6 ms·

They have become a disappointment for me. A lot of misleading articles, paid promotional content, and so on. Now this one... I have blocked them completely from

by goshx 8y ago

They have become a disappointment for me. A lot of misleading articles, paid promotional content, and so on. Now this one... I have blocked them completely from my social media and news sources.

Drdrdrq 8y ago
Oh, so you know what the truth is in this case? Good for you! /s
- MertsA 8y ago
  Bloomberg listed a lot of entities in that article and every single one that wasn't anonymous has all but called Bloomberg outright frauds over it. They have all sorts of anonymous sources telling them anything and everything about this supposed plot yet none of them provided any shred of evidence to back up their claims. Where's the smoking gun here? Why don't we have die shots of this thing? Why hasn't anyone on this very forum seen the C&C traffic from it phoning home to see if it was a target? Nothing about their explanation even seems remotely plausible. Why on earth would the attacker ever do something as obvious and annoying to deal with as what they supposedly did with altering the layout of the board and adding components instead of just backdooring the BMC? Are we supposed to believe that they were simultaneously competent enough to pull off Bloomberg's fairytale but too incompetent to have an altered BMC load backdoored firmware internally instead of off of an EEPROM chip on the board? I'm not saying that we should rush to conclusions but Bloomberg has provided absolutely no sources with any shred of credibility. There's nothing to substantiate anything so why should the default stance be anything other than to consider that article a piece of cyberpunk fanfiction?
  - Drdrdrq 8y ago
    What do you expect Bloomberg to do? Give up their sources? I'm sure they will have no trouble getting new stories if they did that, right? Given the size of the story and their commitment to it I would bet they were duped. There are many who would like to see them lose credibility, who would like to further escalate trade war with China, or who simply shorted some stocks... Or all of the above. But that's a bet, not an opinion. I do however have a problem with someone taking sides so eagerly, without admitting that they don't have a clue. Or if they do, please enlighten us. I'm sure their sources are better than Bloombergs.
    - olyjohn 8y ago
      Here's what I expect them to do. Show me a real picture of the chip. Show me some samples of the malicious traffic. Show me some code that they found, tell us which server models they found the affected hardware in. Somebody should have SOME shred of information on this, but there is none. You don't just sell thousands of servers, and not have a few of them that end up getting shipped to someone else, or have a few that end up in someone's test lab, or home lab. Somebody should be able to produce SOMETHING without giving up their sources. Why can't they produce any of this?
      - joshuamorton 8y ago
        Because it's easier to share words than steal hardware that may be classified due to it's security implications. Which is easier? Telling me what you saw in someone else's safe, or giving me it's contents?
        zeist 8y ago
        Probably sharing a pic of the contents would suffice.
        lostapathy 8y ago
        If this story is as real as Bloomberg wants us to think, there are too many tampered motherboards in circulation for them to have all been vacuumed up by someone with a clearance. A random technician in a datacenter is under no obligation not to leak one unless he holds (or held) a clearance and has agreed to the terms of it. Example - back when internet worms like SQL slammer were a thing, classification was a huge point of contention among gov security. At least in some agencies, because they were due to a vulnerability in a gov system, the IT/security staff were unable to discuss it with outside, uncleared people, because the vulnerability aspect made it classified. At the same time, knowledge of said worms and backdoors was public all over the news, and no reporters ever went to jail for discussing it. This isn't so different - it only takes one person without a clearance to dig up one of these chips and publish pictures, and they can do so legally. The fact that it hasn't happened tells me this isn't a widespread problem.
  - Animats 8y ago
    Enough people have access to Supermicro boards that this should have been found by now. Adding a part seems unnecessary just to add a back door. Intel CPU chips already have built-in back doors; you just have to enable them.
    - MertsA 8y ago
      Exactly, why can't any of their sources just swipe one of the unpopulated PCBs? Even just having a physical circuit board with 6 extra pads added onto it would at least give a hint of truth to their claims.
- goshx 8y ago
  I do not and I never stated I do. What I am saying is that I already had many reasons to stop trusting them and now they have another dubious article out there. I don't have the time nor the patience to investigate each of their articles and it's not like they are the only source of news out there. I've had enough with them already and that's the whole point of my comment.

by goshx 8y ago

They have become a disappointment for me. A lot of misleading articles, paid promotional content, and so on. Now this one... I have blocked them completely from my social media and news sources.

Drdrdrq 8y ago

Oh, so you know what the truth is in this case? Good for you! /s

MertsA 8y ago
Bloomberg listed a lot of entities in that article and every single one that wasn't anonymous has all but called Bloomberg outright frauds over it. They have all sorts of anonymous sources telling them anything and everything about this supposed plot yet none of them provided any shred of evidence to back up their claims. Where's the smoking gun here? Why don't we have die shots of this thing? Why hasn't anyone on this very forum seen the C&C traffic from it phoning home to see if it was a target? Nothing about their explanation even seems remotely plausible. Why on earth would the attacker ever do something as obvious and annoying to deal with as what they supposedly did with altering the layout of the board and adding components instead of just backdooring the BMC? Are we supposed to believe that they were simultaneously competent enough to pull off Bloomberg's fairytale but too incompetent to have an altered BMC load backdoored firmware internally instead of off of an EEPROM chip on the board? I'm not saying that we should rush to conclusions but Bloomberg has provided absolutely no sources with any shred of credibility. There's nothing to substantiate anything so why should the default stance be anything other than to consider that article a piece of cyberpunk fanfiction?
- Drdrdrq 8y ago
  What do you expect Bloomberg to do? Give up their sources? I'm sure they will have no trouble getting new stories if they did that, right? Given the size of the story and their commitment to it I would bet they were duped. There are many who would like to see them lose credibility, who would like to further escalate trade war with China, or who simply shorted some stocks... Or all of the above. But that's a bet, not an opinion. I do however have a problem with someone taking sides so eagerly, without admitting that they don't have a clue. Or if they do, please enlighten us. I'm sure their sources are better than Bloombergs.
  - olyjohn 8y ago
    Here's what I expect them to do. Show me a real picture of the chip. Show me some samples of the malicious traffic. Show me some code that they found, tell us which server models they found the affected hardware in. Somebody should have SOME shred of information on this, but there is none. You don't just sell thousands of servers, and not have a few of them that end up getting shipped to someone else, or have a few that end up in someone's test lab, or home lab. Somebody should be able to produce SOMETHING without giving up their sources. Why can't they produce any of this?
    - joshuamorton 8y ago
      Because it's easier to share words than steal hardware that may be classified due to it's security implications. Which is easier? Telling me what you saw in someone else's safe, or giving me it's contents?
      - zeist 8y ago
        Probably sharing a pic of the contents would suffice.
      - lostapathy 8y ago
        If this story is as real as Bloomberg wants us to think, there are too many tampered motherboards in circulation for them to have all been vacuumed up by someone with a clearance. A random technician in a datacenter is under no obligation not to leak one unless he holds (or held) a clearance and has agreed to the terms of it. Example - back when internet worms like SQL slammer were a thing, classification was a huge point of contention among gov security. At least in some agencies, because they were due to a vulnerability in a gov system, the IT/security staff were unable to discuss it with outside, uncleared people, because the vulnerability aspect made it classified. At the same time, knowledge of said worms and backdoors was public all over the news, and no reporters ever went to jail for discussing it. This isn't so different - it only takes one person without a clearance to dig up one of these chips and publish pictures, and they can do so legally. The fact that it hasn't happened tells me this isn't a widespread problem.
- Animats 8y ago
  Enough people have access to Supermicro boards that this should have been found by now. Adding a part seems unnecessary just to add a back door. Intel CPU chips already have built-in back doors; you just have to enable them.
  - MertsA 8y ago
    Exactly, why can't any of their sources just swipe one of the unpopulated PCBs? Even just having a physical circuit board with 6 extra pads added onto it would at least give a hint of truth to their claims.
goshx 8y ago
I do not and I never stated I do. What I am saying is that I already had many reasons to stop trusting them and now they have another dubious article out there. I don't have the time nor the patience to investigate each of their articles and it's not like they are the only source of news out there. I've had enough with them already and that's the whole point of my comment.