6 ms·

Remember when Clapper gave the "least untruthful answer possible" about domestic bulk collection? [0] It's naive to think Apple and Amazon couldn't lie in resp

Remember when Clapper gave the "least untruthful answer possible" about domestic bulk collection? [0] It's naive to think Apple and Amazon couldn't lie in response to the article, if the intelligence was highly-classified. They may be under extremely strict gag orders (e.g. "give no response whatsoever, including silence, other than denial") and protected by promises of indemnity, as telcos were in the wake of the NSA disclosures. Bloomberg is exquisitely specific and detailed about the chip, including photos and placement (on the baseboard management bridge, disguised as a shielding element.) There's two possibilities, then: someone cajoled dozens of officials across several companies to lie to Bloomberg, or the tech companies have been cajoled into lying. Either way, the proof is in the pudding: every hardware pentesting shop will be going after these boards like they're looking for golden tickets. Either we'll get our die shot, or Bloomberg's getting their pants sued off. 0. https://m.youtube.com/watch?v=Jkb5FKlETqY https://m.youtube.com/watch?v=Jkb5FKlETqY

tinus_hn 8y ago
I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order, if there also is the option of not addressing it at all.
- michaelt 8y ago
  I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order I've always thought such denials are pointless. You think everyone at Google knows every secret gag order they're under? Of course not, that would get leaked within minutes. If I was the NSA I'd find a "patriotic" mid-level or junior employee with the power I wanted to subvert, and give them a gagging order that stopped them telling their boss. That way the Google PR can honestly say that the CEO and legal team haven't seen or heard of a gagging order.
  - sct202 8y ago
    I think it would be odd then if no one else in the company is aware of the issue that those mid/junior level employees would then leak the information to Bloomberg during an active investigation.
yourapostasy 8y ago
> ...every hardware pentesting shop will be going after these boards like they're looking for golden tickets. The way the original story was written, it suggested that four subcontractors were identified, and almost 30 targets selected, with the implied suggestion that either the boards were custom special order boards, or destined for a specific lot order made by a customer. If true, then it is unlikely these boards will be found in the wild except by slipping through those almost 30 targets into the used market. Supermicro has about 600 board SKUs, so finding these needles in the haystack is likely more feasible by approaching data centers offering to help find the boards for free, in return for allowing the pentesting firms to take physical possession of such found boards. The story did reveal that the original "tell" that gave away the chip was odd but not obviously malicious at first glance network traffic, and that the suspected intent was implementing an Advanced Persistent Threat model. The article also mentioned the chips were connected with the BMC, but it wasn't specified in the article whether or not the chips got out onto the Net. So finding the boards in the wild probably will focus upon finding them in the same manner, over the network. Power down the server, let the BMC stay powered on, and watch for unwarranted network activity. Or boot a Linux on a stick that deliberately does as little as possible and premises networking allows it to do just enough routing out to the Net to capture traces of what unauthorized network traffic is trying to do, and watch for unwarranted network activity, in case the chip design is clever, and hides its activity until it detects the mainboard is already running before trying to inject its network payloads onto the mainboard's network interfaces. What are others' thoughts on how to find these "golden ticket" boards?
- dvfjsdhgfv 8y ago
  That's the interesting bit. Having done so much to hide the exploit your most important aim is to hide it's presence. Anything that would just "connect to a Chinese server" would be discovered immediately. If the Bloomberg story is true, the network traffic scheme must have been extremely sophisticated to fool so many network security specialists at top companies for such a long time. This, or the story is false, purposely or not.
  - ytjohn 8y ago
ElBarto 8y ago
> Either way, the proof is in the pudding: every hardware pentesting shop will be going after these boards like they're looking for golden tickets. Either we'll get our die shot, or Bloomberg's getting their pants sued off. From the story, this seems to have happened several years ago. I wouldn't be surprised if house cleaning had been done for some time. If the story is true then I doubt that the Chinese would have flooded the market with these boards. It must have been relatively targeted.
chrisdhoover 8y ago
The proof of the pudding is in the eating. That makes sense. I ate the pudding it tasted good it proved to me its deliciousness. There is no proof in a pudding that is not eaten.
- x0054 8y ago
  You clearly not an Agatha Christie Fan
tptacek 8y ago
This isn't how gag orders (or, in the case of online services, NSLs) work. A gag order can compel you not to share data, but they cannot compel you to lie, let alone lie elaborately, as Apple and Amazon at this point would have to be for their denials to be false. If Apple is lying here, they're lying because they want to, not because something is forcing them to. I believe them.
- kevin_b_er 8y ago
  "Did you receive an NSL?" You have been compel to lie, by the government, to answer "NO" if you've received one. If you can be compelled to lie that you have received an NSL then I do not see why you can't be forced to lie more. We already compelled speech, why not more?
  - isostatic 8y ago
    I thought that you could simply not answer the NSL question (hence warrant canaries)
    - SpaceGorilla 8y ago
      Iirc that's only in theory. I don't think there has been any precedent set. But I always see people say that a warrant canary is a false sense of security.
- rocqua 8y ago
  > This isn't how gag orders (or, in the case of online services, NSLs) work. A gag order can compel you not to share data, but they cannot compel you to lie, let alone lie elaborately Is there case-law to support this? I've heard the argument often, but I don't believe it has yet been tested.
  - vsl 8y ago
    It’s a well established doctrine that this is a direct consequence of First Amedment: https://mtsu.edu/first-amendment/article/933/compelled-speech https://mtsu.edu/first-amendment/article/933/compelled-speec...
bobwaycott 8y ago
> Bloomberg is exquisitely specific and detailed about the chip, including photos and placement (on the baseboard management bridge, disguised as a shielding element.) They are very specific, yes. They show pictures of the alleged chips that are allegedly disguised, yes. They describe placement, yes. However, photographic or video evidence of these chips on SuperMicro boards is conspicuously absent. The only visual of placement is an illustration, not a photo. I’m not suggesting Bloomberg is wrong. I find this story fascinating and incredible (if true). But I noticed there were no photos/video of the chips on boards.
teknologist 8y ago
One thing that sticks out to me is that they are fairly persistent on using "Apple" rather than something like "Apple and its security partners and subcontractors", which would eliminate most of the potential for doubt.
eeeeeeeeeeeee 8y ago
The last paragraph of the press release on this hacker news post: "Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations." So you're basically implying that Apple is colluding with the US government to actively lie to discredit this story.
- acct1771 8y ago
  The funny part is that, based on your tone, you can't imagine a case where: 1) that's possible and 2) Apple may not be a willing colluding party.
  - SpicyLemonZest 8y ago
    I can't imagine a case where it's within the US's power to force Apple to falsely deny a story for them, but not within their power to feed a fake story to Bloomberg.

tinus_hn 8y ago

I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order, if there also is the option of not addressing it at all.

michaelt 8y ago
I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order I've always thought such denials are pointless. You think everyone at Google knows every secret gag order they're under? Of course not, that would get leaked within minutes. If I was the NSA I'd find a "patriotic" mid-level or junior employee with the power I wanted to subvert, and give them a gagging order that stopped them telling their boss. That way the Google PR can honestly say that the CEO and legal team haven't seen or heard of a gagging order.
- sct202 8y ago
  I think it would be odd then if no one else in the company is aware of the issue that those mid/junior level employees would then leak the information to Bloomberg during an active investigation.

yourapostasy 8y ago

> ...every hardware pentesting shop will be going after these boards like they're looking for golden tickets. The way the original story was written, it suggested that four subcontractors were identified, and almost 30 targets selected, with the implied suggestion that either the boards were custom special order boards, or destined for a specific lot order made by a customer. If true, then it is unlikely these boards will be found in the wild except by slipping through those almost 30 targets into the used market. Supermicro has about 600 board SKUs, so finding these needles in the haystack is likely more feasible by approaching data centers offering to help find the boards for free, in return for allowing the pentesting firms to take physical possession of such found boards. The story did reveal that the original "tell" that gave away the chip was odd but not obviously malicious at first glance network traffic, and that the suspected intent was implementing an Advanced Persistent Threat model. The article also mentioned the chips were connected with the BMC, but it wasn't specified in the article whether or not the chips got out onto the Net. So finding the boards in the wild probably will focus upon finding them in the same manner, over the network. Power down the server, let the BMC stay powered on, and watch for unwarranted network activity. Or boot a Linux on a stick that deliberately does as little as possible and premises networking allows it to do just enough routing out to the Net to capture traces of what unauthorized network traffic is trying to do, and watch for unwarranted network activity, in case the chip design is clever, and hides its activity until it detects the mainboard is already running before trying to inject its network payloads onto the mainboard's network interfaces. What are others' thoughts on how to find these "golden ticket" boards?

dvfjsdhgfv 8y ago
That's the interesting bit. Having done so much to hide the exploit your most important aim is to hide it's presence. Anything that would just "connect to a Chinese server" would be discovered immediately. If the Bloomberg story is true, the network traffic scheme must have been extremely sophisticated to fool so many network security specialists at top companies for such a long time. This, or the story is false, purposely or not.
- ytjohn 8y ago

ElBarto 8y ago

> Either way, the proof is in the pudding: every hardware pentesting shop will be going after these boards like they're looking for golden tickets. Either we'll get our die shot, or Bloomberg's getting their pants sued off. From the story, this seems to have happened several years ago. I wouldn't be surprised if house cleaning had been done for some time. If the story is true then I doubt that the Chinese would have flooded the market with these boards. It must have been relatively targeted.

chrisdhoover 8y ago

The proof of the pudding is in the eating. That makes sense. I ate the pudding it tasted good it proved to me its deliciousness. There is no proof in a pudding that is not eaten.

x0054 8y ago
You clearly not an Agatha Christie Fan

tptacek 8y ago

This isn't how gag orders (or, in the case of online services, NSLs) work. A gag order can compel you not to share data, but they cannot compel you to lie, let alone lie elaborately, as Apple and Amazon at this point would have to be for their denials to be false. If Apple is lying here, they're lying because they want to, not because something is forcing them to. I believe them.

kevin_b_er 8y ago
"Did you receive an NSL?" You have been compel to lie, by the government, to answer "NO" if you've received one. If you can be compelled to lie that you have received an NSL then I do not see why you can't be forced to lie more. We already compelled speech, why not more?
- isostatic 8y ago
  I thought that you could simply not answer the NSL question (hence warrant canaries)
  - SpaceGorilla 8y ago
    Iirc that's only in theory. I don't think there has been any precedent set. But I always see people say that a warrant canary is a false sense of security.
rocqua 8y ago
> This isn't how gag orders (or, in the case of online services, NSLs) work. A gag order can compel you not to share data, but they cannot compel you to lie, let alone lie elaborately Is there case-law to support this? I've heard the argument often, but I don't believe it has yet been tested.
- vsl 8y ago
  It’s a well established doctrine that this is a direct consequence of First Amedment: https://mtsu.edu/first-amendment/article/933/compelled-speech https://mtsu.edu/first-amendment/article/933/compelled-speec...

bobwaycott 8y ago

> Bloomberg is exquisitely specific and detailed about the chip, including photos and placement (on the baseboard management bridge, disguised as a shielding element.) They are very specific, yes. They show pictures of the alleged chips that are allegedly disguised, yes. They describe placement, yes. However, photographic or video evidence of these chips on SuperMicro boards is conspicuously absent. The only visual of placement is an illustration, not a photo. I’m not suggesting Bloomberg is wrong. I find this story fascinating and incredible (if true). But I noticed there were no photos/video of the chips on boards.

teknologist 8y ago

One thing that sticks out to me is that they are fairly persistent on using "Apple" rather than something like "Apple and its security partners and subcontractors", which would eliminate most of the potential for doubt.

eeeeeeeeeeeee 8y ago

The last paragraph of the press release on this hacker news post: "Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations." So you're basically implying that Apple is colluding with the US government to actively lie to discredit this story.

acct1771 8y ago
The funny part is that, based on your tone, you can't imagine a case where: 1) that's possible and 2) Apple may not be a willing colluding party.
- SpicyLemonZest 8y ago
  I can't imagine a case where it's within the US's power to force Apple to falsely deny a story for them, but not within their power to feed a fake story to Bloomberg.