10 ms·

Yossi Appleboum on How Bloomberg is Positioning His Research Against Supermicro

143 points by pjf 8y ago

basicplus2 8y ago
TLDR: <We found it in different vendors, not just Supermicro. We found it not just in servers, in different variations, but hardware manipulation on different interfaces, mostly in network related. We found it in different devices connected to the network, even Ethernet switches. I am talking about really big what are considered to be major American brands, many compromised through the same method. This is why I think that Supermicro has nothing to do with that. In many cases, by the way, it is not through manufacturing, it is after through the supply chain. People think of the supply chain in a very narrow sense between the manufacturer and the customer. Supply chain never ends. There are technicians, there are integrators, there are people that work in your facilities. We have seen after installation, after the fact attacks where someone switched something already installed. This is why Supermicro would have no idea what happens later in the supply chain.>
JdeBP 8y ago
The actual title is Yossi Appleboum on How Bloomberg is Positioning His Research Against Supermicro.
- dang 8y ago
  Right. We changed it back. Submitted title was "Yossi Appleboum Disagrees with Bloomberg", which broke the HN guideline about titles: "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
eternalban 8y ago
Mr. Appleboum has made a tactical mistake here and let the kitty out of the bag. This [edit: read: the original Bloomberg article] disinformation campaign appears to have 2 strategic goals. 1 - Penetrate Apple's data centers via a legislative attack vector. We all know that our congress is owned lock stock and barrel by AIPAC. They will pass legislation that will require companies like Apple to permit 3rd parties to audit their facilities. Enter Yossi and company. 1a - As an aside, this confirms for me that for the time being Apple products and facilities are in fact secure and have presented a serious obstacle to the Israeli intelligence services. Bravo to Apple's security teams. 2 - This same nation state actor is poised to pick up the "supply chain" missing links when China is removed from the equation. https://news.ycombinator.com/item?id=18178028 https://news.ycombinator.com/item?id=18178028 http://economy.gov.il/English/InternationalAffairs/InvestInIsrael/BusinessSectors/Pages/Semiconductors.aspx http://economy.gov.il/English/InternationalAffairs/InvestInI...
- seidleroni 8y ago
  So you are suggesting that the purpose of the Bloomberg piece is to actually get access to Apple's data centers? Seems a bit conspiracy minded to me. If that was the end goal, surely there would be easier ways than having your "agent" be quoted in an article regarding the root problem and then hoping that his company is hired to provide inspection services.
  - vertline3 8y ago
    I suppose his broad point is: we should be wary of third party inspectors.
    - pmoriarty 8y ago
      So what if they do look in Apple's datacenter? Are we supposed to feel sorry for or worried about the fate of one of the world's richest companies?
      - zepto 8y ago
        It sounds like you are saying that richness itself is a justification for mistreatment. Is that really your position?
      - vertline3 8y ago
        his point was about apple customer security, so your question doesn't hold. He was arguing that this was a kind of Trojan horse for a third party to gain access.
Canada 8y ago
Hopefully this doesn't wind up as another "BadBIOS", where nobody produces any real technical evidence that it's true.
- xvector 8y ago
  BadBIOS wasn’t real? It sounded so innovative! My day is ruined and my disappointment is immeasurable.
  - platinumrad 8y ago
    The fact that years later people still don't know that BadBIOS wasn't "real" speaks volumes about how this whole incident is going to be remembered. All of the sensational claims get reported everywhere while the eventual retractions are largely ignored.
    - Canada 8y ago
      In the case of BadBIOS there was no retraction. The person who claimed to have found it kept on insisting he did, but he never posted the malware. He just kept on making unverifiable claims and posting meaningless spectrograms and ignoring calls to just show us the code he says he has.
      - peter_d_sherman 8y ago
        What if every single scientific discovery in history was forwarded to a bunch of public-facing guys who said, "Nope, this isn't true." Where would we be then? Remember Galileo? Every single person technical person worth their salt owes themselves the favor of doing their own research, and forming their own opinions. I don't know if BadBIOS is real or not, but until I've done my own research and reached my own conclusions, I (politely!) refuse to take other people's opinion on the matter. Unverified claims? By who? I refuse to believe what amounts to speculation, conjecture and hearsay by any party! Also, please think about "The Streisand Effect" (https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect) when you make posts deferring to debunking by a supposed authority. All I know is that before you posted, I was not interested in BadBIOS... now I am... and I'm going to do my own research on the matter.
ismail 8y ago
The story may be simpler than initially thought. “Whereas the Bloomberg story singles out Supermicro servers, Mr. Appleboum’s sentiment is that this is an industrywide issue” Review the site at: https://www.sepio.systems/solution/ https://www.sepio.systems/solution/ What type of companies stand to gain from the piece?
- giobox 8y ago
  Apparently Bloomberg’s bonus plan for its journalists includes provisions for rewarding stories that “move the market”. One could argue that this sounds like potentially a perverse incentive that could reward questionably sourced stories such as this for the journalists themselves, rather than a specific company gaining. It’s hardly a stretch to imagine a story like this materially affecting the accused companies’ stock prices, which presumably could qualify as a market moving story. > https://www.businessinsider.com/bloomberg-reporters-compensation-2013-12 https://www.businessinsider.com/bloomberg-reporters-compensa...
  - AmericanChopper 8y ago
    You can really tell when somebody gets 100% of their news from HN... They don’t do that anymore, partially due to that 5 year old article (which was reposted on HN yesterday?...)
    - Illniyar 8y ago
      As far as I can tell there is no evidence that the practice has stopped
- blazespin 8y ago
  Yeah the guy is obviously talking his book.
jjcc 8y ago
>I want to be quoted. I am angry and I am nervous and I hate what happened to the story. If Bloomberg is honest, they should apologize. Will it happen? Not likely. They are deliberately misleading. Misleading is a mathematically high order lie. i.e. a lie about another lie that decorates the other lie into a non-lie so it can gain the support from many believers even it's not correct. In contrast, a blatant lie is a first order lie which is very clear right or wrong. It's not defendable. That's a big difference between US/Europa MSM and the propaganda from some totalitarian regimes as I observed. Most audiance seem to be not aware of the former , and they often blieve those who know both are brainwashed by later.
- gerdesj 8y ago
  If Bloomberg is honest, they should apologize. Will it happen? Not likely. They are deliberately misleading. I wasn't aware that Bloomberg had unequivocally been demonstrated to have mislead anyone. At the moment, Bloomberg have made some allegations and several parties have made assertions in response to those allegations. I don't understand your final paragraph.
  - ezVoodoo 8y ago
    Serveral parties such as...
  - platinumrad 8y ago
    Multiple Bloomberg sources have claimed to have been misrepresented in their articles.[1][2] How has Bloomberg not mislead anyone? 1. The article in the OP 2. https://twitter.com/riskybusiness/status/1049429881031819264 https://twitter.com/riskybusiness/status/1049429881031819264
    - deleted 8y ago
      [deleted]
  - joe_the_user 8y ago
    If X is saying "that story is misleading", X is not saying "that story is flat-out wrong". The counter-stories I have seen around the Bloomberg story has been "let us parse these press releases to be certain that they say 'yes, this is flat-out wrong, there is no substance to this at all'". If someone is saying "misleading", that someone is saying that denials as such can't be true. "True but I'm angry 'cause the spin is so wrong" is actually quite a "head turner", whatever the actual situation.
anon49124 8y ago
For any Fortune 500 (Google, Apple, HP, etc.), have certain staff work covertly under shell subsidiaries but develop close rapport with key vendors (as said subsidiary), make straw purchases and do comprehensive (bordering on intrusive) supply-chain surveillance and auditing, because the targets on the side of the parent corp's "boat" paints them as easy marks for industrial/economic espionage/sabotage/monitoring. Not only does this help confuse/disinform competitors, but it can make attacks by state and other actors more difficult. This might mean high-resolution X-raying of all hardware and cryptographic signature verification of all firmware in order to prove hardware received is what was designed, and nothing else.
- deleted 8y ago
  [deleted]
sonnyblarney 8y ago
It's an intriguing story. Not to be too conspiratorial but one simple answer is that the US Feds asked Bloomberg to give the story legs, as a public signal to China. Either to raise the issue of China planting spyware chips on goods, or for some other political reason. The CIA et. al. definitely have relationships with the big press outlets and stories are placed for reasons of national security. Not quite 'propaganda' but definitely for 'national cause'. The press is used as a way to communicate, as if to say 'we know this, and now the world knows, hint, hint' ...
- qubax 8y ago
  It's not conspiracy. It's standard M.O. and it most definitely is propaganda. The chinese do the same thing. When the chinese authorities want to send a signal to another country, their news coverage of the targeted country turns negative. One of the most recent examples is chinese media coverage of south korea after the THAAD deployment. We've done the same thing here. When relations with the US and China were bad, the news coverage of china is very anti-china. When relations are good, the news coverage turns good ( like the generous, almost fawning, Deng news coverage in the 70s ). Of course it's the most noticeable or obvious during war time, but propaganda is ever present during peace, it's just more subtle.
  - sonnyblarney 8y ago
    Sending a signal by releasing information, which is by the way truthful, isn't really propaganda in the classical sense at all. It's just a diplomatic way of communicating. Having a story 'encouraged' in the press about hacking of supply chains for espionage is a pretty decent way of singling to all involved that the jig is up. Ginning up anti-Chinese news over many cycles is more like propaganda, but what does that accomplish? Nothing really, unless nations are really at war and then the 'truth is the first casualty' of course. I think the reason the press is softer on China lately is purely economic, businesses are linked, they pay ad dollars, and they can demand stuff be snuffed just like Harvey Weinstein could get stories canned via backroom arm twisting. Witness specifically the disappearance of all things Dalai Lama and Tibet, which was all the rage in Cali a decade ago and now nobody talks about it. Can't risk upsetting those Chinese dollars flowing into big projects.
tooltalk 8y ago
Well, while I agree that it's an industry wide problem, it's kind of obvious why Supermicro has been singled out out of all vendors making enterprise servers with BMCs -- Supermicro is the cheapest, no-frill whitebox vendor. I'm pretty sure that other big tech companies like Google have greater control over their hardware, custom design them; most financial clients I've worked with would simply never touch these generic boxes with a 10 foot pole. For lesser enterprise tech companies like Apple whose datacenters are filled with cheap generic Chinese servers they penny-pinch from noname companies like Supermicro, Wiwynn with bare minimal, unstable, insecure mgmt BMC's with little or no control of their own (to save money). I've worked with these BMCs past 10 years off and on; started at a large bank automating deployment of marketdata infrastructure on HP hardware; couldn't believe how unstable and insecure they were and how much security risk they posed. Most recently at my last job, about half the BMCs from Supermicro went lemon in production; and not too long, discovered the AAAA* security bug with ILO4 on slightly older HPEs. HPE's had at least fairly responsive post-sales team and I must say their OOB BMC (ILO) improved a lot over time. SM just sucked so bad that my last employer, who had unwisely standardized on Wiwynn's and Supermicro's to save money, ditched them all for HPE this year.
ezVoodoo 8y ago
A second lie to cover up the first lie. Keep it rolling, Bloomberg. We are watching with a smile.
- 0x8BADF00D 8y ago
  Whether or not it’s a lie, you would be a fool to think your hardware is safe.
  - Spooky23 8y ago
    It is hilarious that a non-revelation like this goes banannas, while blobs of mostly unknown code from places like Computrace have been embedded in most PCs for 20 years. Nation state actors enabling surveillance is defiantly plausible, but it would seem dumb to broadly deploy such an obvious, tamper-evident piece of hardware to sophisticated targets.
    - Animats 8y ago
      Yes. Intel Management Engine. The easiest way to implement a backdoor for Intel CPUs is to get your own code into the Management Engine somewhere in the supply chain. That's if it doesn't have one already.
lvs 8y ago
Did I miss something here? Is there a positive-ID photo of the impacted chips/packages anywhere?
- creeble 8y ago
  Agree. Picture or it didn’t happen. Why are we even debating this crap without a single shred of physical evidence?
patrickg_zill 8y ago
If Yossi was ex KGB or CIA instead of ex Mossad, would it modify your perception of the veracity of his statements?
Animats 8y ago
Where's the board? The original Bloomberg story showed pictures of a motherboard. Supermicro motherboards are not rare. Why hasn't one with this strange 6-pin chip surfaced?
- codezero 8y ago
  This is what I’ve been wondering all along.
- SyneRyder 8y ago
  Those were never pictures of the board or the chip. The images are credited to an illustrator. The report itself never mentioned 6-pin. And if you listen to the Risky Business podcast, the chip image is actually a signal coupler sold via Mouser Electronics, that Joe Fitzpatrick sent the journalists a link to when they asked him "what does a signal amplifier or coupler look like". https://risky.biz/RB517_feature/ https://risky.biz/RB517_feature/ https://appleinsider.com/articles/18/10/08/security-researcher-cited-in-bloombergs-china-spy-chip-investigation-casts-doubt-on-storys-veracity https://appleinsider.com/articles/18/10/08/security-research... Actually, you can check for yourself. It's the first photo result at Mouser if you search for "signal coupler". Seems everyone has been running around trying to find a TDK HHM22137A2 on their Super Micro boards: https://au.mouser.com/_/?Keyword=signal+coupler https://au.mouser.com/_/?Keyword=signal+coupler

143 points by pjf 8y ago

TLDR: <We found it in different vendors, not just Supermicro. We found it not just in servers, in different variations, but hardware manipulation on different interfaces, mostly in network related. We found it in different devices connected to the network, even Ethernet switches. I am talking about really big what are considered to be major American brands, many compromised through the same method. This is why I think that Supermicro has nothing to do with that. In many cases, by the way, it is not through manufacturing, it is after through the supply chain. People think of the supply chain in a very narrow sense between the manufacturer and the customer. Supply chain never ends. There are technicians, there are integrators, there are people that work in your facilities. We have seen after installation, after the fact attacks where someone switched something already installed. This is why Supermicro would have no idea what happens later in the supply chain.>

JdeBP 8y ago

The actual title is Yossi Appleboum on How Bloomberg is Positioning His Research Against Supermicro.

dang 8y ago
Right. We changed it back. Submitted title was "Yossi Appleboum Disagrees with Bloomberg", which broke the HN guideline about titles: "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

eternalban 8y ago

Mr. Appleboum has made a tactical mistake here and let the kitty out of the bag. This [edit: read: the original Bloomberg article] disinformation campaign appears to have 2 strategic goals. 1 - Penetrate Apple's data centers via a legislative attack vector. We all know that our congress is owned lock stock and barrel by AIPAC. They will pass legislation that will require companies like Apple to permit 3rd parties to audit their facilities. Enter Yossi and company. 1a - As an aside, this confirms for me that for the time being Apple products and facilities are in fact secure and have presented a serious obstacle to the Israeli intelligence services. Bravo to Apple's security teams. 2 - This same nation state actor is poised to pick up the "supply chain" missing links when China is removed from the equation. https://news.ycombinator.com/item?id=18178028 https://news.ycombinator.com/item?id=18178028 http://economy.gov.il/English/InternationalAffairs/InvestInIsrael/BusinessSectors/Pages/Semiconductors.aspx http://economy.gov.il/English/InternationalAffairs/InvestInI...

seidleroni 8y ago
So you are suggesting that the purpose of the Bloomberg piece is to actually get access to Apple's data centers? Seems a bit conspiracy minded to me. If that was the end goal, surely there would be easier ways than having your "agent" be quoted in an article regarding the root problem and then hoping that his company is hired to provide inspection services.
- vertline3 8y ago
  I suppose his broad point is: we should be wary of third party inspectors.
  - pmoriarty 8y ago
    So what if they do look in Apple's datacenter? Are we supposed to feel sorry for or worried about the fate of one of the world's richest companies?
    - zepto 8y ago
      It sounds like you are saying that richness itself is a justification for mistreatment. Is that really your position?
    - vertline3 8y ago
      his point was about apple customer security, so your question doesn't hold. He was arguing that this was a kind of Trojan horse for a third party to gain access.

Canada 8y ago

Hopefully this doesn't wind up as another "BadBIOS", where nobody produces any real technical evidence that it's true.

xvector 8y ago
BadBIOS wasn’t real? It sounded so innovative! My day is ruined and my disappointment is immeasurable.
- platinumrad 8y ago
  The fact that years later people still don't know that BadBIOS wasn't "real" speaks volumes about how this whole incident is going to be remembered. All of the sensational claims get reported everywhere while the eventual retractions are largely ignored.
  - Canada 8y ago
    In the case of BadBIOS there was no retraction. The person who claimed to have found it kept on insisting he did, but he never posted the malware. He just kept on making unverifiable claims and posting meaningless spectrograms and ignoring calls to just show us the code he says he has.
    - peter_d_sherman 8y ago
      What if every single scientific discovery in history was forwarded to a bunch of public-facing guys who said, "Nope, this isn't true." Where would we be then? Remember Galileo? Every single person technical person worth their salt owes themselves the favor of doing their own research, and forming their own opinions. I don't know if BadBIOS is real or not, but until I've done my own research and reached my own conclusions, I (politely!) refuse to take other people's opinion on the matter. Unverified claims? By who? I refuse to believe what amounts to speculation, conjecture and hearsay by any party! Also, please think about "The Streisand Effect" (https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect) when you make posts deferring to debunking by a supposed authority. All I know is that before you posted, I was not interested in BadBIOS... now I am... and I'm going to do my own research on the matter.

ismail 8y ago

The story may be simpler than initially thought. “Whereas the Bloomberg story singles out Supermicro servers, Mr. Appleboum’s sentiment is that this is an industrywide issue” Review the site at: https://www.sepio.systems/solution/ https://www.sepio.systems/solution/ What type of companies stand to gain from the piece?

giobox 8y ago
Apparently Bloomberg’s bonus plan for its journalists includes provisions for rewarding stories that “move the market”. One could argue that this sounds like potentially a perverse incentive that could reward questionably sourced stories such as this for the journalists themselves, rather than a specific company gaining. It’s hardly a stretch to imagine a story like this materially affecting the accused companies’ stock prices, which presumably could qualify as a market moving story. > https://www.businessinsider.com/bloomberg-reporters-compensation-2013-12 https://www.businessinsider.com/bloomberg-reporters-compensa...
- AmericanChopper 8y ago
  You can really tell when somebody gets 100% of their news from HN... They don’t do that anymore, partially due to that 5 year old article (which was reposted on HN yesterday?...)
  - Illniyar 8y ago
    As far as I can tell there is no evidence that the practice has stopped
blazespin 8y ago
Yeah the guy is obviously talking his book.

jjcc 8y ago

>I want to be quoted. I am angry and I am nervous and I hate what happened to the story. If Bloomberg is honest, they should apologize. Will it happen? Not likely. They are deliberately misleading. Misleading is a mathematically high order lie. i.e. a lie about another lie that decorates the other lie into a non-lie so it can gain the support from many believers even it's not correct. In contrast, a blatant lie is a first order lie which is very clear right or wrong. It's not defendable. That's a big difference between US/Europa MSM and the propaganda from some totalitarian regimes as I observed. Most audiance seem to be not aware of the former , and they often blieve those who know both are brainwashed by later.

gerdesj 8y ago
If Bloomberg is honest, they should apologize. Will it happen? Not likely. They are deliberately misleading. I wasn't aware that Bloomberg had unequivocally been demonstrated to have mislead anyone. At the moment, Bloomberg have made some allegations and several parties have made assertions in response to those allegations. I don't understand your final paragraph.
- ezVoodoo 8y ago
  Serveral parties such as...
- platinumrad 8y ago
  Multiple Bloomberg sources have claimed to have been misrepresented in their articles.[1][2] How has Bloomberg not mislead anyone? 1. The article in the OP 2. https://twitter.com/riskybusiness/status/1049429881031819264 https://twitter.com/riskybusiness/status/1049429881031819264
  - deleted 8y ago
    [deleted]
- joe_the_user 8y ago
  If X is saying "that story is misleading", X is not saying "that story is flat-out wrong". The counter-stories I have seen around the Bloomberg story has been "let us parse these press releases to be certain that they say 'yes, this is flat-out wrong, there is no substance to this at all'". If someone is saying "misleading", that someone is saying that denials as such can't be true. "True but I'm angry 'cause the spin is so wrong" is actually quite a "head turner", whatever the actual situation.

anon49124 8y ago

For any Fortune 500 (Google, Apple, HP, etc.), have certain staff work covertly under shell subsidiaries but develop close rapport with key vendors (as said subsidiary), make straw purchases and do comprehensive (bordering on intrusive) supply-chain surveillance and auditing, because the targets on the side of the parent corp's "boat" paints them as easy marks for industrial/economic espionage/sabotage/monitoring. Not only does this help confuse/disinform competitors, but it can make attacks by state and other actors more difficult. This might mean high-resolution X-raying of all hardware and cryptographic signature verification of all firmware in order to prove hardware received is what was designed, and nothing else.

deleted 8y ago
[deleted]

sonnyblarney 8y ago

It's an intriguing story. Not to be too conspiratorial but one simple answer is that the US Feds asked Bloomberg to give the story legs, as a public signal to China. Either to raise the issue of China planting spyware chips on goods, or for some other political reason. The CIA et. al. definitely have relationships with the big press outlets and stories are placed for reasons of national security. Not quite 'propaganda' but definitely for 'national cause'. The press is used as a way to communicate, as if to say 'we know this, and now the world knows, hint, hint' ...

qubax 8y ago
It's not conspiracy. It's standard M.O. and it most definitely is propaganda. The chinese do the same thing. When the chinese authorities want to send a signal to another country, their news coverage of the targeted country turns negative. One of the most recent examples is chinese media coverage of south korea after the THAAD deployment. We've done the same thing here. When relations with the US and China were bad, the news coverage of china is very anti-china. When relations are good, the news coverage turns good ( like the generous, almost fawning, Deng news coverage in the 70s ). Of course it's the most noticeable or obvious during war time, but propaganda is ever present during peace, it's just more subtle.
- sonnyblarney 8y ago
  Sending a signal by releasing information, which is by the way truthful, isn't really propaganda in the classical sense at all. It's just a diplomatic way of communicating. Having a story 'encouraged' in the press about hacking of supply chains for espionage is a pretty decent way of singling to all involved that the jig is up. Ginning up anti-Chinese news over many cycles is more like propaganda, but what does that accomplish? Nothing really, unless nations are really at war and then the 'truth is the first casualty' of course. I think the reason the press is softer on China lately is purely economic, businesses are linked, they pay ad dollars, and they can demand stuff be snuffed just like Harvey Weinstein could get stories canned via backroom arm twisting. Witness specifically the disappearance of all things Dalai Lama and Tibet, which was all the rage in Cali a decade ago and now nobody talks about it. Can't risk upsetting those Chinese dollars flowing into big projects.

tooltalk 8y ago

Well, while I agree that it's an industry wide problem, it's kind of obvious why Supermicro has been singled out out of all vendors making enterprise servers with BMCs -- Supermicro is the cheapest, no-frill whitebox vendor. I'm pretty sure that other big tech companies like Google have greater control over their hardware, custom design them; most financial clients I've worked with would simply never touch these generic boxes with a 10 foot pole. For lesser enterprise tech companies like Apple whose datacenters are filled with cheap generic Chinese servers they penny-pinch from noname companies like Supermicro, Wiwynn with bare minimal, unstable, insecure mgmt BMC's with little or no control of their own (to save money). I've worked with these BMCs past 10 years off and on; started at a large bank automating deployment of marketdata infrastructure on HP hardware; couldn't believe how unstable and insecure they were and how much security risk they posed. Most recently at my last job, about half the BMCs from Supermicro went lemon in production; and not too long, discovered the AAAA* security bug with ILO4 on slightly older HPEs. HPE's had at least fairly responsive post-sales team and I must say their OOB BMC (ILO) improved a lot over time. SM just sucked so bad that my last employer, who had unwisely standardized on Wiwynn's and Supermicro's to save money, ditched them all for HPE this year.

ezVoodoo 8y ago

A second lie to cover up the first lie. Keep it rolling, Bloomberg. We are watching with a smile.

0x8BADF00D 8y ago
Whether or not it’s a lie, you would be a fool to think your hardware is safe.
- Spooky23 8y ago
  It is hilarious that a non-revelation like this goes banannas, while blobs of mostly unknown code from places like Computrace have been embedded in most PCs for 20 years. Nation state actors enabling surveillance is defiantly plausible, but it would seem dumb to broadly deploy such an obvious, tamper-evident piece of hardware to sophisticated targets.
  - Animats 8y ago
    Yes. Intel Management Engine. The easiest way to implement a backdoor for Intel CPUs is to get your own code into the Management Engine somewhere in the supply chain. That's if it doesn't have one already.

lvs 8y ago

Did I miss something here? Is there a positive-ID photo of the impacted chips/packages anywhere?

creeble 8y ago
Agree. Picture or it didn’t happen. Why are we even debating this crap without a single shred of physical evidence?

patrickg_zill 8y ago

If Yossi was ex KGB or CIA instead of ex Mossad, would it modify your perception of the veracity of his statements?

Animats 8y ago

Where's the board? The original Bloomberg story showed pictures of a motherboard. Supermicro motherboards are not rare. Why hasn't one with this strange 6-pin chip surfaced?

codezero 8y ago
This is what I’ve been wondering all along.
SyneRyder 8y ago
Those were never pictures of the board or the chip. The images are credited to an illustrator. The report itself never mentioned 6-pin. And if you listen to the Risky Business podcast, the chip image is actually a signal coupler sold via Mouser Electronics, that Joe Fitzpatrick sent the journalists a link to when they asked him "what does a signal amplifier or coupler look like". https://risky.biz/RB517_feature/ https://risky.biz/RB517_feature/ https://appleinsider.com/articles/18/10/08/security-researcher-cited-in-bloombergs-china-spy-chip-investigation-casts-doubt-on-storys-veracity https://appleinsider.com/articles/18/10/08/security-research... Actually, you can check for yourself. It's the first photo result at Mouser if you search for "signal coupler". Seems everyone has been running around trying to find a TDK HHM22137A2 on their Super Micro boards: https://au.mouser.com/_/?Keyword=signal+coupler https://au.mouser.com/_/?Keyword=signal+coupler