6 ms·

Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

27 points by 2bluesc 7y ago

Doxin 7y ago
For anyone trying to spot counterfeit products in general, a good place to look is at the FCC logo. On the counterfeit card in the article the FCC logo is wrong. The real logo ends with two concentric circles with a pie-slice out of them forming the "cc" while the counterfeit logo clearly has a different shape.
- deleted 7y ago
  [deleted]
- neilv 7y ago
  A different article, linked by the HN post one, shows much better quality screen-printing logos on a counterfeit card than on the counterfeit in the immediate article: https://forums.servethehome.com/index.php?threads/comparison-intel-i350-t4-genuine-vs-fake.6917/ https://forums.servethehome.com/index.php?threads/comparison... Though I can't see an FCC logo in the different article's photos. (I also can't see an FCC logo on the different model of supposedly-Intel quad-gigabit PCIe card of mine I just looked at.)
  - Doxin 7y ago
    It's a general quick way to check, it'll not always work. A bodged FCC logo means it's almost certainly a counterfeit. A proper or missing FCC logo means near nothing. I just noticed the bodged FCC logo in the original article, that's all. sometimes you can spot similar shenanigans based on the CE logo but that's more rare.
    - neilv 7y ago
      Thanks. Sometimes, with counterfeits of various kinds of electronics products, I've wondered whether there was ever an intentional telltale indicator. So that country or other entity never accidentally got a counterfeit into a supply chain where they really didn't want it to be. (For example, not into the parts supply chain of a high-profile device manufactured there. Nor to ruin domestic markets for prestige luxury brand products, or other products for domestic consumption for which quality/integrity is considered very important.)
earthstabber 7y ago
Coincidentally, I just put a used intel gb ct up for sale, along with an unrelated note to the fcc. I’ll double check the nic now to confirm authenticity. My voice is my passport. Verify me.
jaclaz 7y ago
Maybe it is just me, but I fail to see any evidence that a counterfeit card is necessarily a security risk. It is IMHO more likely that it has inferior performance or even more probably a shorter lifetime due to inferior quality of components and/or sub-standard manufacturing. About the: >When our reader tried using iPXE, a network booting tool, with the NIC, it failed even though genuine cards work without issue. knowing how picky PXE and iPXE are, I would like to see some details of the tests performed. Since the actual reproduction of markings was so poor, and given that the actual PCB traces run differently, it is likely a no-brand or "bulk" item marked as Intel, as an example, have a look at this one: https://italian.alibaba.com/product-detail/pci-e-pci-express-gigabit-ethernet-network-card-adapters-slot-rj45-nic-10-100-1000m-diskless-lan-card-62084565969.html https://italian.alibaba.com/product-detail/pci-e-pci-express... It seems a lot like it.
- AmVess 7y ago
  It's pretty easy to salt the firmware with malware if you are the company making counterfeit NICs. This makes them very necessarily a major security risk.
- ryanmercer 7y ago
  >Maybe it is just me, but I fail to see any evidence that a counterfeit card is necessarily a security risk. Even if it isn't a security risk from a data theft/malicious code standpoint, it could be substandard in quality and be exponentially more likely to fail. A failure could just be an annoyance, taking Jim Bob's pornoputer off the home network and causing him to be unable to connect to the YouPorns until his nephew can come fix the boobie-box. A failure however could take down a mission-critical computer in an emergency response center where even minutes could mean the difference in life or death for someone. Substandard components could also result in a fire, perhaps not in a NIC, but larger capacitors in something larger could overvolt and catch fire. Worse, I've long had the thought that a hostile government could create ICs that effectively brick themselves when they receive a certain command. With a NIC, in theory, you could have the NIC radio home a small packet occasionally to report the IP. With the list of IPs you could very casually probe which of a handful of pre-determine ports are open, you could get tens of thousands, or even millions, of these chips in the wild looking perfectly normal just waiting for a command. Then say as a foreign government you want to launch an attack on the United States, you filter all the IPs in your database by location, which will remove the bulk of the machines in other countries from the list, and you have a bunch of servers in a bunch of countries get segments of the IP list and they start sending the kill signal at the same time (and if you get really crafty you make the compromised hardware actually start a timer before it bricks, so you can get the instruction out to as many as possible before the bricking causes widespread disruption of the internet). If you've waited long enough you'll have your trojan horse IC in businesses, homes, government offices of varying levels. If you manage to get even 100,000 taken offline, you've probably caused enough disruption to impact the NYSE as well as cause a good deal of disruption and mayhem. You may have even taken mission critical systems offline at power generation and transmission facilities. You've caused some economic damage at a minimum and based on how things go down you may have just made it much easier to launch a physical attack, especially if you have already trickled special forces soldiers into the country on tourists visas or via smuggling routes (United States special forces actually train to go into countries ahead of common forces to cause disruption and/or train local resistance) and can cause further disruption by causing mass panic with shootings/bombings/attacking first responders. There is more to it than "oh someone can spy on my data now".
LUmBULtERA 7y ago
Will official Intel drivers work on a counterfeit card? It seems like Intel would bake some authentication into the drivers and authentic hardware such that the drivers would not work if the card is counterfeit.
- rasz 7y ago
  >authentication Where? Intel sells network chips to OEMs, one of the more shady ones decided to directly clone Intel PCB.
  - LUmBULtERA 7y ago
    In this case, are you saying the answer is "Yes, official Intel drivers will work on a counterfeit card," and it is not possible for Intel to include anything in the driver or hardware that can perform authentication? I was asking because I don't know.
    - blackflame7000 7y ago
      They could but its simply too expensive to add something like a secure enclave to a device this cheap. Maybe on your high-end 10-100 GBe adapters that sell for 100s of dollars, it makes sense. I just don't think they are aware of the problem to the degree that they would make such big changes.

27 points by 2bluesc 7y ago

For anyone trying to spot counterfeit products in general, a good place to look is at the FCC logo. On the counterfeit card in the article the FCC logo is wrong. The real logo ends with two concentric circles with a pie-slice out of them forming the "cc" while the counterfeit logo clearly has a different shape.

deleted 7y ago
[deleted]
neilv 7y ago
A different article, linked by the HN post one, shows much better quality screen-printing logos on a counterfeit card than on the counterfeit in the immediate article: https://forums.servethehome.com/index.php?threads/comparison-intel-i350-t4-genuine-vs-fake.6917/ https://forums.servethehome.com/index.php?threads/comparison... Though I can't see an FCC logo in the different article's photos. (I also can't see an FCC logo on the different model of supposedly-Intel quad-gigabit PCIe card of mine I just looked at.)
- Doxin 7y ago
  It's a general quick way to check, it'll not always work. A bodged FCC logo means it's almost certainly a counterfeit. A proper or missing FCC logo means near nothing. I just noticed the bodged FCC logo in the original article, that's all. sometimes you can spot similar shenanigans based on the CE logo but that's more rare.
  - neilv 7y ago
    Thanks. Sometimes, with counterfeits of various kinds of electronics products, I've wondered whether there was ever an intentional telltale indicator. So that country or other entity never accidentally got a counterfeit into a supply chain where they really didn't want it to be. (For example, not into the parts supply chain of a high-profile device manufactured there. Nor to ruin domestic markets for prestige luxury brand products, or other products for domestic consumption for which quality/integrity is considered very important.)

earthstabber 7y ago

Coincidentally, I just put a used intel gb ct up for sale, along with an unrelated note to the fcc. I’ll double check the nic now to confirm authenticity. My voice is my passport. Verify me.

jaclaz 7y ago

Maybe it is just me, but I fail to see any evidence that a counterfeit card is necessarily a security risk. It is IMHO more likely that it has inferior performance or even more probably a shorter lifetime due to inferior quality of components and/or sub-standard manufacturing. About the: >When our reader tried using iPXE, a network booting tool, with the NIC, it failed even though genuine cards work without issue. knowing how picky PXE and iPXE are, I would like to see some details of the tests performed. Since the actual reproduction of markings was so poor, and given that the actual PCB traces run differently, it is likely a no-brand or "bulk" item marked as Intel, as an example, have a look at this one: https://italian.alibaba.com/product-detail/pci-e-pci-express-gigabit-ethernet-network-card-adapters-slot-rj45-nic-10-100-1000m-diskless-lan-card-62084565969.html https://italian.alibaba.com/product-detail/pci-e-pci-express... It seems a lot like it.

AmVess 7y ago
It's pretty easy to salt the firmware with malware if you are the company making counterfeit NICs. This makes them very necessarily a major security risk.
ryanmercer 7y ago
>Maybe it is just me, but I fail to see any evidence that a counterfeit card is necessarily a security risk. Even if it isn't a security risk from a data theft/malicious code standpoint, it could be substandard in quality and be exponentially more likely to fail. A failure could just be an annoyance, taking Jim Bob's pornoputer off the home network and causing him to be unable to connect to the YouPorns until his nephew can come fix the boobie-box. A failure however could take down a mission-critical computer in an emergency response center where even minutes could mean the difference in life or death for someone. Substandard components could also result in a fire, perhaps not in a NIC, but larger capacitors in something larger could overvolt and catch fire. Worse, I've long had the thought that a hostile government could create ICs that effectively brick themselves when they receive a certain command. With a NIC, in theory, you could have the NIC radio home a small packet occasionally to report the IP. With the list of IPs you could very casually probe which of a handful of pre-determine ports are open, you could get tens of thousands, or even millions, of these chips in the wild looking perfectly normal just waiting for a command. Then say as a foreign government you want to launch an attack on the United States, you filter all the IPs in your database by location, which will remove the bulk of the machines in other countries from the list, and you have a bunch of servers in a bunch of countries get segments of the IP list and they start sending the kill signal at the same time (and if you get really crafty you make the compromised hardware actually start a timer before it bricks, so you can get the instruction out to as many as possible before the bricking causes widespread disruption of the internet). If you've waited long enough you'll have your trojan horse IC in businesses, homes, government offices of varying levels. If you manage to get even 100,000 taken offline, you've probably caused enough disruption to impact the NYSE as well as cause a good deal of disruption and mayhem. You may have even taken mission critical systems offline at power generation and transmission facilities. You've caused some economic damage at a minimum and based on how things go down you may have just made it much easier to launch a physical attack, especially if you have already trickled special forces soldiers into the country on tourists visas or via smuggling routes (United States special forces actually train to go into countries ahead of common forces to cause disruption and/or train local resistance) and can cause further disruption by causing mass panic with shootings/bombings/attacking first responders. There is more to it than "oh someone can spy on my data now".

LUmBULtERA 7y ago

Will official Intel drivers work on a counterfeit card? It seems like Intel would bake some authentication into the drivers and authentic hardware such that the drivers would not work if the card is counterfeit.

rasz 7y ago
>authentication Where? Intel sells network chips to OEMs, one of the more shady ones decided to directly clone Intel PCB.
- LUmBULtERA 7y ago
  In this case, are you saying the answer is "Yes, official Intel drivers will work on a counterfeit card," and it is not possible for Intel to include anything in the driver or hardware that can perform authentication? I was asking because I don't know.
  - blackflame7000 7y ago
    They could but its simply too expensive to add something like a secure enclave to a device this cheap. Maybe on your high-end 10-100 GBe adapters that sell for 100s of dollars, it makes sense. I just don't think they are aware of the problem to the degree that they would make such big changes.