4 ms·

Despite the comments here, there's more evidence that that story was not made up, with real names this time at least. https://www.bloomberg.com/news/articles/2

Despite the comments here, there's more evidence that that story was not made up, with real names this time at least. https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom https://www.bloomberg.com/news/articles/2018-10-09/new-evide... I'm not saying it is true, but of course all parties involved will deny everything, imagine how much it would hurt them if they acknowledged they have been hacked.

jakebasile 8y ago
I don't know, previous revelations of wide scale breaches haven't affected the target companies that much.
- AimForTheBushes 8y ago
  They almost all cause an immediate loss in value though. Knowing that knowledge beforehand would net someone a lot of money.
  - airstrike 8y ago
    Especially around earnings season...
- m0skit0 8y ago
  But those were one-time breaches related to patchable software flaws, and nobody knew for sure if a national-backed entity did it (maybe except Stuxnet https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet). They were not hardware and not directly linked to the Chinese government.
TACIXAT 8y ago
This evidence does nothing to support the original chip story. An ethernet implant is completely separate and does not affect the originally reported companies.
seppin 8y ago
All parties have every reason to deny. The companies will be hurt, the intel folks don't want anything public, ever. Journalists are the only ones that care about what the public knows.
- fx32s 8y ago
  The proof of guilt is on the accusing party though. Still lacking hard evidence here.
duskwuff 8y ago
There's a lot about this story that doesn't add up either. One particularly questionable bit is: > Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones. The metal is necessary to diffuse heat from the chip hidden inside, which acts like a mini computer. Every RJ45 jack ("Ethernet connector") I've seen used in modern networking hardware has a metal case for EMI shielding. This isn't an indicator of compromise. Nor does this make sense as a location for an implant -- the RJ45 jack isn't in a privileged position to access information on the server, nor would a device located inside the jack be able to easily interact with the network without interfering with the real Ethernet controller.
- gamblor956 8y ago
  Every RJ45 jack ("Ethernet connector") I've seen used in modern networking hardware has a metal case for EMI shielding. Where would one acquire these metal RJ45 jacks? The ones I have are all plastic (usually clear), with the exception of the small (copper?) metal wires that transmit the signals. I am in fact looking at one right now on my desk and it's definitely not metal shielded.
  - calbear81 8y ago
    It's called a shielded RJ45 jack (you can also search for a shielded ethernet cable).
  - cthalupa 8y ago
    He is not referring to the jack you place in a wall or patch panel, but instead the one that is on the NIC or motherboard. I have never seen a plastic ethernet jacket on a server motherboard or server NIC.
  - duskwuff 8y ago
    Those are RJ45 plugs. An RJ45 jack is the female portion that's typically soldered onto a PCB. Here's an example of what I'm talking about: https://www.digikey.com/product-detail/en/amphenol-commercial-products/RJCSE538001/RJCSE538001TR-ND/3464999 https://www.digikey.com/product-detail/en/amphenol-commercia...
bonestamp2 8y ago
> imagine how much it would hurt them if they acknowledged they have been hacked We don't even have to imagine much beyond the current pain its caused Supermicro. According to that article, the stock dropped 41% last Thursday from the original article and then another 15% today (the article says 27% today, but they made some gains since the article was published).

jakebasile 8y ago

I don't know, previous revelations of wide scale breaches haven't affected the target companies that much.

AimForTheBushes 8y ago
They almost all cause an immediate loss in value though. Knowing that knowledge beforehand would net someone a lot of money.
- airstrike 8y ago
  Especially around earnings season...
m0skit0 8y ago
But those were one-time breaches related to patchable software flaws, and nobody knew for sure if a national-backed entity did it (maybe except Stuxnet https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet). They were not hardware and not directly linked to the Chinese government.

TACIXAT 8y ago

This evidence does nothing to support the original chip story. An ethernet implant is completely separate and does not affect the originally reported companies.

seppin 8y ago

All parties have every reason to deny. The companies will be hurt, the intel folks don't want anything public, ever. Journalists are the only ones that care about what the public knows.

fx32s 8y ago
The proof of guilt is on the accusing party though. Still lacking hard evidence here.

duskwuff 8y ago

There's a lot about this story that doesn't add up either. One particularly questionable bit is: > Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones. The metal is necessary to diffuse heat from the chip hidden inside, which acts like a mini computer. Every RJ45 jack ("Ethernet connector") I've seen used in modern networking hardware has a metal case for EMI shielding. This isn't an indicator of compromise. Nor does this make sense as a location for an implant -- the RJ45 jack isn't in a privileged position to access information on the server, nor would a device located inside the jack be able to easily interact with the network without interfering with the real Ethernet controller.

gamblor956 8y ago
Every RJ45 jack ("Ethernet connector") I've seen used in modern networking hardware has a metal case for EMI shielding. Where would one acquire these metal RJ45 jacks? The ones I have are all plastic (usually clear), with the exception of the small (copper?) metal wires that transmit the signals. I am in fact looking at one right now on my desk and it's definitely not metal shielded.
- calbear81 8y ago
  It's called a shielded RJ45 jack (you can also search for a shielded ethernet cable).
- cthalupa 8y ago
  He is not referring to the jack you place in a wall or patch panel, but instead the one that is on the NIC or motherboard. I have never seen a plastic ethernet jacket on a server motherboard or server NIC.
- duskwuff 8y ago
  Those are RJ45 plugs. An RJ45 jack is the female portion that's typically soldered onto a PCB. Here's an example of what I'm talking about: https://www.digikey.com/product-detail/en/amphenol-commercial-products/RJCSE538001/RJCSE538001TR-ND/3464999 https://www.digikey.com/product-detail/en/amphenol-commercia...

bonestamp2 8y ago

> imagine how much it would hurt them if they acknowledged they have been hacked We don't even have to imagine much beyond the current pain its caused Supermicro. According to that article, the stock dropped 41% last Thursday from the original article and then another 15% today (the article says 27% today, but they made some gains since the article was published).