4 ms·

The most compelling explanation I've heard is that the BMC chip could be programmed by two distinct flash chips, one for factory programming and one for some ot

The most compelling explanation I've heard is that the BMC chip could be programmed by two distinct flash chips, one for factory programming and one for some other purpose. In some SKUs, the latter isn't populated but it has a higher priority than the first chip. Since there are many flash chips fitting the same pin out, all it took was soldering a compromised flash chip (with firmware for the BMC chip) onto pads that are already part of the design to compromise the whole system without any obvious sign that the board was tampered with (because in some SKUs, both chips were populated).

simias 8y ago
By explanation do you mean theory or is it coming from somebody who has special knowledge of the situation? I'm not trying to be adversarial, even if it's only a theory it's an interesting one, but given the amount of conflicting information we have regarding this whole mess I think it's important to be clear about what's pure speculation and what's been reported by people supposedly in the know.
jlgaddis 8y ago
The BMCs on the newest Supermicro servers are from ASPEED. The X10 models have the AST2400 [0] and the X11 models have the AST2500 [1]. They have ARM CPUs and run, basically, an embedded Linux. If you wanted to "backdoor" motherboards that shipped with these BMCs, wouldn't it would be much easier to just install your own "customized" version of the firmware on them? It certainly seems that it'd be much more difficult to incorporate another device into the system. [0]: https://www.aspeedtech.com/products.php?fPath=20&rId=376 https://www.aspeedtech.com/products.php?fPath=20&rId=376 [1]: https://www.aspeedtech.com/products.php?fPath=20&rId=440 https://www.aspeedtech.com/products.php?fPath=20&rId=440
- vel0city 8y ago
  If possible, it is better to have separate hardware that can continuously compromise the firmware. That way your exploit continues to exist even if valid firmware is flashed directly onto the memory module.
- gruez 8y ago
  because all it takes for it to be discovered is someone checking the SPI flash contents
- OverlordXenu 8y ago
  well companies like Apple and Amazon are reflashing/updating, so that wouldn't stick.
- akiselev 8y ago
  If I'm right, that's exactly what they did. When the BMC chip boots, it checks two flash chips for firmware so the attacker just uploaded their own code to one of a million standard SPI flash chips and plopped it onto the board. They didn't have to incorporate another device into the system, the system was already designed for two flash memory chips. However, to save money on some SKUs, the manufacturer left one of the positions on the board open. Normally this wouldn't be worth talking about because most active chips are too complicated and too design/supplier specific to carry out an attack like this, but SPI flash is about as standard a footprint/protocol as you can get in EE short of transistors so if you ship a product that could be reprogrammed from unpopulated pads, you're opening yourself up to a large attack surface. Honestly, after I read the latest BMC chip theory I was like: "Oh, shit. Have I done that?"

simias 8y ago

By explanation do you mean theory or is it coming from somebody who has special knowledge of the situation? I'm not trying to be adversarial, even if it's only a theory it's an interesting one, but given the amount of conflicting information we have regarding this whole mess I think it's important to be clear about what's pure speculation and what's been reported by people supposedly in the know.

jlgaddis 8y ago

The BMCs on the newest Supermicro servers are from ASPEED. The X10 models have the AST2400 [0] and the X11 models have the AST2500 [1]. They have ARM CPUs and run, basically, an embedded Linux. If you wanted to "backdoor" motherboards that shipped with these BMCs, wouldn't it would be much easier to just install your own "customized" version of the firmware on them? It certainly seems that it'd be much more difficult to incorporate another device into the system. [0]: https://www.aspeedtech.com/products.php?fPath=20&rId=376 https://www.aspeedtech.com/products.php?fPath=20&rId=376 [1]: https://www.aspeedtech.com/products.php?fPath=20&rId=440 https://www.aspeedtech.com/products.php?fPath=20&rId=440

vel0city 8y ago
If possible, it is better to have separate hardware that can continuously compromise the firmware. That way your exploit continues to exist even if valid firmware is flashed directly onto the memory module.
gruez 8y ago
because all it takes for it to be discovered is someone checking the SPI flash contents
OverlordXenu 8y ago
well companies like Apple and Amazon are reflashing/updating, so that wouldn't stick.
akiselev 8y ago
If I'm right, that's exactly what they did. When the BMC chip boots, it checks two flash chips for firmware so the attacker just uploaded their own code to one of a million standard SPI flash chips and plopped it onto the board. They didn't have to incorporate another device into the system, the system was already designed for two flash memory chips. However, to save money on some SKUs, the manufacturer left one of the positions on the board open. Normally this wouldn't be worth talking about because most active chips are too complicated and too design/supplier specific to carry out an attack like this, but SPI flash is about as standard a footprint/protocol as you can get in EE short of transistors so if you ship a product that could be reprogrammed from unpopulated pads, you're opening yourself up to a large attack surface. Honestly, after I read the latest BMC chip theory I was like: "Oh, shit. Have I done that?"