5 ms·

But surely there's at least a few thousand of the hacked boards? The article mentioned a data center and entire companies being targeted. All it would take is s

But surely there's at least a few thousand of the hacked boards? The article mentioned a data center and entire companies being targeted. All it would take is someone to dig up some junked boards, unless they were intentionally destroyed to hide evidence. Unlike 0 days or other issues, this seems like it would be easy to reproduce. Just need to find the boards.

sonnyblarney 8y ago
Things are hacked often with a specific facility or installation in mind. It could be as little has a handful and that'd be enough to compromise a lot. I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in. Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines. I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things. I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)
- drb91 8y ago
  > I actually don't care what the truth is Why are you in this thread at all then?
  - sonnyblarney 8y ago
    Because 'the truth of the Bloomberg story' is not important - what matters is 'what's actually happening' in the world. And this kind of hacking is definitely happening irrespective of how right/wrong the Bloomberg report is.
    - drb91 8y ago
      So why are you rambling on about unrelated pet topics in HN threads?
      - acct1771 8y ago
        Do you truly believe his point to be unrelated, this isn't a debate about GP's tone? I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.
        drb91 8y ago
        I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.
        sonnyblarney 8y ago
        The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.
        acct1771 8y ago
        It IS a conspiracy. What you said is not a conspiracy theory.
        sonnyblarney 8y ago
        Ha ha yes, you're right!
        acct1771 8y ago
        I think you mean conspiracy theory. Of course this event is a conspiracy.
moftz 8y ago
You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actually could take over the BMC firmware, that could give you access to not only the OS running on that server but everything else on the network so the actual number of implants needed for an attack on a network/datacenter are low compared to how many machines are on there.
- drb91 8y ago
  Any evidence of this theory?
  - yourapostasy 8y ago
    No evidence that this alleged attack was highly-targeted, but it is pretty much SOP now, since the history of Stuxnet [1] publicly revealed the strategy. I was initially impressed the Bloomberg's story, but the longer this drags on with no independent proof, and given the one of the author's previous infosec reporting gaffe with no follow through, I've dismissed the story's veracity to a low probability. [1] https://en.wikipedia.org/wiki/Stuxnet#History https://en.wikipedia.org/wiki/Stuxnet#History
  - moftz 8y ago
    No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.

sonnyblarney 8y ago

Things are hacked often with a specific facility or installation in mind. It could be as little has a handful and that'd be enough to compromise a lot. I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in. Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines. I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things. I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)

drb91 8y ago
> I actually don't care what the truth is Why are you in this thread at all then?
- sonnyblarney 8y ago
  Because 'the truth of the Bloomberg story' is not important - what matters is 'what's actually happening' in the world. And this kind of hacking is definitely happening irrespective of how right/wrong the Bloomberg report is.
  - drb91 8y ago
    So why are you rambling on about unrelated pet topics in HN threads?
    - acct1771 8y ago
      Do you truly believe his point to be unrelated, this isn't a debate about GP's tone? I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.
      - drb91 8y ago
        I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.
        sonnyblarney 8y ago
        The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.
        acct1771 8y ago
        It IS a conspiracy. What you said is not a conspiracy theory.
        sonnyblarney 8y ago
        Ha ha yes, you're right!
        acct1771 8y ago
        I think you mean conspiracy theory. Of course this event is a conspiracy.

moftz 8y ago

You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actually could take over the BMC firmware, that could give you access to not only the OS running on that server but everything else on the network so the actual number of implants needed for an attack on a network/datacenter are low compared to how many machines are on there.

drb91 8y ago
Any evidence of this theory?
- yourapostasy 8y ago
  No evidence that this alleged attack was highly-targeted, but it is pretty much SOP now, since the history of Stuxnet [1] publicly revealed the strategy. I was initially impressed the Bloomberg's story, but the longer this drags on with no independent proof, and given the one of the author's previous infosec reporting gaffe with no follow through, I've dismissed the story's veracity to a low probability. [1] https://en.wikipedia.org/wiki/Stuxnet#History https://en.wikipedia.org/wiki/Stuxnet#History
- moftz 8y ago
  No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.