4 ms·

Honestly, the Supermicro story makes me uneasy. Yes, both accused corporations rebuffed the story. Yes, there was no real evidence or any follow-up to justify t

Honestly, the Supermicro story makes me uneasy. Yes, both accused corporations rebuffed the story. Yes, there was no real evidence or any follow-up to justify the story. But god damn, the paranoid person inside me can't let it go. It sounds like such an easy thing to do for such an amazing payoff. And of course both accused have a massive incentive to not disclose a vulnerability such as this one. Hell, the higher-ups might not even know about it if the company has gone through efforts to maintain plausible deniability in scenarios like this.

new299 7y ago
I think the fact that fake components regularly make their way into the supply chain should be more of a concern than the supermicro story. So, supply chain security is poor, and getting backdoored parts into the supply chain is a realistic possibility. Bunnie has a good recent talk on this. https://www.bunniestudios.com/blog/?p=5519 https://www.bunniestudios.com/blog/?p=5519 The question in my mind, is is it worth the risk of detection. Particularly when other methods are less traceable, more easily deniable.
- tyingq 7y ago
  You don't even need fake chips. Many servers come with out of band remote management. Some of them even hijack the built-in Ethernet port. Even many Intel CPUs have it built in. You can get by with just a software hack. Bundling a reverse telnet or similar would likely be trivial if you had access to the manufacturer.
- nyolfen 7y ago
  bunnie himself says near the end of the presentation that he believes that something happened with supermicro but that the details were deliberately obfuscated by the usgov sources for the story
  - new299 7y ago
    Well what bunnie says in that talk is that something may well have happened but it doesn’t pass Occam’s razor as presented in the Bloomberg article. Specifically he says that adding an IC to the board doesn’t make sense. And that embedding something in an existing package/device is possible. This is very different to what is described in the article being discussed here, and much more complex. The Bloomberg article seems largely inaccurate in any case. I don’t think it’s worth using as a motivation for any security work.
    - Enginerrrd 7y ago
      Yeah Occam's razor says your efforts would be much better spent on flashing custom firmware than a retrofit. That or a deliberate backdoor built into the chip from the ground up. Or something like this: https://m.youtube.com/watch?v=_eSAF_qT_FY https://m.youtube.com/watch?v=_eSAF_qT_FY But a nearly magic rice-grain part with a microcontroller and networking?? You could make a fortune in IOT with something that capable.
- mikorym 7y ago
  Did you see the post recently about System 76's laptops that will soon have open source hardware drivers? Talking about fake items, fake items surely could have fake drivers, but even legitimate items could introduce fake (as in "unofficial") drivers. I think people are maybe naturally more paranoid of something that is "an intrusion". I think the unreasonable human element is when you perceive an intrusion that was not. As in: "They have hacked me look, my screen is blue!"
simonh 7y ago
What makes me doubt the story is that these boards should be all over the place. If you did sneak parts into the supply chain, you’d have no control over where they went, so there should be dozens, perhaps hundreds of companies, government bodies, etc with these things. Given this, we have to believe that Apple, Amazon etc lied about this, knowing that there would be massive amounts of physical evidence easily available to rivals and security researchers, any of which could prove they were lying at any moment. Why on earth would they take such an insane and unnecessary risk?
dlgeek 7y ago
Why would Amazon have incentive to deny the story if it were true? According to Bloomberg, the issue was discovered at an acquisition while they were doing due diligence, not in their own servers. If it were true, they should be screaming to anyone who would listen about how they're so serious about security that they go to these depths to find threats, and how you can't trust anyone who doesn't.
- rootw0rm 7y ago
  Unless a National Security Letter compelled them to remain silent...
imtringued 7y ago
>It sounds like such an easy thing to do for such an amazing payoff. I don't understand how spending tens of millions on making a custom chip design so that you can replace a resistor as a backdoor is an easy thing to do. Most surface mount components have standard form factors. You can just replace entire chips and it is also very easy to simply add a back door to the firmware but a rice grain sized backdoor chip? Come on. That's just some journalist's method of making a lot of money through ad revenue.
chopin 7y ago
I think the biggest problem with hardware implants is that you loose plausible deniability with it. For a state actor that seems a big risk. Especially China would have to lose big time as no one would trust their electronics any longer. You can have almost the same gain with a software implant. It's easier to pull off and you get plausible deniability as a bonus.

new299 7y ago

I think the fact that fake components regularly make their way into the supply chain should be more of a concern than the supermicro story. So, supply chain security is poor, and getting backdoored parts into the supply chain is a realistic possibility. Bunnie has a good recent talk on this. https://www.bunniestudios.com/blog/?p=5519 https://www.bunniestudios.com/blog/?p=5519 The question in my mind, is is it worth the risk of detection. Particularly when other methods are less traceable, more easily deniable.

tyingq 7y ago
You don't even need fake chips. Many servers come with out of band remote management. Some of them even hijack the built-in Ethernet port. Even many Intel CPUs have it built in. You can get by with just a software hack. Bundling a reverse telnet or similar would likely be trivial if you had access to the manufacturer.
nyolfen 7y ago
bunnie himself says near the end of the presentation that he believes that something happened with supermicro but that the details were deliberately obfuscated by the usgov sources for the story
- new299 7y ago
  Well what bunnie says in that talk is that something may well have happened but it doesn’t pass Occam’s razor as presented in the Bloomberg article. Specifically he says that adding an IC to the board doesn’t make sense. And that embedding something in an existing package/device is possible. This is very different to what is described in the article being discussed here, and much more complex. The Bloomberg article seems largely inaccurate in any case. I don’t think it’s worth using as a motivation for any security work.
  - Enginerrrd 7y ago
    Yeah Occam's razor says your efforts would be much better spent on flashing custom firmware than a retrofit. That or a deliberate backdoor built into the chip from the ground up. Or something like this: https://m.youtube.com/watch?v=_eSAF_qT_FY https://m.youtube.com/watch?v=_eSAF_qT_FY But a nearly magic rice-grain part with a microcontroller and networking?? You could make a fortune in IOT with something that capable.
mikorym 7y ago
Did you see the post recently about System 76's laptops that will soon have open source hardware drivers? Talking about fake items, fake items surely could have fake drivers, but even legitimate items could introduce fake (as in "unofficial") drivers. I think people are maybe naturally more paranoid of something that is "an intrusion". I think the unreasonable human element is when you perceive an intrusion that was not. As in: "They have hacked me look, my screen is blue!"

simonh 7y ago

What makes me doubt the story is that these boards should be all over the place. If you did sneak parts into the supply chain, you’d have no control over where they went, so there should be dozens, perhaps hundreds of companies, government bodies, etc with these things. Given this, we have to believe that Apple, Amazon etc lied about this, knowing that there would be massive amounts of physical evidence easily available to rivals and security researchers, any of which could prove they were lying at any moment. Why on earth would they take such an insane and unnecessary risk?

dlgeek 7y ago

Why would Amazon have incentive to deny the story if it were true? According to Bloomberg, the issue was discovered at an acquisition while they were doing due diligence, not in their own servers. If it were true, they should be screaming to anyone who would listen about how they're so serious about security that they go to these depths to find threats, and how you can't trust anyone who doesn't.

rootw0rm 7y ago
Unless a National Security Letter compelled them to remain silent...

imtringued 7y ago

>It sounds like such an easy thing to do for such an amazing payoff. I don't understand how spending tens of millions on making a custom chip design so that you can replace a resistor as a backdoor is an easy thing to do. Most surface mount components have standard form factors. You can just replace entire chips and it is also very easy to simply add a back door to the firmware but a rice grain sized backdoor chip? Come on. That's just some journalist's method of making a lot of money through ad revenue.

chopin 7y ago

I think the biggest problem with hardware implants is that you loose plausible deniability with it. For a state actor that seems a big risk. Especially China would have to lose big time as no one would trust their electronics any longer. You can have almost the same gain with a software implant. It's easier to pull off and you get plausible deniability as a bonus.