4 ms·

This article sounded a bit weird to me from the technical level, but I just assumed it could be lack of clear understanding on the nitty-gritty from the journal

by aylmao 8y ago

This article sounded a bit weird to me from the technical level, but I just assumed it could be lack of clear understanding on the nitty-gritty from the journalist, or just me not knowing about hardware enough to know what's possible and how. Given this is all getting a little fishy I'll share what had me thinking: 1. The article mentions "they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere on the internet..." Servers tend to run on VPNs. This being a dormant backdoor is believable, but then the article mentions: > "American investigators eventually figured out who else had been hit. Since the implanted chips were designed to ping anonymous computers on the internet for further instructions, operatives could hack those computers to identify others who’d been affected." Which makes me believe the devices were active and somehow circumvented corporate VPNs. I'm unsure how undetectable this could be using the system's network stack (or if it would be possible at all)-- would the claim then be that this tiny device shipped with a whole TCP/IP layer and some sort of very powerful wireless capability? 2. It continues with: "and preparing the device’s operating system to accept this new code" Is this possible? Where would a device like this need to be wired to be able to write to memory with some arbitrary payload to do this? From the pictures it looks like it has 6 pins maximum-- could this do? If so, wouldn't this mean this device would need to do some next-level signal processing that would probably require advanced computation? Could said computation be done by a processing unit that fits the size of this chip? Moreover, assuming it takes control of the OS independently would imply there's some decent amounts of memory in here, to hold the payload, etc. no? But if it's just a backdoor that doesn't take control of the OS, then how is it communicating over the internet with other machines like the article claims? Again, I might be wrong and things that I don't think possible might. I'm mostly just curious to know if my intuition is too naive. Please comment below if you know more about these things than I do. EDIT: I was really disappointed that the article itself didn't go into these technicalities, because IMO this would be an impressive feat and newsworthy by itself. The lack of alternative coverage in sources more close to technical expertise was weird to me.

solarkraft 8y ago
If this is actually true (and I have doubts), the reporting will explode in the next few days/weeks with all the detail you could wish for. A few pins can be enough to write to memory, if there's an interface for it (SPI, I2C, but I'd be surprised to see those unprotectedly lying around on a server board ...). It's be very slow, but I think networking could work as well. With efficient software the resources needed on the chip itself could be held very low and eventually offloaded to the main processor. I don't think it has any wireless or DSP stuff. I don't know enough about processors, memory, networking and low level software security to know how difficult it is to compromise a computer with such a chip on the main board, but the chip itself certainly seems feasible. But: It must be really expensive to manufacture the compromised devices. It just seems stupid to manufacture every device with such a chip. 1/1000 seems reasonable. The larger companies have (had?) lots of them anyway.
JdeBP 8y ago
About halfway down, the Bloomberg article mentions a BMC, a baseboard management controller. This is an existing part of mainboard design that has been around for just under a couple of decades. Read up about IPMI and BMCs, what they do and what their capabilities are. Then consider the threat, explained elsewhere on Hacker News several times, of simply supplying an extra ROM chip containing different firmware for that processor to run. Focussing on the technical is focussing on the wrong thing. Bloomberg's point was not that BMCs can do this, nor that they can be made to do this. People have discussed these on-board systems and their problematic natures rather widely. It was that the supply chain is vulnerable, and that (on the assumption that Bloomberg is right) this problem with the supply chain is no longer a hypothetical case of what an attacker government could do, but is now a documented case of what one government has done, a few years ago.

by aylmao 8y ago

solarkraft 8y ago

If this is actually true (and I have doubts), the reporting will explode in the next few days/weeks with all the detail you could wish for. A few pins can be enough to write to memory, if there's an interface for it (SPI, I2C, but I'd be surprised to see those unprotectedly lying around on a server board ...). It's be very slow, but I think networking could work as well. With efficient software the resources needed on the chip itself could be held very low and eventually offloaded to the main processor. I don't think it has any wireless or DSP stuff. I don't know enough about processors, memory, networking and low level software security to know how difficult it is to compromise a computer with such a chip on the main board, but the chip itself certainly seems feasible. But: It must be really expensive to manufacture the compromised devices. It just seems stupid to manufacture every device with such a chip. 1/1000 seems reasonable. The larger companies have (had?) lots of them anyway.

JdeBP 8y ago

About halfway down, the Bloomberg article mentions a BMC, a baseboard management controller. This is an existing part of mainboard design that has been around for just under a couple of decades. Read up about IPMI and BMCs, what they do and what their capabilities are. Then consider the threat, explained elsewhere on Hacker News several times, of simply supplying an extra ROM chip containing different firmware for that processor to run. Focussing on the technical is focussing on the wrong thing. Bloomberg's point was not that BMCs can do this, nor that they can be made to do this. People have discussed these on-board systems and their problematic natures rather widely. It was that the supply chain is vulnerable, and that (on the assumption that Bloomberg is right) this problem with the supply chain is no longer a hypothetical case of what an attacker government could do, but is now a documented case of what one government has done, a few years ago.