5 ms·

and if it is correct?

imglorp 8y ago
If it's correct, it's highly likely that most cloud vendors are in the same boat. Imagine Google or AWS, who each have multiple millions of servers: even if they build their own motherboards, there are so many 3rd party components there's no way to vet all the boards. Their IDS will catch some, but not all. One might imagine a cloud vendor is constantly the target from multiple state actors, foreign and domestic, all vying for universal access.
- cm2187 8y ago
  I can't imagine the cost of x-ray-ing all motherboards on an AWS scale.
  - imglorp 8y ago
    X-ray won't catch substitute chips: they will have the same package and same markings but a few extra functions on their silicon. Good luck eyeballing that one. I think you're right though: they should examine a sample of the boards at lest. In addition--layering defense--one would imagine simply putting a motherboard on a quarantine LAN, simulating their production network, and watching its network traffic for phoning home. The real implants might be waiting for a specific situation, like a date or a string on the bus, so you never really know if you got them all.
  - AnthonyMouse 8y ago
    At that point they might as well just replace them. Which they presumably do every few years regardless.
jackconnor 8y ago
Then they’re screwed, because it was them who messed up and didn’t QA hard enough. We’ll see...
ElBarto 8y ago
Following the first story it was reported that Amazon had already ditched Supermicro as a supplier.
- toast0 8y ago
  Given Amazon's scale, I would be very surprised if they're not either leveraging Open Compute designs or doing something similar with custom designs similar to open compute. Supermicro makes nice motherboards and servers, but they definitely are addressing general purposes, and something tuned more towards the specific needs of Amazon could be a lot more cost effective; even if that just means getting hardware that runs OpenBMC so the BMC firmware isn't complete trash.

If it's correct, it's highly likely that most cloud vendors are in the same boat. Imagine Google or AWS, who each have multiple millions of servers: even if they build their own motherboards, there are so many 3rd party components there's no way to vet all the boards. Their IDS will catch some, but not all. One might imagine a cloud vendor is constantly the target from multiple state actors, foreign and domestic, all vying for universal access.

cm2187 8y ago
I can't imagine the cost of x-ray-ing all motherboards on an AWS scale.
- imglorp 8y ago
  X-ray won't catch substitute chips: they will have the same package and same markings but a few extra functions on their silicon. Good luck eyeballing that one. I think you're right though: they should examine a sample of the boards at lest. In addition--layering defense--one would imagine simply putting a motherboard on a quarantine LAN, simulating their production network, and watching its network traffic for phoning home. The real implants might be waiting for a specific situation, like a date or a string on the bus, so you never really know if you got them all.
- AnthonyMouse 8y ago
  At that point they might as well just replace them. Which they presumably do every few years regardless.

jackconnor 8y ago

Then they’re screwed, because it was them who messed up and didn’t QA hard enough. We’ll see...

ElBarto 8y ago

Following the first story it was reported that Amazon had already ditched Supermicro as a supplier.

toast0 8y ago
Given Amazon's scale, I would be very surprised if they're not either leveraging Open Compute designs or doing something similar with custom designs similar to open compute. Supermicro makes nice motherboards and servers, but they definitely are addressing general purposes, and something tuned more towards the specific needs of Amazon could be a lot more cost effective; even if that just means getting hardware that runs OpenBMC so the BMC firmware isn't complete trash.