8 ms·

"There should be hundreds of thousands or millions of these hacked motherboards" No, the boards would be selectively hacked. And we know it happens because 'w

"There should be hundreds of thousands or millions of these hacked motherboards" No, the boards would be selectively hacked. And we know it happens because 'we' do it as well. Surely there is evidence floating around but it's also unlikely that companies would want to admit the breach. I kind of believe Apple and Amazon though, there's too much risk if they were to be caught lying. This is a weird one ...

jorblumesea 8y ago
But surely there's at least a few thousand of the hacked boards? The article mentioned a data center and entire companies being targeted. All it would take is someone to dig up some junked boards, unless they were intentionally destroyed to hide evidence. Unlike 0 days or other issues, this seems like it would be easy to reproduce. Just need to find the boards.
- sonnyblarney 8y ago
  Things are hacked often with a specific facility or installation in mind. It could be as little has a handful and that'd be enough to compromise a lot. I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in. Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines. I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things. I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)
  - drb91 8y ago
    > I actually don't care what the truth is Why are you in this thread at all then?
    - sonnyblarney 8y ago
      Because 'the truth of the Bloomberg story' is not important - what matters is 'what's actually happening' in the world. And this kind of hacking is definitely happening irrespective of how right/wrong the Bloomberg report is.
      - drb91 8y ago
        So why are you rambling on about unrelated pet topics in HN threads?
        acct1771 8y ago
        Do you truly believe his point to be unrelated, this isn't a debate about GP's tone? I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.
        drb91 8y ago
        I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.
        sonnyblarney 8y ago
        The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.
        acct1771 8y ago
        It IS a conspiracy. What you said is not a conspiracy theory.
        sonnyblarney 8y ago
- moftz 8y ago
  You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actually could take over the BMC firmware, that could give you access to not only the OS running on that server but everything else on the network so the actual number of implants needed for an attack on a network/datacenter are low compared to how many machines are on there.
  - drb91 8y ago
    Any evidence of this theory?
    - yourapostasy 8y ago
      No evidence that this alleged attack was highly-targeted, but it is pretty much SOP now, since the history of Stuxnet [1] publicly revealed the strategy. I was initially impressed the Bloomberg's story, but the longer this drags on with no independent proof, and given the one of the author's previous infosec reporting gaffe with no follow through, I've dismissed the story's veracity to a low probability. [1] https://en.wikipedia.org/wiki/Stuxnet#History https://en.wikipedia.org/wiki/Stuxnet#History
    - moftz 8y ago
      No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.
paxys 8y ago
You just need ONE board to be able to prove it. Surely Bloomberg or their sources can get their hand on a single piece?
- sonnyblarney 8y ago
  The story is weird, and yes, they should be able to produce a board, surely. They maybe got caught with their pants down. But it doesn't matter - this is happening 100% guaranteed. 'We' do it and China has become far more aggressive in these areas these days ... so if they could be doing it, they would be. Someone should come up with a bit of proof though.
  - Barrin92 8y ago
    evidence is usually required for statements like " this is happening 100% guaranteed." I don't know what brave new world we have entered where journalists, or even online users for that matter, make confident claims about things for which there is no physical evidence.
    - sonnyblarney 8y ago
      A very close friend of mine led customer support for a large American IT company in the middle east where US federal agents were posed as support staff. I worked at a large high-tech firm with business in the middle east, including content-filtering solutions and we were basically 'required' to work with Western governmental entities of a 'security nature'. The US has massive clandestine projects in this regard and some of them are not so secret - consider the recent Wikileaks: [1] "The US intelligence agency has been involved in a concerted effort to write various kinds of malware to spy on just about every piece of electronic equipment that people use. That includes iPhones, Androids and computers running Windows, macOS and Linux." [1] https://www.independent.co.uk/life-style/gadgets-and-tech/news/wikileaks-cia-what-are-they-explained-vault-7-year-zero-julian-assange-secrets-a7616826.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... All countries with active spy/clandestine agencies are spying on one another using malware, spyware, hardware hacking, phishing, social engineering, whatever. And many firms are complicit to one degree or another. That Apple or AWS etc. may have been compromised with a specific attack makes for a really weird story - but that this is happening in general is a non-story - of course it is. It's not about this specific attack really.
PeterisP 8y ago
Bloomberg claims that there is evidence floating around - unless they're bluffing, they should be able to show evidence of at least one such motherboard, instead of CGI graphics showing how it might look. Have they seen any actual hard evidence? Noone is disputing that the described attack vector is possible, but if Bloomberg has not properly verified if it actually has happened, then their article becomes a lie; and if they have properly verified it (as opposed to blindly trusting unnamed sources), why are they seemingly unable to show any hard evidence or details to the public?
- monocasa 8y ago
  These were supposedly targeted attacks. Why would Bloomberg have access to AWS and Apple internally designed boards?
  - liamkinne 8y ago
    > internally designed boards What? The allegations are against super micro boards produced in China.
    - monocasa 8y ago
      Super Micro builds custom designed boards for other businesses given the right quantities. It's a huge part of their business; I wouldn't be surprised if it's bigger than their white box boards. One of the allegations was that special purpose video encoder boards from a hardware startup that Amazon acquired (Elemental) were targeted. These aren't off the shelf boards that anyone can buy.
  - PeterisP 8y ago
    Because the sources in AWS and Apple who reported this issue to Bloomberg have access to the boards they're reporting about? What details and evidence about these boards have these sources provided to Bloomberg? Are there any details or evidence?
    - monocasa 8y ago
mtw 8y ago
> And we know it happens because 'we' do it as well. What's the logic in this? This is like saying Saudis must be Christians because we are Christians as well
- barbecue_sauce 8y ago
  The implication here is more "we know its possible because we do it".
- verelo 8y ago
  No it’s not. It’s much more like saying the Saudis probably killed the journalist because we do it too.
  - novaleaf 8y ago
    not sure why you are so downvoted on this (maybe less drama next time) but more or less right. More specifically though, the Snowden docs showed how the usa does this kind of stuff on a one-off basis.
    - cronix 8y ago
      and IIRC, that it was/is the "preferred" method because it's easier to pull off/harder to detect than most other methods.
    - verelo 8y ago
      Honestly, less drama, fair enough...but sadly it's not drama, it's fact albeit in small numbers, this 100% happened as we found out from Snowden docs and other leaks! That wasn't really the point i was trying to make though, and if it's happened or not doesn't really need to hold true for the basis of my comparison to hold true as a basis of english arguments. Also, I gave up hunting karma on HN a while back, i'd rather speak my mind honestly than be artificially censored by chasing a number.
      - jhabdas 8y ago
drb91 8y ago
How would you verify this theory?
SEJeff 8y ago
The Apple and Amazon statements were bulletproof, and would very likely guarantee them shareholder lawsuits if they were in fact falsified. Additionally, the SEC would likely investigate if this did happen (since it would be fraud with harmed investors looking for blood)
- will4274 8y ago
  > Additionally, the SEC would likely investigate if this did happen The phone companies all denied providing metadata to the NSA when the story first came out. I couldn't find the WaPo article from the same week, which I remembering reading in hardcopy, but here's a cite for the same from NPR: https://www.npr.org/templates/story/story.php?storyId=5409137 https://www.npr.org/templates/story/story.php?storyId=540913.... Did the SEC sue Verizon here?
  - nneonneo 8y ago
    Original Verizon statement: https://www.ft.com/content/d70c2ce2-e519-11da-80de-0000779e2340 https://www.ft.com/content/d70c2ce2-e519-11da-80de-0000779e2... They're very careful to say that they never turned phone records over to the NSA - who's to say they didn't turn phone records over to the DoJ, FBI, or any other agency, which then bounced them over to the NSA? I think they do have an out here. Plus, I'm not certain the SEC would sue over a matter of national security, even if Verizon was directly lying.
  - SEJeff 8y ago
    Yeah I don't think those are really related. Apple was exceptionally clear that this simply didn't happen. Verizon is very careful about how they word that to say they didn't turn them over to the NSA, while omitting all of the other three letter agencies (DIA, FBI, DOJ, etc). Compare that with Apple's statement, which is forcefully blunt and has no wiggle room: On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement. The fact that they then asked Bloomberg to retract the story is also going a step further. The next step would be a libel lawsuit against Bloomberg, but that would be the thermonuclear option. All of that said, the BMC on supermicro boxes is running a super old unpatched Linux and is absolutely chock full of exploits: https://www.cvedetails.com/google-search-results.php?q=supermicro+bmc&sa=Search https://www.cvedetails.com/google-search-results.php?q=super... I had to root one several years ago to fix a broken server we couldn't take out of service for $reasons.
C1sc0cat 8y ago
Would the pr team even know if it was true
ChicagoBoy11 8y ago
Is there, though? Take the latest Google example where they were less than forthcoming about user data that was accessed. Did anything ultimately happen to them? I think the same would happen in this case. If it were found, I'm sure they could quickly come up with some BS excuse that it was the best way to prevent the potential damage from being greater, that all along they had been investigating and doing whatever they could to mitigate the damage, yada yada yada. Then cue massive outrage. Followed by everyone else using their thing products as usual
devy 8y ago
> it's also unlikely that companies would want to admit the breach. No comment is the proper action for no admission. However, Tim Cook and Andy Jassy put out public statements if they were willingly lying, they will be prosecuted by SEC
ryanmarsh 8y ago
"weird" is right That such a potentially damaging allegation has not been met with a more forceful (read: lawyerly) response is "weird". That this dropped in one publication with quite a bit of detail is "weird". The timing of the responses, the rumors of trouble at SuperMicro, the timeframe of the alleged compromised boards. It's all weird. I'm waiting for the other shoe to drop on this one.

jorblumesea 8y ago

But surely there's at least a few thousand of the hacked boards? The article mentioned a data center and entire companies being targeted. All it would take is someone to dig up some junked boards, unless they were intentionally destroyed to hide evidence. Unlike 0 days or other issues, this seems like it would be easy to reproduce. Just need to find the boards.

sonnyblarney 8y ago
Things are hacked often with a specific facility or installation in mind. It could be as little has a handful and that'd be enough to compromise a lot. I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in. Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines. I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things. I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)
- drb91 8y ago
  > I actually don't care what the truth is Why are you in this thread at all then?
  - sonnyblarney 8y ago
    Because 'the truth of the Bloomberg story' is not important - what matters is 'what's actually happening' in the world. And this kind of hacking is definitely happening irrespective of how right/wrong the Bloomberg report is.
    - drb91 8y ago
      So why are you rambling on about unrelated pet topics in HN threads?
      - acct1771 8y ago
        Do you truly believe his point to be unrelated, this isn't a debate about GP's tone? I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.
        drb91 8y ago
        I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.
        sonnyblarney 8y ago
        The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.
        acct1771 8y ago
        It IS a conspiracy. What you said is not a conspiracy theory.
        sonnyblarney 8y ago
moftz 8y ago
You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actually could take over the BMC firmware, that could give you access to not only the OS running on that server but everything else on the network so the actual number of implants needed for an attack on a network/datacenter are low compared to how many machines are on there.
- drb91 8y ago
  Any evidence of this theory?
  - yourapostasy 8y ago
    No evidence that this alleged attack was highly-targeted, but it is pretty much SOP now, since the history of Stuxnet [1] publicly revealed the strategy. I was initially impressed the Bloomberg's story, but the longer this drags on with no independent proof, and given the one of the author's previous infosec reporting gaffe with no follow through, I've dismissed the story's veracity to a low probability. [1] https://en.wikipedia.org/wiki/Stuxnet#History https://en.wikipedia.org/wiki/Stuxnet#History
  - moftz 8y ago
    No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.

paxys 8y ago

You just need ONE board to be able to prove it. Surely Bloomberg or their sources can get their hand on a single piece?

sonnyblarney 8y ago
The story is weird, and yes, they should be able to produce a board, surely. They maybe got caught with their pants down. But it doesn't matter - this is happening 100% guaranteed. 'We' do it and China has become far more aggressive in these areas these days ... so if they could be doing it, they would be. Someone should come up with a bit of proof though.
- Barrin92 8y ago
  evidence is usually required for statements like " this is happening 100% guaranteed." I don't know what brave new world we have entered where journalists, or even online users for that matter, make confident claims about things for which there is no physical evidence.
  - sonnyblarney 8y ago
    A very close friend of mine led customer support for a large American IT company in the middle east where US federal agents were posed as support staff. I worked at a large high-tech firm with business in the middle east, including content-filtering solutions and we were basically 'required' to work with Western governmental entities of a 'security nature'. The US has massive clandestine projects in this regard and some of them are not so secret - consider the recent Wikileaks: [1] "The US intelligence agency has been involved in a concerted effort to write various kinds of malware to spy on just about every piece of electronic equipment that people use. That includes iPhones, Androids and computers running Windows, macOS and Linux." [1] https://www.independent.co.uk/life-style/gadgets-and-tech/news/wikileaks-cia-what-are-they-explained-vault-7-year-zero-julian-assange-secrets-a7616826.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... All countries with active spy/clandestine agencies are spying on one another using malware, spyware, hardware hacking, phishing, social engineering, whatever. And many firms are complicit to one degree or another. That Apple or AWS etc. may have been compromised with a specific attack makes for a really weird story - but that this is happening in general is a non-story - of course it is. It's not about this specific attack really.

PeterisP 8y ago

Bloomberg claims that there is evidence floating around - unless they're bluffing, they should be able to show evidence of at least one such motherboard, instead of CGI graphics showing how it might look. Have they seen any actual hard evidence? Noone is disputing that the described attack vector is possible, but if Bloomberg has not properly verified if it actually has happened, then their article becomes a lie; and if they have properly verified it (as opposed to blindly trusting unnamed sources), why are they seemingly unable to show any hard evidence or details to the public?

monocasa 8y ago
These were supposedly targeted attacks. Why would Bloomberg have access to AWS and Apple internally designed boards?
- liamkinne 8y ago
  > internally designed boards What? The allegations are against super micro boards produced in China.
  - monocasa 8y ago
    Super Micro builds custom designed boards for other businesses given the right quantities. It's a huge part of their business; I wouldn't be surprised if it's bigger than their white box boards. One of the allegations was that special purpose video encoder boards from a hardware startup that Amazon acquired (Elemental) were targeted. These aren't off the shelf boards that anyone can buy.
- PeterisP 8y ago
  Because the sources in AWS and Apple who reported this issue to Bloomberg have access to the boards they're reporting about? What details and evidence about these boards have these sources provided to Bloomberg? Are there any details or evidence?
  - monocasa 8y ago

mtw 8y ago

> And we know it happens because 'we' do it as well. What's the logic in this? This is like saying Saudis must be Christians because we are Christians as well

barbecue_sauce 8y ago
The implication here is more "we know its possible because we do it".
verelo 8y ago
No it’s not. It’s much more like saying the Saudis probably killed the journalist because we do it too.
- novaleaf 8y ago
  not sure why you are so downvoted on this (maybe less drama next time) but more or less right. More specifically though, the Snowden docs showed how the usa does this kind of stuff on a one-off basis.
  - cronix 8y ago
    and IIRC, that it was/is the "preferred" method because it's easier to pull off/harder to detect than most other methods.
  - verelo 8y ago
    Honestly, less drama, fair enough...but sadly it's not drama, it's fact albeit in small numbers, this 100% happened as we found out from Snowden docs and other leaks! That wasn't really the point i was trying to make though, and if it's happened or not doesn't really need to hold true for the basis of my comparison to hold true as a basis of english arguments. Also, I gave up hunting karma on HN a while back, i'd rather speak my mind honestly than be artificially censored by chasing a number.
    - jhabdas 8y ago

drb91 8y ago

How would you verify this theory?

SEJeff 8y ago

The Apple and Amazon statements were bulletproof, and would very likely guarantee them shareholder lawsuits if they were in fact falsified. Additionally, the SEC would likely investigate if this did happen (since it would be fraud with harmed investors looking for blood)

will4274 8y ago
> Additionally, the SEC would likely investigate if this did happen The phone companies all denied providing metadata to the NSA when the story first came out. I couldn't find the WaPo article from the same week, which I remembering reading in hardcopy, but here's a cite for the same from NPR: https://www.npr.org/templates/story/story.php?storyId=5409137 https://www.npr.org/templates/story/story.php?storyId=540913.... Did the SEC sue Verizon here?
- nneonneo 8y ago
  Original Verizon statement: https://www.ft.com/content/d70c2ce2-e519-11da-80de-0000779e2340 https://www.ft.com/content/d70c2ce2-e519-11da-80de-0000779e2... They're very careful to say that they never turned phone records over to the NSA - who's to say they didn't turn phone records over to the DoJ, FBI, or any other agency, which then bounced them over to the NSA? I think they do have an out here. Plus, I'm not certain the SEC would sue over a matter of national security, even if Verizon was directly lying.
- SEJeff 8y ago
  Yeah I don't think those are really related. Apple was exceptionally clear that this simply didn't happen. Verizon is very careful about how they word that to say they didn't turn them over to the NSA, while omitting all of the other three letter agencies (DIA, FBI, DOJ, etc). Compare that with Apple's statement, which is forcefully blunt and has no wiggle room: On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement. The fact that they then asked Bloomberg to retract the story is also going a step further. The next step would be a libel lawsuit against Bloomberg, but that would be the thermonuclear option. All of that said, the BMC on supermicro boxes is running a super old unpatched Linux and is absolutely chock full of exploits: https://www.cvedetails.com/google-search-results.php?q=supermicro+bmc&sa=Search https://www.cvedetails.com/google-search-results.php?q=super... I had to root one several years ago to fix a broken server we couldn't take out of service for $reasons.

C1sc0cat 8y ago

Would the pr team even know if it was true

ChicagoBoy11 8y ago

Is there, though? Take the latest Google example where they were less than forthcoming about user data that was accessed. Did anything ultimately happen to them? I think the same would happen in this case. If it were found, I'm sure they could quickly come up with some BS excuse that it was the best way to prevent the potential damage from being greater, that all along they had been investigating and doing whatever they could to mitigate the damage, yada yada yada. Then cue massive outrage. Followed by everyone else using their thing products as usual

devy 8y ago

> it's also unlikely that companies would want to admit the breach. No comment is the proper action for no admission. However, Tim Cook and Andy Jassy put out public statements if they were willingly lying, they will be prosecuted by SEC

ryanmarsh 8y ago

"weird" is right That such a potentially damaging allegation has not been met with a more forceful (read: lawyerly) response is "weird". That this dropped in one publication with quite a bit of detail is "weird". The timing of the responses, the rumors of trouble at SuperMicro, the timeframe of the alleged compromised boards. It's all weird. I'm waiting for the other shoe to drop on this one.