5 ms·

This seems not terribly interesting to me. The article motivates itself the allegations of devices embedded in supermicro products saying “But even as the facts

by new299 7y ago

This seems not terribly interesting to me. The article motivates itself the allegations of devices embedded in supermicro products saying “But even as the facts of that story remain unconfirmed...”. But it’s not that the facts as unconfirmed, as far as I can tell there was literally no supporting evidence and the story didn’t really make much sense. Then it’s discuss how a microcontroller attached to the serial port of Cisco networking equipment can be used to reconfigure the equipment to allow access. Given that the purpose of the serial port is reconfiguring the device, this is unsurprising. They used a small commodity microcontroller. It’s not sitting on a footprint. It’s just bodies onto the PCB. It’s quite obvious from inspecting the board... So... what’s the point of this article? If you have physical access to the hardware you can make a small but obvious change to the PCB? I’m not even sure where the $200 comes from. The part costs <50 cents. It’s so big many people could solder it by eye (I have in the past, and was soldering a similar pitch part last night using an iPhone as a magnifier). So... this level of modification has been possible for at least 20 years. It’s pretty obvious, and is about a days work... What I would have been a little more interested in seeing is a part placed on an existing footprint. I’ve actually done this myself. Maybe I should have billed it as security research... http://41j.com/blog/2016/09/mirrorswitch/ http://41j.com/blog/2016/09/mirrorswitch/ Beyond that, I’d be interested in knowing how easy it is to get hold of dies are repackage them additional microcontrollers. This would mean there’s no physical visible difference on the PCB. But even this could be detected as automated XRay inspection is not uncommon. Ultimately... if you are a state level actor. You have better and less easily detectable options than this.

joshvm 7y ago
> I’m not even sure where the $200 comes from. "With only a $150 hot-air soldering tool, a $40 microscope, and some $2 chips ordered online, Elkins was able to alter a Cisco firewall in a way that he says most IT admins likely wouldn't notice, yet would give a remote attacker deep control." (I don't agree that $200 is realistic, but TFA does at least justify the number)
- steve19 7y ago
  That is like saying <insert app here> only cost $99 to develop (cost of apple dev account). Or suxnet cost $2.50 (the cost of a cheap 2gb USB pen drive) It ignore the labour, high level engineering and resources needed to execute a supply chain attack like this.
  - new299 7y ago
    Right, so I’m not sure what the purpose of the cost estimate is. To show you don’t need expensive tools? If that’s the case, then 200USD is massive over-estimate. You only need a soldering iron, and the parts. If you’re looking at the time costs, as I’d estimate this would take maybe a day or two. The time/human resource cost isn’t that right either. But.. I’m just not sure what the point of the article is...
- new299 7y ago
  You can do this with a 30USD soldering iron by eye. None of the other equipment is essential.
- dillonmckay 7y ago
  Where can I get a soldering microscope for $40?
  - moftz 7y ago
    You can get cheap USB microscopes that would work well enough
  - duckymcduckface 7y ago
    Alibaba, you can get a digital one that comes with a small screen. They are absolute garbage to work with but will work for one off projects
xvector 7y ago
Honestly, the Supermicro story makes me uneasy. Yes, both accused corporations rebuffed the story. Yes, there was no real evidence or any follow-up to justify the story. But god damn, the paranoid person inside me can't let it go. It sounds like such an easy thing to do for such an amazing payoff. And of course both accused have a massive incentive to not disclose a vulnerability such as this one. Hell, the higher-ups might not even know about it if the company has gone through efforts to maintain plausible deniability in scenarios like this.
- new299 7y ago
  I think the fact that fake components regularly make their way into the supply chain should be more of a concern than the supermicro story. So, supply chain security is poor, and getting backdoored parts into the supply chain is a realistic possibility. Bunnie has a good recent talk on this. https://www.bunniestudios.com/blog/?p=5519 https://www.bunniestudios.com/blog/?p=5519 The question in my mind, is is it worth the risk of detection. Particularly when other methods are less traceable, more easily deniable.
  - tyingq 7y ago
    You don't even need fake chips. Many servers come with out of band remote management. Some of them even hijack the built-in Ethernet port. Even many Intel CPUs have it built in. You can get by with just a software hack. Bundling a reverse telnet or similar would likely be trivial if you had access to the manufacturer.
  - nyolfen 7y ago
    bunnie himself says near the end of the presentation that he believes that something happened with supermicro but that the details were deliberately obfuscated by the usgov sources for the story
    - new299 7y ago
      Well what bunnie says in that talk is that something may well have happened but it doesn’t pass Occam’s razor as presented in the Bloomberg article. Specifically he says that adding an IC to the board doesn’t make sense. And that embedding something in an existing package/device is possible. This is very different to what is described in the article being discussed here, and much more complex. The Bloomberg article seems largely inaccurate in any case. I don’t think it’s worth using as a motivation for any security work.
Craighead 7y ago
This is exactly how state level actors would and have done this.
- rhexs 7y ago
  The entire article is a guy doing a serial port hello world on a slightly more "advanced" arduino. This, like a good chunk of security research, is designed to generate press first and foremost, but isn't really an educational or useful piece unless you didn't know what a serial port was or that soldering was possible. I mean, this quote is a pretty stellar example: "Elkins says with a bit more reverse engineering, it would also be possible to reprogram the firmware of the firewall to make it into a more full-featured foothold for spying on the victim's network, though he didn't go that far in his proof of concept." With a bit more effort, the researcher could make the chip wireless, very difficult to find, could enable it to reflash the bootloader, and could also include an embedded microphone! But they didn't. (because that would actually be hard)
jsjohnst 7y ago
> I’m not even sure where the $200 comes from. The article breaks out the $200, most of it was a $150 hot air soldering iron. The chip used was taking off a $2 board, so yes, the chip was literally pocket change at best.
moftz 7y ago
X-ray inspection is usually only looking for solder bridges and voids. You aren't really looking at dies unless you have a really good x-ray and actually are concerned about the integrity of the chip. Counterfeit parts end up in designs all the time. They could be knockoff versions that still work or just random parts relabeled. Even these are really only x-rayed as a last resort.
- sephamorr 7y ago
  I use very good PCB inspection xrays and ct scanners, and it is critical to use energy levels which do not resolve the silicon, e.g. are not absorbed by the die. Otherwise, it is frustratingly easy to give the part a total ionizing dose which breaks it. I wouldn't want to use an xray to do more than verify the die is the same shape and has the same wirebond layout.
keyme 7y ago
I found your hack (http://41j.com/blog/2016/09/mirrorswitch/ http://41j.com/blog/2016/09/mirrorswitch/) very interesting. Enough to pop open a dumb switch I had laying around... RTL chipset. Googled the DS in 2 minutes. What do you know... VLANs, port mirroring, IGMP snooping, ACLs and an embedded 8051!

by new299 7y ago

joshvm 7y ago

> I’m not even sure where the $200 comes from. "With only a $150 hot-air soldering tool, a $40 microscope, and some $2 chips ordered online, Elkins was able to alter a Cisco firewall in a way that he says most IT admins likely wouldn't notice, yet would give a remote attacker deep control." (I don't agree that $200 is realistic, but TFA does at least justify the number)

steve19 7y ago
That is like saying <insert app here> only cost $99 to develop (cost of apple dev account). Or suxnet cost $2.50 (the cost of a cheap 2gb USB pen drive) It ignore the labour, high level engineering and resources needed to execute a supply chain attack like this.
- new299 7y ago
  Right, so I’m not sure what the purpose of the cost estimate is. To show you don’t need expensive tools? If that’s the case, then 200USD is massive over-estimate. You only need a soldering iron, and the parts. If you’re looking at the time costs, as I’d estimate this would take maybe a day or two. The time/human resource cost isn’t that right either. But.. I’m just not sure what the point of the article is...
new299 7y ago
You can do this with a 30USD soldering iron by eye. None of the other equipment is essential.
dillonmckay 7y ago
Where can I get a soldering microscope for $40?
- moftz 7y ago
  You can get cheap USB microscopes that would work well enough
- duckymcduckface 7y ago
  Alibaba, you can get a digital one that comes with a small screen. They are absolute garbage to work with but will work for one off projects

xvector 7y ago

Honestly, the Supermicro story makes me uneasy. Yes, both accused corporations rebuffed the story. Yes, there was no real evidence or any follow-up to justify the story. But god damn, the paranoid person inside me can't let it go. It sounds like such an easy thing to do for such an amazing payoff. And of course both accused have a massive incentive to not disclose a vulnerability such as this one. Hell, the higher-ups might not even know about it if the company has gone through efforts to maintain plausible deniability in scenarios like this.

new299 7y ago
I think the fact that fake components regularly make their way into the supply chain should be more of a concern than the supermicro story. So, supply chain security is poor, and getting backdoored parts into the supply chain is a realistic possibility. Bunnie has a good recent talk on this. https://www.bunniestudios.com/blog/?p=5519 https://www.bunniestudios.com/blog/?p=5519 The question in my mind, is is it worth the risk of detection. Particularly when other methods are less traceable, more easily deniable.
- tyingq 7y ago
  You don't even need fake chips. Many servers come with out of band remote management. Some of them even hijack the built-in Ethernet port. Even many Intel CPUs have it built in. You can get by with just a software hack. Bundling a reverse telnet or similar would likely be trivial if you had access to the manufacturer.
- nyolfen 7y ago
  bunnie himself says near the end of the presentation that he believes that something happened with supermicro but that the details were deliberately obfuscated by the usgov sources for the story
  - new299 7y ago
    Well what bunnie says in that talk is that something may well have happened but it doesn’t pass Occam’s razor as presented in the Bloomberg article. Specifically he says that adding an IC to the board doesn’t make sense. And that embedding something in an existing package/device is possible. This is very different to what is described in the article being discussed here, and much more complex. The Bloomberg article seems largely inaccurate in any case. I don’t think it’s worth using as a motivation for any security work.

Craighead 7y ago

This is exactly how state level actors would and have done this.

rhexs 7y ago
The entire article is a guy doing a serial port hello world on a slightly more "advanced" arduino. This, like a good chunk of security research, is designed to generate press first and foremost, but isn't really an educational or useful piece unless you didn't know what a serial port was or that soldering was possible. I mean, this quote is a pretty stellar example: "Elkins says with a bit more reverse engineering, it would also be possible to reprogram the firmware of the firewall to make it into a more full-featured foothold for spying on the victim's network, though he didn't go that far in his proof of concept." With a bit more effort, the researcher could make the chip wireless, very difficult to find, could enable it to reflash the bootloader, and could also include an embedded microphone! But they didn't. (because that would actually be hard)

jsjohnst 7y ago

> I’m not even sure where the $200 comes from. The article breaks out the $200, most of it was a $150 hot air soldering iron. The chip used was taking off a $2 board, so yes, the chip was literally pocket change at best.

moftz 7y ago

X-ray inspection is usually only looking for solder bridges and voids. You aren't really looking at dies unless you have a really good x-ray and actually are concerned about the integrity of the chip. Counterfeit parts end up in designs all the time. They could be knockoff versions that still work or just random parts relabeled. Even these are really only x-rayed as a last resort.

sephamorr 7y ago
I use very good PCB inspection xrays and ct scanners, and it is critical to use energy levels which do not resolve the silicon, e.g. are not absorbed by the die. Otherwise, it is frustratingly easy to give the part a total ionizing dose which breaks it. I wouldn't want to use an xray to do more than verify the die is the same shape and has the same wirebond layout.

keyme 7y ago

I found your hack (http://41j.com/blog/2016/09/mirrorswitch/ http://41j.com/blog/2016/09/mirrorswitch/) very interesting. Enough to pop open a dumb switch I had laying around... RTL chipset. Googled the DS in 2 minutes. What do you know... VLANs, port mirroring, IGMP snooping, ACLs and an embedded 8051!