3 ms·

This article is a summary of the current state of affairs; There is no new information, and does not answer the question in the headline. Bloomberg says a spy

This article is a summary of the current state of affairs; There is no new information, and does not answer the question in the headline. Bloomberg says a spy chip was discovered and Apple and Amazon worked with the government to investigate. Apple and Amazon both deny the story is correct.

ycombi42 8y ago
With the government’s involvement in this international matter, especially considering it’s China, is it possible that there’s a gag order preventing them from saying anything?
- simonh 8y ago
  Their strenuous, detailed denials, personally given by individual senior officers seem to go very far beyond what a gag order would require.
  - legulere 8y ago
    So detailed they sounded suspicious to some: https://tvtropes.org/pmwiki/pmwiki.php/Main/SuspiciouslySpecificDenial https://tvtropes.org/pmwiki/pmwiki.php/Main/SuspiciouslySpec...
  - crdoconnor 8y ago
    Whether or not there was a gag order they're still unlikely to want to admit to being hacked.
  - ganoushoreilly 8y ago
    Given project/ biz structures at least with amazon and the gov cloud efforts, their response could be entirely true and false at the same time. Ie. amazon didn’t have modified hardware but the joint business venture did.
sumedh 8y ago
> There is no new information, It links to the Cambridge university security team blog and they say Bloomberg's claim passes the sniff test. https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/ https://www.lightbluetouchpaper.org/2018/10/05/making-sense-...
- yorwba 8y ago
  Which has been discussed before https://news.ycombinator.com/item?id=18148749 https://news.ycombinator.com/item?id=18148749 So whether that's new information or not depends on how much time you waste on HN ;)
- kryogen1c 8y ago
  Im not familiar with this Cambridge researcher, but they seem very far off the mark and I do not think the original article passes the smell test. Let's make multiple very serious and not reasonable assumptions and jump to the end: a compromised bmc on the network. It is still non-trivial to get anything accomplished. Either you pass traffic through the likely sinkholed DNS (https://en.m.wikipedia.org/wiki/OpenDNS https://en.m.wikipedia.org/wiki/OpenDNS) or make hard coded calls likely to be flagged by ips/ids. Even if you don't get caught immediately, the number of firewalls with access rules to wan to lan traffic back to your ilo/idrac has got to be effectively 0. Even if the access rules are in place, I'd bet Nat isn't - even reverse ssh tunnels require Nat. There are file integrity solutions to check for OS compromises ( https://www.tripwire.com/solutions/file-integrity-and-change-monitoring/ https://www.tripwire.com/solutions/file-integrity-and-change...) The idea that these were shipped randomly globally to Enterprise environments and no one ever figured it out is basically impossible. Maybe there is some grey area and the CTOs and CISOs just never got told what the Frontline admins didn't think was a big deal. Something else is going on. Maybe this is FUD with China in the title to fuel some political economic maneuvering. Maybe everything about the attack is real except Russia did it to hurt China.
picsao 8y ago
A cloud service provider subverted on this scale, would be liable for any damage - ip lost etc so plausible denial for the win.

ycombi42 8y ago

With the government’s involvement in this international matter, especially considering it’s China, is it possible that there’s a gag order preventing them from saying anything?

simonh 8y ago
Their strenuous, detailed denials, personally given by individual senior officers seem to go very far beyond what a gag order would require.
- legulere 8y ago
  So detailed they sounded suspicious to some: https://tvtropes.org/pmwiki/pmwiki.php/Main/SuspiciouslySpecificDenial https://tvtropes.org/pmwiki/pmwiki.php/Main/SuspiciouslySpec...
- crdoconnor 8y ago
  Whether or not there was a gag order they're still unlikely to want to admit to being hacked.
- ganoushoreilly 8y ago
  Given project/ biz structures at least with amazon and the gov cloud efforts, their response could be entirely true and false at the same time. Ie. amazon didn’t have modified hardware but the joint business venture did.

sumedh 8y ago

> There is no new information, It links to the Cambridge university security team blog and they say Bloomberg's claim passes the sniff test. https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/ https://www.lightbluetouchpaper.org/2018/10/05/making-sense-...

yorwba 8y ago
Which has been discussed before https://news.ycombinator.com/item?id=18148749 https://news.ycombinator.com/item?id=18148749 So whether that's new information or not depends on how much time you waste on HN ;)
kryogen1c 8y ago
Im not familiar with this Cambridge researcher, but they seem very far off the mark and I do not think the original article passes the smell test. Let's make multiple very serious and not reasonable assumptions and jump to the end: a compromised bmc on the network. It is still non-trivial to get anything accomplished. Either you pass traffic through the likely sinkholed DNS (https://en.m.wikipedia.org/wiki/OpenDNS https://en.m.wikipedia.org/wiki/OpenDNS) or make hard coded calls likely to be flagged by ips/ids. Even if you don't get caught immediately, the number of firewalls with access rules to wan to lan traffic back to your ilo/idrac has got to be effectively 0. Even if the access rules are in place, I'd bet Nat isn't - even reverse ssh tunnels require Nat. There are file integrity solutions to check for OS compromises ( https://www.tripwire.com/solutions/file-integrity-and-change-monitoring/ https://www.tripwire.com/solutions/file-integrity-and-change...) The idea that these were shipped randomly globally to Enterprise environments and no one ever figured it out is basically impossible. Maybe there is some grey area and the CTOs and CISOs just never got told what the Frontline admins didn't think was a big deal. Something else is going on. Maybe this is FUD with China in the title to fuel some political economic maneuvering. Maybe everything about the attack is real except Russia did it to hurt China.

picsao 8y ago

A cloud service provider subverted on this scale, would be liable for any damage - ip lost etc so plausible denial for the win.