heard? Supermicro servers are extremely popular in data centers. Yet no one has noticed anything and no one has found any malicious chips in them. Unless the Chinese secret services also hacked all of the firewalls, someone would have picked up some outgoing packets that are going to Chinese C&C servers. And those would have been scrutinized and chased down. A company I interned at this past summer was scrutinizing every client on their internal network. They would have easily detected a machine that was connecting to an IP outside the subnet, for example. This whole story is just fishy and every company mentioned in that Bloomberg piece is not only denying it, but strongly denying it ever happened. And Bloomberg reporters have zero evidence... except for some stories from "anonymous sources".

cm2187 8y ago
The article suggested the chips were hidden under components. You would have to tear apart the motherboard and know what to expect exactly. The number of companies who do this kind of audit must be in the single digit if any. Now the article may or may not be a hoax, but a few years ago the NSA was exposed doing exactly that. So at the very least it is credible. As for detection, I’d rather expect this devices to be activated on demand, like creating a backdoor, rather than sending streams of data from all servers, most of which (per the article) will be owned by an adult website or a mormon church which aren’t exactly strategic activities.
- rickycook 8y ago
  well, the article said that amazon noticed pings to c&c servers in its beijing datacentre. it did also say that these were more sophisticated hardware attacks but didn’t make it clear if these chips were also found
  - cm2187 8y ago
    Yes, sorry, agree. On stealthness, the article mentioned that “In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached” but also says that the chips came in different sizes so some could have been easier to detect.
Arn_Thor 8y ago
My translation of the part pertaining to the national security authorities in Norway. Direct quotes from the authorities are shown as such: --- NSM is aware of the issues with Supermicro. "- We know about this, but can neither deny nor confirm it is correct. We register that this is being denied by the companies", says Monica Strom Arnoy, communication director in NSM to VG. NSM has, however, been aware that Supermicro may have been compromised, long before Bloomberg's article. "- We have known about this since June", says Strom Arnoy, who does not wish to further explain from where they have this information. --- My reading is that they suspect Supermicro. Further, that they are familiar with the claims about Apple and Amazon but won't confirm or deny whether they are correct. Damming for Supermicro, less clear for Apple and Amazon
antpls 8y ago
If it's real, it could be part of a bigger persistent threat. Maybe those chips would react to some signals, start to heat and fry the motherboard. In case of military war, it could DoS many servers at once from the inside. It could also be used to prematurely break the motherboards, and sell new ones. There could just be there to ping C&C upon activation in order to locate datacenters, including military ones maybe (information that could be useful in that case of war too). We can think of a few use cases than just spying on network packets.
alwayseasy 8y ago
That's not how journalism works, "Anonymous sources" are not anonymous to the journalists and editor of Bloomberg. Evidence can be vetted but not published.

Tor3 8y ago

What they said in the interview was that they "knew" about the story, as in "We've heard it", but they also say that they can neither deny nor confirm it. So that's not much.

hef19898 8y ago

It is an interessting story indeed, espiacially with third country sources more or less confirming the general story but not the specific details. I personally have a hard time to believe Bloomberg went public with it without a thourough due dilligence. They should be totally aware of the consequences if they did. At least for Amazon, having jepardiced servers, this goes strait to the core of their business namely customer trust. Until now Amazon did not have any data breaches of customer data which they did pride themselves a lot for. If the Bloomberg story is true, this ould be at risk. So, yeah, a strong denial is exactly what one could expect. I'm curious to see that story unfold.

_red 8y ago

This is completely anecdotal, but I'm on several mailing list for bulk buyers of off-lease server equipment. Typically these list are 90% Dell, HP, IBM. About 6 months ago I started to notice a huge percentage of SuperMicros being sold. Sometimes the whole list was nothing but SM servers. Obviously could be many factors, but does strike me as odd.

the_duke 8y ago
Any of those public or easy to get in to? Would be nice to quantify this.