5 ms·

That's the interesting bit. Having done so much to hide the exploit your most important aim is to hide it's presence. Anything that would just "connect to a Chi

That's the interesting bit. Having done so much to hide the exploit your most important aim is to hide it's presence. Anything that would just "connect to a Chinese server" would be discovered immediately. If the Bloomberg story is true, the network traffic scheme must have been extremely sophisticated to fool so many network security specialists at top companies for such a long time. This, or the story is false, purposely or not.

ytjohn 8y ago
Most places I know of isolate their OOB management network, requiring a vpn or jumpbox to access it. However, if someone did let their OOB network full outbound access, I could see this slipping through. I could imagine that simply going to a CDN or cloud provider like AWS/Cloudfront/cloudflare/akamai with a dns lookup along the lines of updates.supermicro.cdn-front.com wouldn't be too suspicious. At that point, you'd be looking for dns lookups and not firewall hits. If you are blocking outbound, I could still this going unnoticed if you're not actively reviewing denials. But, if you are properly watching dns lookups from OOB and it's anything other than necessary services (ntp, ldap, syslog), then this would get picked up pretty quickly.
- fulafel 8y ago
  Sounds like many things would have to go right in the defender's court. Optimism is not a good defense strategy :)
  - ytjohn 8y ago
    Heh. One colleague has "Hope is not a valid deployment strategy" as a signature. Most places might be blocking this type of activity by default. For most of our security audits, it's just assumed that the SM IPMI or Dell idrac is vulnerable to one exploit or another. We mitigate that by controlling the traffic. I feel this is common practice in most places that understand vlans and firewalls. However, while blocking is easy, being aware of something like this is on another level altogether. Unicorn jumping over a rainbow level rare. You really have to be logging outbound attempts and dns lookups. Where I work, there is a full security team and they are at an insane level where they log the allowed traffic. One told me that the allowed traffic is more interesting than the denied traffic. Denied just tells them what we anticipated, while active helps them establish a pattern and look for deviations.
    - dvfjsdhgfv 8y ago
      That's my point. Security people were analyzing network traffic for decades trying to spot something that doesn't fit, host-wise, pattern-wise or even packet-wise (see The Museum of Broken Packets[0], for example). And someone managed to somehow hide all this traffic from security experts working for Amazon and Apple, for months or years? I'm very curious to see how. [0] http://lcamtuf.coredump.cx/mobp/ http://lcamtuf.coredump.cx/mobp/
      - fulafel 8y ago
        I think you misread - "Unicorn jumping over a rainbow level rare" was about catching it, not missing it.
- isostatic 8y ago
  > However, if someone did let their OOB network full outbound access, I could see this slipping through. Quite, especially in small networks and inline ilos, entirely possible that people plug the ilo (ipmi etc) to a more open network. Sure, nothing in, but no block on stuff going out.
TheOtherHobbes 8y ago
I'd appreciate a detailed explanation of the steps needed to get from putting this chip on a motherboard to actionable intelligence useful to a hostile nation state. If we're talking about being able to make changes at the OS level, surely those should be relatively easy to spot? If we're talking about copying packets, wouldn't that be useless under most circumstances? If we're talking about doing whatever on a mass scale, surely most of the data would be junk and a huge and very clever backend would be needed to sift out the useful elements? Presumably none of this is impossible, but I haven't yet seen a good description of how it's all supposed to fit together.
- rocqua 8y ago
  Something like triggering a memory-read of a specific address the moment you see a TLS diffie helman exchange on the wire? The idea being that you can recover the session key, and thus break the encryption retroactively. That requires more than just access to the network, but it is rather simple. With just access to the network, perhaps one could do spoofed DNS responses that are never seen on the network? A very simple '1% of the time, set the gmail.com A record to the chinese gmail IP' might be enough. One could create mayhem by sending false ARP or DHCP responses, but that is only mayhem. Perhaps if it is externally triggerable it is useful offensively as DoS.

ytjohn 8y ago

Most places I know of isolate their OOB management network, requiring a vpn or jumpbox to access it. However, if someone did let their OOB network full outbound access, I could see this slipping through. I could imagine that simply going to a CDN or cloud provider like AWS/Cloudfront/cloudflare/akamai with a dns lookup along the lines of updates.supermicro.cdn-front.com wouldn't be too suspicious. At that point, you'd be looking for dns lookups and not firewall hits. If you are blocking outbound, I could still this going unnoticed if you're not actively reviewing denials. But, if you are properly watching dns lookups from OOB and it's anything other than necessary services (ntp, ldap, syslog), then this would get picked up pretty quickly.

fulafel 8y ago
Sounds like many things would have to go right in the defender's court. Optimism is not a good defense strategy :)
- ytjohn 8y ago
  Heh. One colleague has "Hope is not a valid deployment strategy" as a signature. Most places might be blocking this type of activity by default. For most of our security audits, it's just assumed that the SM IPMI or Dell idrac is vulnerable to one exploit or another. We mitigate that by controlling the traffic. I feel this is common practice in most places that understand vlans and firewalls. However, while blocking is easy, being aware of something like this is on another level altogether. Unicorn jumping over a rainbow level rare. You really have to be logging outbound attempts and dns lookups. Where I work, there is a full security team and they are at an insane level where they log the allowed traffic. One told me that the allowed traffic is more interesting than the denied traffic. Denied just tells them what we anticipated, while active helps them establish a pattern and look for deviations.
  - dvfjsdhgfv 8y ago
    That's my point. Security people were analyzing network traffic for decades trying to spot something that doesn't fit, host-wise, pattern-wise or even packet-wise (see The Museum of Broken Packets[0], for example). And someone managed to somehow hide all this traffic from security experts working for Amazon and Apple, for months or years? I'm very curious to see how. [0] http://lcamtuf.coredump.cx/mobp/ http://lcamtuf.coredump.cx/mobp/
    - fulafel 8y ago
      I think you misread - "Unicorn jumping over a rainbow level rare" was about catching it, not missing it.
isostatic 8y ago
> However, if someone did let their OOB network full outbound access, I could see this slipping through. Quite, especially in small networks and inline ilos, entirely possible that people plug the ilo (ipmi etc) to a more open network. Sure, nothing in, but no block on stuff going out.

TheOtherHobbes 8y ago

I'd appreciate a detailed explanation of the steps needed to get from putting this chip on a motherboard to actionable intelligence useful to a hostile nation state. If we're talking about being able to make changes at the OS level, surely those should be relatively easy to spot? If we're talking about copying packets, wouldn't that be useless under most circumstances? If we're talking about doing whatever on a mass scale, surely most of the data would be junk and a huge and very clever backend would be needed to sift out the useful elements? Presumably none of this is impossible, but I haven't yet seen a good description of how it's all supposed to fit together.

rocqua 8y ago
Something like triggering a memory-read of a specific address the moment you see a TLS diffie helman exchange on the wire? The idea being that you can recover the session key, and thus break the encryption retroactively. That requires more than just access to the network, but it is rather simple. With just access to the network, perhaps one could do spoofed DNS responses that are never seen on the network? A very simple '1% of the time, set the gmail.com A record to the chinese gmail IP' might be enough. One could create mayhem by sending false ARP or DHCP responses, but that is only mayhem. Perhaps if it is externally triggerable it is useful offensively as DoS.