4 ms·
They have a photograph of the chip and scores of (unfortunately anonymous) sources. It sounds like some researcher found weird traffic, eventually found there
by droithomme 8y ago
They have a photograph of the chip and scores of (unfortunately anonymous) sources.
It sounds like some researcher found weird traffic, eventually found there is a chip on some of these servers that wasn't in the original gerber files, and this chip is doing something, and beyond that a lot of people are speculating about who and what.
Apple and Amazon deny that the story is correct. That doesn't mean that there isn't a chip there and they now know what it is doing but are prohibited from saying much beyond the story as a published whole is not true.
- 14 8y agoWas there a picture of the chip released? I have been trying to follow and last I seen was it seemed the pictures in the article was likely an artists representation of the chip. Did an actual picture get released or was there confirmation the picture they released was the real chip? Thank you
- RL_Quine 8y agoJust an artists impression.
- solarkraft 8y agoWhich is infinitely sketchy.
- Terretta 8y agoFTA: ”... it's not clear if this is a real photograph or a Bloomberg-made mockup.”
- xevb3k 8y agoIt’s reasonably clear that the chip shown in the article is very unlikely to be any kind of microcontroller/semiconductor. It’s embedded in ceramic. Such devices need to be fired at very high temperatures which a semiconductor wouldn’t be able to withstand.
- ohazi 8y agoYou can make two half ceramic pieces and cement them together nearly seamlessly with a semiconductor inside. This was common before DIP packages.
- ethbro 8y agoI was going to say, the number of ways to make something look like a ceramic component are more relevant.
- CamperBob2 8y agoIn any case, someone who can make a malicious IC die look like a balun could just as easily add their die to the EEPROM package that's intended to be there. It makes no sense for state-level bad guys to create disguised packages and add them to boards at the assembly house. There are any number of other links in the supply chain where they could accomplish the same goal with an actual nonzero chance of getting away with it.
- sjwright 8y agoThe key benefit of injecting at the assembly house is that it means you can target the injections based on the final customer. This reduces the footprint of the attack, which reduces the chances of your exploit being publicly exposed, and reduces the risks inherent in scaling up a highly specialised top secret supply chain.
- solarkraft 8y agoYou're arguing against compromising the boards, right?
- sjwright 8y agoNo. I'm pointing out an advantage in putting the exploit into the supply chain as late as possible, such that it can be selected for based on customer. Compromising the motherboard may be a good approach if the boards have some amount of customisation for each customer.