5 ms·
OK so this is a different hack than Bloomberg reported before: ethernet jack piggyback instead of bmc. I'm not sure this adds credibility to the allegations in
by berbec 8y ago
OK so this is a different hack than Bloomberg reported before: ethernet jack piggyback instead of bmc. I'm not sure this adds credibility to the allegations in the other story.
The details that Bloomberg related previously are so different that this couldnt be what they originally were reporting on. This adds to the China hacking server board narrative, but it does nothing to prove the Bloomberg reporting actually true.
It does cast doubt on the denials made previously.
It seems this story isn't totally smoke and mirrors as Apple, Amazon and Super Micro seem to want us to believe.
- resters 8y agoRead it more carefully. The ethernet jack is a tactic used by US intelligence years ago. That was mentioned in the story to explain the history of supply chain attacks.
- cm2187 8y agoDo you think the NSA manufactured their implants in China?
- Gokenstein 8y agoPlausible deniability. Wouldn't surprise me if China is getting the blame for a LOT of US hacking.
- resters 8y agoI think it's totally plausible. See my other comment in this thread for my conspiracy theory :)
- setquk 8y agoWith the current political climate, that might be the intention. If you undermine international trade though marketing you don't have to fight a tariff war.
- Gokenstein 8y agoSeems like all US conflicts are now an excuse to race to the bottom with whoever our "enemy" is. We imported torture from the middle east and now state run news and corporations from China.
- deleted 8y ago[deleted]
- duxup 8y agoIf it is well known... can't imagine others wouldn't follow if it works. Hard to imagine it remains an exclusive method by one actor.
- ricardobeat 8y ago> subsequent physical inspection revealed an implant built into the server’s Ethernet connector It looks pretty clear that this is the hack in question, not an example.
- jldugger 8y agoNote that BMCs can also piggyback on ethernet ports; I've seen some vendors use a shared ethernet port for OOB and ethernet. Which is fun because you can accidentally put a super important insecure oob service on the same jack as an internet exposed web service.
- jlgaddis 8y agoIIRC... The DCMI spec actually requires that the BMC be capable of sharing an Ethernet port. A dedicated Ethernet port for the BMC is optional.
- bockafer 8y agoSM boards with dedi and shared phy for ipmi are usually defaulted to auto mode. I think first interface it can arp for the gateway on wins (or maybe dedi then shared).