6 ms·
DHS Press Secretary on Recent Media Reports of Potential Supply Chain Compromise
- Jerry2 8y agoSo, both the British and US governments are on the record confirming Apple and Amazon's statements. The next step should be Bloomberg's internal investigation so they can figure out how that story got published without any corroborating evidence. Supermicro's stock took a beating and now they will have a legal case against Bloomberg.
- Simon_says 8y agoI don't see why it's so clear cut. The available evidence is congruent with Bloomberg's story being either true or false.
- nmg 8y ago"Editor's note: The following story is either true or false" doesn't have a very journalistic ring to it..
- coolspot 8y agoBut it is still possible that DHS is just not aware of CIA/NSA discoveries and activities. There were suspicious events that signal that something is up, like when Apple completely switched from Supermicro to other vendors or when they started to develop processes to prevent supply chain hardware attack around time when CIA supposedly found the bug (2015-2016). iPhone is also switched from Qualcomm modem to US designed and fabricated by Intel.
- paranoidrobot 8y agoSwitching from one vendor to another could come from any number of reasons. Also, their work on supply-chain security is also at the same time that Apple was more publicly promoting the security of their own hardware. So those two things could be entirely co-incidental. That said, short of a release of internal documents, I don't think anyone outside has a decent idea of what's going on.
- kccqzy 8y ago> iPhone is [sic] also switched from Qualcomm modem to US designed and fabricated by Intel. Qualcomm is based in San Diego, CA.
- coolspot 8y agoSupermicro is based in San Jose, CA . Qualcomm is fabless company, manufacturing chips among others in Taiwan.
- praneshp 8y agoQualcomm is also American
- dx87 8y agoThere's still too many weasel words in the statement. They didn't confirm that the article is wrong, the said "we have no reason to doubt the statements from the companies named in the story". That could just be another way of saying "we have no reason to doubt that Apple and Amazon weren't aware of the issue." It could also just be DHS trying to cover their ass. They say that supply chain security is core to their mission, so having an article come out alleging that the most valuable company in the world and the primary supplier of government cloud infrastructure were affected by a compromised supply chain would be pretty embarrasing for DHS.
- yalogin 8y agoAt any other moment in history there might be a possibility but I strongly believe that Trump would be more than willing to announce it to the world if this is even under a bit of a doubt. Simply because we haven’t seen any tweets complaining yet I believe that no such thing happened.
- bradleyjg 8y ago> Supermicro's stock took a beating and now they will have a legal case against Bloomberg. Under the First Amendment Supermicro would have to prove actual malice—that is that Bloomberg knee its reporting was false or acted with reckless disregard for the truth. That’s a very difficult standard to meet.
- ikeboy 8y agoCould they subpoena Bloomberg for their sources and sue them?
- anon49124 8y agoIANAL, but this website mentions Chobani sued Alex Jones / InfoWars over allegedly defamatory, fictitious statements. [0] Perhaps Bloomberg can be sued for defamation by Supermicro if discovery can turn up evidence that the story was both malicious and intentional. 0. https://www.robertreeveslaw.com/blog/sued-fake-news/ https://www.robertreeveslaw.com/blog/sued-fake-news/
- bradleyjg 8y agoThe answer is complicated but boils down to: probably not. Both California and New York (the two most plausible jurisdictions for such a suit) have shield laws that create a qualified reporter’s privilege. That’s in addition to the constitutional news gathering privilege, if any (it’s an area where the case law is not entirely settled.)
- headsoup 8y agoActually they said they have 'no reason to doubt' them, which would imply that if something damning was found they could then just say 'ah well now we have reason to doubt.' In other words, they said nothing at all.
- awake 8y agoWhat are people’s thoughts on investing in supermicro. If this story turns out to be false are they undervalued at the moment?
- deleted 8y ago[deleted]
- Danieru 8y agoIt at least looks capable of spiking back to the medium term average once the news clears: http://tools.morningstar.co.uk/uk/stockreport/default.aspx?SecurityToken=0P000086IX]3]0]E0WWE$$ALL http://tools.morningstar.co.uk/uk/stockreport/default.aspx?S...
- united893 8y agoFolks reading this: Please tread with caution, don't take stock advice from HN. Especially for OTC stock. While the story may be false, it's very likely they may never recover. - Their product is fungible, folks on the front line buying motherboards may just chose to avoid SuperMicro to avoid awkward conversations with their boss. - They were having financial issues before, had some shady accounting and got delisted from Nasdaq. They're now traded over the counter. - Last quarter their net earnings were $17M; that'll most likely be wiped and they'll go in the red. - They've got $120M in the bank and $700M in quarterly operating expenses. - The market can stay irrational longer than you can stay liquid. Many companies are now likely auditing their systems for mystery chips. Many companies have learned of the hacked firmware distributed to Apple. Many in-progress orders may have been halted. This may be fatal to them.
- subcosmos 8y agoBoy, if the story is false, that would be a hell of a short sale o.0 Hard to handle such circumstances in the natsec space when specific information is, by it's very nature, unverifiable.
- whatshisface 8y agoIf the hacked chips are found it may turn out to be very verifiable.
- beaner 8y agoNot taking a side, what the heck is the chip in the photos if the story is inaccurate?
- nrp 8y agoIt’s basically an “artist’s representation”. The chip in the image on the Bloomberg cover looks like typical 3-pin oscillator package, and absolutely not a thing that would be placed on a bus with data going through it.
- Itsdijital 8y agoIt's not a micro, but there are microcontrollers that are comparable in size. An AVR ATtiny20 is available in a 1.5mm x 1.4mm package. That's just about a 2mm^2 footprint, it's totally insane.
- zokier 8y agoAnd not just itty ATtinys, for example MAX32660 is full fat ARM M4F core in 1.6x1.6 mm package. It is the sort of thing you could hide pretty much anywhere. For reference here is a picture of similar package (called wlcsp or variation of thereof): https://img.youtube.com/vi/edERx4x5eY0/maxresdefault.jpg https://img.youtube.com/vi/edERx4x5eY0/maxresdefault.jpg
- anon1348 8y agoSomeone found it on sale for 10 cents on Taobao, https://archive.fo/3k7e2 https://archive.fo/3k7e2 (scroll down to the bottom) It's a Ceramic balun HHM1522E1 patch 0805 signal adjustment 880MHz ~ 960MHz
- testplzignore 8y ago> Information and communications technology supply chain security is core to DHS’s cybersecurity mission How true is this? I know US-CERT is within DHS, but what else does DHS do in this area? I did a bit of searching and found https://fcw.com/articles/2018/02/14/dhs-supply-chain-security.aspx https://fcw.com/articles/2018/02/14/dhs-supply-chain-securit..., which seems to imply that until 8 months ago, DHS wasn't doing much (or anything) in this area. If that's the case, I don't see how a statement from them regarding supply chain security can carry any weight. You don't go from nothing to being an expert in 8 months.
- jhabdas 8y agoThere's an Oscar Wilde quote in there somewhere.
- AndrewKemendo 8y agoThe DOD and the IC broadly have been very focused on Supply Chain Risk Management for a long time. Unfortunately the way the SCRM process works inside the govt is that it's legally focused and limited to primarily defense products, specifically things like hardware used in missiles, planes and equipment. The major shift over the last decade or two to the commercial world being the source of a lot of risk vectors that impact the govt, means that govt capabilities to have oversight and control, or even warning, is severely limited. This case is a great example of that, as more and more threats to the govt are coming through commercial and personal devices. Said another way, foreign adversaries don't need to target military equipment to have major capacity to spy on, or impact US government activities and policies. Private companies have to request support from DHS when there isn't a known risk to military supply chain. 99% of companies don't do this because 1. They don't want to, 2. The govt makes it hard to do and 3. It's not advertised well. The US Govt is not structured to handle this at scale and there is no real solution without making a HUGE shift in private sector oversight that would be incredibly unconstitutional.
- anonandonandon 8y agoSuppose somebody had access to a potentially compromised motherboard exhibiting strange behavior on the network. How would one go about analyzing it? Who would be on the so-called dream team? Asking for a friend.
- subcosmos 8y agoPCAP everything, discretely, then think about next steps
- lawnchair_larry 8y agoI would say that if you don’t know the answer to that, you don’t have a potentially compromised board and are just chasing ghosts.
- late2part 8y agoPut pics and facts here anonymously. Alternatively mail a computer security company or FBI - folks are hungry for examples. Or mail me and I will help. Or Bruce Schneier or Krebs or...
- jijji 8y agoIf any box on your network is establishing outbound connetions to machines in china, that would be suspect... Firewalls and IDS at least detect/block this activity.
- Itsdijital 8y agoI feel like if you had the resources to implement something like this, you would also have the resources to mask where you are phoning home to.
- fspeech 8y agoThe Bloomberg report talked about how investigators tracked phone calls inside China, presumably by hacking and compromising Chinese telecom infrastructure. I don't see how, even if true, the US government would own up to something like that, esp. when it is accusing China of hacking. Imagine the headlines that would generate if the Chinese admitted to doing the same to the US (tapping US calls without a court order and with the potential power to shut down the infrastructure in time of conflict). It would be a bigger deal than planting chips on a few motherboards. The whole story smells of fog of war.
- jijji 8y agoIf a real supply chain attack was actually happening sponsored by a foreign government, the US would flag it top secret and never release the details. I find it highly incredulous for DHS, or any US government agency, to publicly denounce such attacks as a non-issue... If anything, the report by Bloomberg is confirming what alot of people already suspected would happen or has already happened.
- jschwartzi 8y agoWhy would they do that? Surely it's to their advantage to actually tell the targets of the supply chain attack about it? What are you basing this on other than speculation?
- qaq 8y agoSo basically Apple stated that they have not found anything and are not aware of FBI investigation and DHS confirmed Apple has not found anything and is not aware of FBI investigation. There is no statement that DHS has not found anything. The rest of the statement is water about DHS taking it's job seriously.
- askaboutit 8y agoIn this day and age it’s quite ironic for any country to say that they don’t hack other countries. China will hack, Russia will hack, japan will hack and USA will definitely hack. It’s not just about control. It’s about corporate advantage as well.
- charlysl 8y agoHacking is one thing, your main outsourcing partner planting hardware backdoors by the millions is quite another. These are companies that take your money and then hack you.
- deleted 8y ago[deleted]
- qrbLPHiKpiux 8y ago> “... [we] are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely.” Snowden showed us otherwise.