19 ms·

Supermicro Hack: China Exploited a US Tech Supplier over Years [2021 Follow-Up]

402 points by kenneth 6y ago

kenneth 6y ago
I previously submitted this story a few days ago[1], where it garnered some discussion and a bit over 100 upvotes, but never made the front-page due to some down-weights in HN's algorithm. I'm reposting this story at Daniel's suggestion. He agreed it deserved a second chance to break out. -- I noticed that it's commonly accepted that Bloomberg's 2018 stories on the Supermicro hack were bogus, costing them a huge amount of reputational damage. However, Bloomberg stood by the stories. I'm very curious to see how this one will be received. I was never quite convinced by the naysayers or the denials by the government, Apple, or Amazon. I think it's quite likely that Bloomberg will be proven right in the end, this story having been accurate but suppressed for "secrecy" reasons all along. Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. This time, it seems they have been able to do so. Either way, I'm thrilled to see an outlet do original reporting and stand by their work in the face of universal condemnation. We are better off for having strong dissenting views informing us and expanding the narrative. I'm finding myself increasingly distrustful of the work of journalism outlets, but this (and those gone independent on Substack) gives me hope. [1]: Previous discussion here: https://news.ycombinator.com/item?id=26112436 https://news.ycombinator.com/item?id=26112436
- deleted 6y ago
  [deleted]
- stevemk14ebr 6y ago
  I think this twitter thread is a very reasonable analysis of this article: https://twitter.com/pwnallthethings/status/1360232753623629824 https://twitter.com/pwnallthethings/status/13602327536236298.... I think critically there are a lot of claims here, and none of them provide _concrete_ proof of any form. There's a lot of 'senior official said X' and X number of people in the know declined to comment, but these are just appeals to authority/credentials. People are flawed and second hand rumours of rumours can easily bend the truth. I don't think it's necessarily fair to put out a story claiming this is 'the truth' when alot of the sourcing is indirect and 'declined to comment'. It's just not there with the facts! True or not, we can't know, but this report need more facts.
  - jorblumesea 6y ago
    This is `usually how national security problems are reported on, due to the classified nature of the work. You don't have to believe it, but it's naive to think that you're going to see actual chips. Currents and formers can talk about the what, but not the how. I mean even China knows the "what". Methods and means are a big deal, PRB kills entire chapters because of it.
  - datavirtue 6y ago
    Head in sand. A outfit like bloomberg isn't going going to screw up this bad and then double down by citing more sources. Get a clue.
  - jstrong 6y ago
    > Alarmed by the devices’ sophistication, officials opted to warn a small number of potential targets in briefings that identified Supermicro by name. Executives from 10 companies and one large municipal utility told Bloomberg News that they’d received such warnings. in my book that counts as "concrete proof."
    - deftnerd 6y ago
      Only if you believe that the warnings went out because of the "alarm over the devices' sophistication" and not "alarm over the idea this could happen" or even "alarm over a misidentification of a legitimate component and now we're too embarrassed to issue a retraction to those 10 CEOs"
      - koheripbal 6y ago
        Ok, but now you're making another argument with also zero evidence. I think it's fair to say there are multiple circumstantial pieces of evidence that SuperMicro is inserting security vulnerabilities. That should be enough to take the same decision that both the US gov't and Apple and others have made to avoid that manufacturer.
    - michaelt 6y ago
      The article certainly quotes a wealth of sources - but all of them seem to be vague, third-hand stuff. An unnamed "adviser" to security firms that analyzed Supermicro equipment. An executive for some unnamed company, who received a briefing. A venture capitalist who received a briefing. A retired FBI agent who was told there was an "additional little component" by someone he can't name. Some former FBI officials that refuse to name supermicro, and say only that supply chain attacks are possible. Fifty interviews with officials, all of whom asked not to be named. So apparently this information is so public that everyone and their dog is happy confirm it - yet at the same time, so classified that the victims and the 50 sources can't be named? That's pretty vague compared reports of hardware implants like credit card skimmers [1] which put pictures of the hardware front and centre and make it clear that the author has personally seen it and knows (basically) how it works. [1] https://krebsonsecurity.com/all-about-skimmers/ https://krebsonsecurity.com/all-about-skimmers/
- ikeboy 6y ago
  >Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. It's not just that - it's that no other reputable outlet was able to confirm the story, and many tried. This just doesn't happen with controversial but true stories with many sources - some of those sources will be willing to talk to other outlets.
  - jtbayly 6y ago
    Bruce Schneier said last time that he didn’t believe it. This time he said he was wrong. When pressed by a skeptic in the comments, he said, “Independent from this article, I know that the DoD believes this threat is real and is giving away R&D funding for security solutions. So I have more than the Bloomberg reporting to go on.” https://www.schneier.com/blog/archives/2021/02/chinese-supply-chain-attack-on-computer-systems.html https://www.schneier.com/blog/archives/2021/02/chinese-suppl...
    - Daho0n 6y ago
      That "the DoD believes this threat" is not the same as it actually happened. The threat is real, the article is very likely fluff.
      - jtbayly 6y ago
        Yes, but everybody already knows the threat is real, most especially Schneier. Something made him change his mind.
      - datavirtue 6y ago
        All you people are in denial. The first bloomberg story was credible but was protecting sources. They go further and get people on the record and double down....literally stretching their necks out, and you people keep propping up strawmen from the original article. Admit it. You were skeptical, determined that it couldn't be true, ran around shooting your mouth off about how it was fake news and now you can't help but continue smearing the egg all over your face.
- ncmncm 6y ago
  For a story claiming physical alteration of products, they should have had photographs of altered products. Otherwise it's just "anonymous loudmouths blow smoke". Everything that would be done with the extra component could more easily be done with BIOS code, attracting no attention. So it doesn't pass the sniff test.
  - gruez 6y ago
    >Everything that would be done with the extra component could more easily be done with BIOS code This is tricky because on newer platforms the BIOS is signed and verified by the CPU. The signing keys are likely going to be located in the engineering offices (in the US) rather than just lying around in the factories, so getting them would require much more access than just bribing/threatening a few technicians at the factory. > attracting no attention. So it doesn't pass the sniff test. Compromised BIOS is a known threat, so I'd presume paranoid customers would verify/reflash the BIOS upon receiving them. This can be done without booting the motherboard at all (ie. attaching SPI clips to the flash chip and reading/writing directly). A tampered bios would get detected this way so it's not exactly "no attention".
  - mdip 6y ago
    I don't think you deserved the downvotes as I felt somewhat the same way. Part of that comes from the reporting, which appears to have been done by someone who doesn't understand the things he's reporting on (or, at least, some of the people quoted are saying things that are nonsense that someone outside of our industry wouldn't necessary recognize) i.e. "had a chip encrypted on the motherboard that would record all the data" ... one does not simply ... encrypt a chip ... With these kinds of explanations or statements used as evidence, it's frustrating trying to figure out what "really happened". Personally, I don't doubt there's something to all of this. It's a "real threat" as has been reported; whether or not it's "theoretically real" or "actually used" isn't that relevant: if it's a "real threat" someone has figured out precisely how to do it or has seen it (or close-enough variations of the "it") being done that it's worth taking action. My hunch is that it's a firmware-related hack; no hardware added to the boards. The article talks around BIOS and such, indicating that some of the code involved was inserted by employees directly connected to the company. It explains the lack of photographic evidence--what's the evidence[0]? And wouldn't the attacker prefer it that way? It also helps explain the "encrypted chip" -- perhaps code, encrypted on the chip (decrypted/executed at boot) was what was intended by that statement[1]. [0] Disassembled code on Github would have been nice, but the US government isn't likely to drop that. [1] And maybe it was said in that bizarre manner intentionally, who knows?
- marcan_42 6y ago
  It's not just the lack of sources, it's the fact that Bloomberg made up complete nonsense to fill in the bits of the picture that they didn't have. Off the top of my head from that time, I remember they asked someone about the plausibility of some part of the story about the component types that might have been altered, he pointed them at some random example from Digi-Key, and that example became their photoshoot prop. All of their photos were provably fake and staged, and made no technical sense. There was that whole sub-story about how supposedly Ethernet jacks having metal shields was one of the indicators of compromise (what? almost every piece of datacenter kit uses Ethernet jacks with metal shields). The more you looked into the details, the less they added up. The only thing we could confirm was that, at some point, Supermicro shipped compromised drivers. That part I can absolutely believe, and like the last bit of this story update claims, that may well have been an APT hack from a state-actor. That side of the story is entirely believable and self-consistent. But the hardware modifications? Sorry, but the way that story has been reported is complete garbage. I'm not saying it isn't true, I'm saying Bloomberg provided no credible evidence that it is true, and plenty of evidence that they don't have the slightest clue what they're doing, and that their reporting is dishonest. Originally I gave them the benefit of the doubt, but when they published the Ethernet jack story with less than 5 days to check anything from that guy, they lost all semblance of credibility.
  - plorkyeran 6y ago
    Yeah, I'm confused by all the posts acting like the objections were just that Bloomberg's first story didn't provide any evidence. It was quite a bit worse than that; they included some very obviously faked evidence and a lot of utter nonsense. I wouldn't be surprised if it turned out to be "based on a true story" but even if every single one of their claims turns out to have been a distorted retelling of something real then I'll still stand by my opinion that it was terrible reporting.
  - kenneth 6y ago
    Oftentimes, media will use imagery or illustration that are there for illustrative purposes. I don't think Bloomberg claimed to be showing actual photographic evidence. Not to mention, oftentimes the story and the presentation come from separate sources — the editors taking the written story and deciding the headline, and how to present and illustrate it.
- Number157 6y ago
  Well actually kenneth is behind everything and we can prove is because we have the sources to back it up. No of course we can't give out the sources, our journalistic integrity requires us to protect our sources. But we fact checked everything and it's 100% true.
- cheph 6y ago
  > Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. Wait is this all of a sudden a prerequisite for something being believable?!?!?! What the hell did I live through since 2016?
- JumpCrisscross 6y ago
  As a bicoastal American, there is a strong East-West schism in that. West Coast techies, largely disconnected from D.C., being (rightfully albeit overconfidently) sceptical. East Coasters being (almost always overconfidently) confident in their friend at such and such (almost always unrelated) agency vouching for the story.
- Puts 6y ago
  This was published almost one and a half year before the Bloomberg story: https://www.theinformation.com/articles/apple-severed-ties-with-server-supplier-after-security-concern https://www.theinformation.com/articles/apple-severed-ties-w... Why do you completely cut tie with a big supplier over security concerns and at the same time don't disclose why? I'd say this is exceptional in the business of IT-security.
- geofft 6y ago
  > We are better off for having strong dissenting views informing us and expanding the narrative. Strong dissenting views is a means to an end, not an end. The truth is some point in the space of plausible ideas. If the region covered by existing ideas doesn't overlap the truth, then yes, you need to expand it. If it does, then looking elsewhere is guaranteed to bring you farther away from the truth. If the story is false (or, more precisely, Bloomberg's reporters are talking to people who aren't technically qualified to analyze the subject and are misinterpreting it and Bloomberg is putting its own spin of misinterpretation on it), then Bloomberg's contribution to the discourse - to the pursuit of truth - is of no more value than the National Enquirer saying that Batboy hacked all our computers. Possibly of less value, in that people know not to take the Enquirer seriously. The ability to have a wide range of views expressed is good for the pursuit of truth, yes. That doesn't mean that a dissenting view is of merit because it is dissenting. And in the case of this article, when it was based on a previous one that was attacked on the merits and not because of how dissenting it was, and seems to be more of the same, a commitment to the search for truth requires us to dismiss it.
- vl 6y ago
  This is interesting how and why reasonably credible stories instead of being investigated get ignored by mainstream media all the time, recent example being NY Post. In this case Bloomberg comes back with the vengeance, but we need to see if it will picked up or will be buried again.
  - stjohnswarts 6y ago
    NYP is garbage, quite famous for splashing completely untrue stories on the front (or top article on WWW) and then retracting it a few days later in the most remote areas of their media.
- stjohnswarts 6y ago
  Thanks! I didn't see it before. I'd been following it a bit but this fleshed out more details for me. Kudos.
- TwoNineFive 6y ago
  > I'm finding myself increasingly distrustful of the work of journalism outlets You can't say something like this about Bloomberg News and what happened with the Bloomberg presidential campaign and have credibility.
throwaway888abc 6y ago
Unpaywalled: https://archive.is/xewlX https://archive.is/xewlX
gbin 6y ago
Can anyone show us any code? Or an actual chip? Cool infographics don't cut it for me after the first time around with this.
- deleted 6y ago
  [deleted]
- pfundstein 6y ago
  No. As with the previous article I am yet to see a single shred of hard evidence. I would take this series with a healthy dose of skepticism. Speculation: I read last time that Bloomberg rewards the authors of stories that cause stock swings and the last time this came up there was a sizeable swing which had almost returned to normal when this story was released.
  - shalmanese 6y ago
    > I read last time that Bloomberg rewards the authors of stories that cause stock swings They ended that practice well before the previous story was published.
  - deleted 6y ago
    [deleted]
  - Lammy 6y ago
    > As with the previous article I am yet to see a single shred of hard evidence. I would take this series with a healthy dose of skepticism. "As long as knowledge has not been attained, the skeptics aim not to affirm anything." I would ask HN readers if they believe the Snowden leaks about NSA's TAO unit? If so, why so much doubt that other superpowers practice similar operations?
    - PixyMisa 6y ago
      This particular story should be verifiable if it is true. Nobody has been able to verify it, including the journalists who wrote the story. Nobody doubts that China engages in a broad range of hacking attempts. It's just that this story is entirely unsupported by evidence.
kennethfriedman 6y ago
John Gruber at Daring Fireball has covered the meta-story of the publication of these articles extensively. Here's his take on the most recent update: https://daringfireball.net/linked/2021/02/12/bloomberg-big-con https://daringfireball.net/linked/2021/02/12/bloomberg-big-c...
- amanzi 6y ago
  Gruber is the least likely to have an unbiased opinion on this since Apple was part of the story. I don't know what to make of this, but I'm finding it more difficult to believe that the story is not true.
  - PixyMisa 6y ago
    I don't trust Gruber to be free of bias, but on the other hand, everything he says in his response is correct. This is a non-followup to a non-story.
- jstrong 6y ago
  Gruber's article says > Today’s follow-up from Bloomberg offers no evidence either. The follow-up article actually has quite a bit of evidence. e.g. > “In early 2018, two security companies that I advise were briefed by the FBI’s counterintelligence division investigating this discovery of added malicious chips on Supermicro’s motherboards,” said Mike Janke, a former Navy SEAL who co-founded DataTribe, a venture capital firm. maybe there are reasons not to believe the testimony of Janke. but saying the article "offers no evidence" is just bunk.
  - lorenzhs 6y ago
    The word of someone who's not an expert in the subject, who wasn't in the meetings and only heard about them via an unspecified number of intermediates, and doesn't even work there but "advises" the companies? Forgive me, but for the only sourcing of their main claim, that's a bit too weak to clear my standard of evidence.
JMY1 6y ago
Since Supermicro mother boards are selling everywhere, it should be very easy to find one such board and take a picture right?
- gruez 6y ago
  Not really, neither this nor the original article claimed it was done on a mass sale (ie. every machine coming off the line). It was likely only done to juicy targets only.
  - pfundstein 6y ago
    Surely a "juicy target" then would have sufficient resources to confirm or deny this? Last time this came out though, both Apple and Amazon -- who use SuperMicro servers -- explicitly denied that the servers were compromised.
    - JohnJamesRambo 6y ago
      I’m surprised you are surprised by this. Did you expect them to admit their servers were compromised?
      - pfundstein 6y ago
        On one hand, no, but on the other hand I would expect that they preempt inevitable leaks of such information.
      - PixyMisa 6y ago
        The admitted it when they discovered the NSA was tapping their fiber links. They not only admitted it, they were furious, and encrypted all their internal traffic. What's more, they didn't just keep quiet, they made very strong public denials, the kind that would result in SEC and shareholder lawsuits if they were proven to be false.
        paganel 6y ago
kmeisthax 6y ago
>They shared one other trait; U.S. spymasters discovered the manipulations but kept them largely secret as they tried to counter each one and learn more about China’s capabilities. Putting aside the concerns with the believability of this particular Bloomberg article... how many legitimate security holes are ignored in software purely on the basis of "the NSA figures it's NOBUS (nobody knows but us) and it'd be good to use it on China?" I'm personally convinced that the spymasters are more worried about keeping a good stock of security holes in reserve instead of actually securing infrastructure.
- urfuebrjcydy 6y ago
  Are you telling me that a spymaster prioritized intelligence gathering?
  - pdpi 6y ago
    Espionage and counter-espionage are two concerns that need to be balanced against each other. They’re both handled by the same organisations (sort of), so it’s reasonable to ask where those organisations are setting the balance
    - owenmarshall 6y ago
      Fascinating question that I doubt we will ever know the answer to.
    - BelenusMordred 6y ago
      Can't see what they'd ever gain from going public. Counter-intelligence is their job and I'd be highly surprised if they'd alert their opposition simply for some free PR. Far better to try work out what has been compromised and try feed misinformation into that data exfil for as long as possible. That's what we pay them to do, not gallivant around in the media tooting their own horn.
      - michaelt 6y ago
        > Can't see what they'd ever gain from going public 0. It went public with the initial Bloomberg article, so it was lost as a misinformation channel years ago. 1. To get the security problem fixed, thus protecting US interests 2. To support US foreign policy goals like "Europe should reject Huawei 5G equipment" with concrete evidence 3. To demonstrate that, if a US company thinks they've discovered a different supply chain attack attempt, that they're interested, competent to help, and able to speak to you. 4. To show potential hires that that they're protecting the country from real threats, and that there are opportunities to do work that's neither illegal nor unethical 5. To demonstrate to the taxpayer that they're doing their job
kbrosnan 6y ago
Joe Fitz does not think much of this article. https://twitter.com/securelyfitz/status/1360266293190873090 https://twitter.com/securelyfitz/status/1360266293190873090 Worth reviewing the B-Sides PDX 2018 panel on the Supermicro "hack". The reporter was mirroring and testing for plausibility of comments from two or more security researchers attacks on each other. The reporter would take the attack that Joe came up with and ask another security researcher does this seem like a real threat. Then take the attack that the other researcher came up with and test Joe. https://www.youtube.com/watch?v=8omlNyUVllY https://www.youtube.com/watch?v=8omlNyUVllY
- yjftsjthsd-h 6y ago
  > The reporter was mirroring and testing for plausibility of comments from two or more security researchers attacks on each other. That seems completely reasonable? How else would a reporter tell if something is plausible in a field where they lack personal experience?
  - kbrosnan 6y ago
    Reporters do and should use this technique to understand what their article is about and verify a base understanding. They should be careful when it becomes an awkward game of telephone. [1] As Joe Fitz and Joe Grand say in the panel it is a theoretical attack. There are plenty of ways to do an attack with similar effectiveness for cheaper and with more precision. See NSA's ANT catalog where individual boards and devices were created to target specific individuals or organizations. [1] https://en.wikipedia.org/wiki/Telephone_(game) https://en.wikipedia.org/wiki/Telephone_(game)
deleted 6y ago
[deleted]
gigel82 6y ago
A follow up devoid of any concrete evidence to a flaming article devoid of any concrete evidence. Why are they even doubling down on this? If this is as wide-spread as they claim, I'm sure someone donated a "bugged" board for them to have prodded by experts, right?
- rincebrain 6y ago
  It depends. If the assertion is that the customers targeted are a number of very high-profile companies and the US gov't, how often does either group refresh and then eventually sell off or recycle their surplus hardware publicly? I would expect, if this is true, a lot of the affected hardware to still be running for many years to come, and the majority of the private hardware to be disposed of in a recycling pile rather than showing up on the secondhand market. The government, as far as I know, does resell their used hardware sometimes in large lots, so perhaps some lucky customer cheaping out on buying hardware will find some exciting packets in their future...
- ChrisRR 6y ago
  Follow the money
hellotomyrars 6y ago
Its weird to see a follow-up to this that doesn't even begin to acknowledge the broad skepticism of claims except for saying that the previous push-back from the alleged targets was a drop in the bucket. I don't doubt there are highly-targeted supply chain attacks that happen at the whims of state level actors but the specifics presented by this and its previous reporting still are difficult at best to believe with the reporting as it is presented.
- Lammy 6y ago
  It's weird to see how the skepticism is so one-sided on this issue. Any time I've commented that I believe the hack is probably largely true even if the story details aren't 100% accurate I just get downvoted to oblivion and/or called names. My kind of skepticism is open to all possibilities.
  - PixyMisa 6y ago
    How can you say that the story is "probably true" when there is no evidence to back up any of the claims?
    - Lammy 6y ago
      Forgive me for answering a question with another question, but may I ask if you believe in the NSA's Tailored Access Operations unit based on the leaks we got? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... I do, and based on that it feels perfectly reasonable to believe that every other superpower probably has an equivalent. It also feels perfectly reasonable that server BMCs would be a common target for all such units considering the ludicrous access they provide, e.g. remote BIOS flashing, continuous screen recording, etc.
      - rcxdude 6y ago
        That's a great reason for believing some BMCs have been compromised, but it's not a good reason for believing these BMCs specifically have been compromised (and in this way).
areoform 6y ago
Reading these articles and the history of tradecraft has pushed me in Bloomberg's corner. Even without access to any privileged information, I am highly certain that history will come down on Bloomberg's side. It is simply more likely - from first principles reasoning alone - that Bloomberg's story is true than it is false. A famous example is Operation GUNMAN. At the height of the Cold War, the KGB bugged typewriters used by the US Consulate in Leningrad. The breach was so significant that it took some time for them to figure out what had happened, but eventually the NSA got involved (as did the NYT). They of course denied that anything like this ever happened (until a few decades had passed), and they tried to reverse it/control what the soviets saw etc. Here's the NSA's report, https://cryptome.org/2012/05/nsa-gunman.pdf https://cryptome.org/2012/05/nsa-gunman.pdf Here's a LA Times article published around the same time, https://www.latimes.com/archives/la-xpm-1987-04-13-mn-504-story.html https://www.latimes.com/archives/la-xpm-1987-04-13-mn-504-st... Some choice excerpts, > “He wanted the Soviets to hear 95% of what he had to say--when he briefed a congressman, for example,” the diplomat said. “This was one way he had of getting his ideas across to the Soviets. For the other 5%, you had the secure rooms.” > The wife of a former security officer at the American Embassy, for instance, recalls complaining long and distinctly to her kitchen walls several years ago about the disappearance of her favorite butcher knife, seemingly purloined by the Soviet maid. She came home from work a few days later to find a lump under the living room rug. It was the knife. It is difficult to find citations for this, but the NSA knew about the typewriters since at least 1982. However, the State Department "refused comment" on the stories published in '87, and the NSA (which wasn't well known at the time) IIRC denied it, > Embassy officials have refused comment on a CBS News report last March that the Soviets spied on the U.S. embassy from 1982-84 by slipping eavesdropping devices into typewriters. https://apnews.com/article/d79106674e3cac8460d3f8035f1e70fc https://apnews.com/article/d79106674e3cac8460d3f8035f1e70fc For a more modern example, there's STUXNET. Sure we know a lot about it, and they've more or less gloated on background, but they still technically deny any involvement. The official line is that it didn't happen. And there is no real confirmation that it was the US or Israel. Just assumptions. As the decades pass, and the utility and political impact fades, STUXNET will be written about and redacted reports about it will be published. This timeline exists for a success. The timeline for a failure is likely to be longer. None of the participants involved have the incentive to confirm this story. Apple and other companies will lose face. The NSA and FBI would inadvertently disclose sources and methods. SuperMicro would lose customers. It is more believable to me that a state that has billions of dollars at its disposal has deployed such methods against major US companies than it is to believe that such an event hasn't happened. It becomes far more believable given the push to bring back foundries etc to the States. Is this a shot across the bow? A way to let most of congress know that this is a real concern? Who knows? The balance of probabilities falls on the side of this being true rather than false. If you and I could think of this as a method to capture incidental usage data to map out US facilities etc and catch OPSEC fails, then the Chinese security apparatus can do so as well. However, unlike us, they have the ability to print money and throw both capital and labor at the problem until it resolves in their favour.
1970-01-01 6y ago
No proof anywhere! None! Until Bloomberg has actual details, and not bland quotes as proof, I actually believe China: "The chip was blended into the trace on a multilayered board" “What I was told was there was an additional little component on the Supermicro motherboards that was not supposed to be there,”
- jstrong 6y ago
  > “In early 2018, two security companies that I advise were briefed by the FBI’s counterintelligence division investigating this discovery of added malicious chips on Supermicro’s motherboards,” said Mike Janke, a former Navy SEAL who co-founded DataTribe, a venture capital firm. is that a "bland quote"? do you think that meeting did not happen? do you think the fbi was wrong?
  - 1970-01-01 6y ago
    No, I would describe this quote as a giving the story the illusion of truth. Adding a 3 letter agency does nothing but add sizzle and sensation instead of substance and truth. I have no way of knowing if that meeting happened. I do not trust the FBI or any other 3 letter agency to tell the truth at all times.
  - renewiltord 6y ago
    Haha, this is what I'd say if I wanted to ascribe more importance to myself than is worthy. Two security companies I advise = companies I have a brief relationship with, as a consultant were briefed by = were questioned as a matter of routine the FBI's counterintelligence division = some FBI agent's 400th cold lead on this investigating the discovery of = looking to see if some loony internal theory is real Of course you read it and conclude "Oh, the FBI thinks this is credible enough that they told security companies it's happening and they should watch out for it" but that's because that's intentional.
aaron695 6y ago
You know how the state department 'thinks' its diplomats are being zapped by magic sonic laser weapons in Cuba and China. Same thing. There's enough useful idiots within the agencies to keep this going with zero evidence. And since no-one will get a promotion dispelling these rumours, since it'd be like supporting China/Russia, here we are. A good run down on the 'evidence' and hows it's created here - https://twitter.com/pwnallthethings/status/1360232753623629824 https://twitter.com/pwnallthethings/status/13602327536236298...
em3rgent0rdr 6y ago
> As military experts investigated the Pentagon breach, they determined that the malicious instructions guiding the Pentagon’s servers were hidden in the machines’ basic input-output system, or BIOS, part of any computer that tells it what to do at startup. If concerned about this, get a computer that can run the free-opensource Libreboot firmware: https://libreboot.org/docs/hardware/ https://libreboot.org/docs/hardware/
- yjftsjthsd-h 6y ago
  I wonder if there's any way to swing these kinds of problems into getting government funding for coreboot/libreboot.
  - Mindless2112 6y ago
    coreboot was created at a government lab. https://www.coreboot.org/FAQ#Who_is_working_on_coreboot.3F https://www.coreboot.org/FAQ#Who_is_working_on_coreboot.3F
renewiltord 6y ago
Haha yes, these guys have returned. Looking forward to buying some discount SMCI. Last time I doubled my money. Can't wait for the suckers who read Bloomberg News to give me more money.
- renewiltord 6y ago
  Haha, looks like a "Fool me once, shame on you. Fool me twi- you can't fool me again" situation. No one listened to Bloomberg. Sad day. I was hoping to rob infants of their candy.
Loic 6y ago
If you combine the tradition of "ghost" run and drop-shipping, you do not need that many control of points in the production and delivery chain to inject your payload. The payload can be at the Bios or hardware level.
aneutron 6y ago
At this point, this seems to fall into one of two categories: - A childish fixation on spy novels with no journalistic work put behind, or evidence for that matter. - A concerted effort to actively and timely harm Supermicro. How does one write an article, TWICE, unsubstantiated, both times, and tanks the compaby's stock TWICE, and still get away with it. Hell, half of the facts or occurrences in the article are not even related to Supermicro. What the hell is even this article
- turbinerneiter 6y ago
  Not sure if it is an urban legend, but some people say "journalists" at Bloomberg get a bonus depending on how much their articles move the stock price of their target^^
- jstrong 6y ago
  we must have read different articles. I read one where multiple credible people went on the record to say the FBI had warned them that supermicro servers were compromised.
  - aneutron 6y ago
    Hence the "half" part. We have yet to see 1ny condemning evidence. No code, no written report, nothing.
Brian_K_White 6y ago
The Occam's Razor for this is that you have to work harder to disbelieve it than to believe it. You actually have to actively avoid knowing or recognizing things, and have to actively construct rationalizations to explain not taking things seriously. Additionally, completely seperately and standing on itcs own: There is no benefit to you or me to disregard it rather than regard it. That is a whole sufficient argument all by itself. Additionally, completely seperately and standing on it's own: There is no benefit to Bloomberg to fabricate a story like this that they know can't at least eventually be backed up, especially not twice. It has only cost them so far. Did they not know it would cost them? That's a whole sufficient argument all by itself. What is the scam if we are tricked into being careful about hardware supply chains really (1)? China and a dozen others are NOT trying to hack in any way they possibly can? It's NOT perfectly possible to do everything claimed? (1) We're being manipulated! In what direction and for what purpose and how is it against our interests?
- h2odragon 6y ago
  It must be true because Bloomberg wouldn't lie twice? You recall the "Bloomberg for President" campaign? And their multiple incidents of "vandalism" across the country on the same night? Which was all oddly respectful of property...
- gimmeThaBeet 6y ago
  If they were just saying that there were BIOS alterations, code injection, something soft, I have no trouble accepting that as a credible threat. It's feasible, and probably quite hard to detect. But they made fairly specific claims that named companies had discovered extra/altered chips on their boards. So they are saying someone has the mobos, Supermicro has the BOM. Is this part on the BOM? Where did we buy this part from? This is a resistor package, why is there an IC inside? Altered firmware/software would be an admitted beast to wrestle. But the easiest work of all these should be to find the funky part in boards.
- 5560675260 6y ago
  > There is no benefit to Bloomberg to fabricate a story like this that they know can't at least eventually be backed up, especially not twice. There is a real benefit for the author of the story - he gets paid. There is a small benefit for Bloomberg - they get clicks. What I assume is happening here is a mix of incompetence and confidence that they can just get away with this even if the story is false.
afrcnc 6y ago
I need a downvote button for this. See here for the reasons why this article is pure garbage: https://twitter.com/craiu/status/1360242489962221570 https://twitter.com/craiu/status/1360242489962221570
mcosta 6y ago
Trends in mainstream believing. Intel is backdooring all their chips: true. NSA is spying on all of us: true. Marketers are fingerprinting us in sophisticated ways (example: browser cache timing attacks): true. China is bugging motherboards: false.
- johnklos 6y ago
  ...and you know this for a fact how, exactly? Where's your data? Where's your research?
- sudosysgen 6y ago
  The first three aren't believed. They were proven. The Intel ME (and AMD PSP) are literally physically indistinguishable from a backdoor. NSA spying was proven by Snowden et al. Marketers fingerprinting us to the level that personal targeting is possible was proven. Is it possible that China is bugging motherboards? Yes. But if they are, it should not be difficult at all to prove. Just buy some motherboards and analyze the chips to find where the backdoor is. The fact that in over two years that still hasn't been done is just very suspicious. If someone is making a large claim but not providing information that can be found using public, verifiable sources, then it's very reasonable to doubt it. Evidence isn't based purely on what seems right. If hard evidence can be provided but isn't, why should I believe you?
  - evilos 6y ago
    > Just buy some motherboards and analyze the chips to find where the backdoor is If you were bugging motherboards, you would surely anticipate this. Some possible mitigations include only bugging a subset of the motherboards, and bugging them in ways that make them physically indistinguishable from a normal unit. Modified silicon or firmware would be very hard to detect. > The fact that in over two years that still hasn't been done is just very suspicious. If someone is making a large claim but not providing information that can be found using public, verifiable sources, then it's very reasonable to doubt it. If the bugged hardware is rare (it would be if the attackers were smart), then the public would not have access to it and the government agencies looking into this may still well be investigating this or keeping it quiet for whatever reason. I'm not convinced either way on this situation, but it's far from impossible that the allegations are true and it is seems worth discussing.
mdip 6y ago
> In an unusual disclosure for any public company ... We experienced unauthorized intrusions into our network between 2011 and 2018 Seems like the author is trying to create drama where there isn't any, here. Is that an unusual disclosure given that it was made in 2019? I know very little about this subject having never worked (at least directly) in financials/compliance. I've participated in various parts of these things (mostly centered around IT SOX compliance about a decade ago). Something I recall about those days, though, was to "err on the side of disclosure". The game was always "The Department doesn't want to say (this thing) but the auditors want us to[0]". Even if it was based on very little, it's better to explain it than have it come up in a lawsuit. By 2019, this Supermicro story was considered "fact" despite there being enough questions as to call the whole thing into question. The disclosure, from my perspective, served to help the company in two ways: (1) Whatever Supermicro's official position about "being breached" up to that point were, they weren't clear. Whether or not upper management's official position was "we were breached/we were not breached" is irrelevant. In a lawsuit, discovery would likely turn up piles of e-mail from people far down the chain speculating on a breach in a manner that implies "the organization knew all along!" So they've put it to bed "we've been breached" is the official position. That's the starting point of "moving on"... (2) Assuming it's true, they've now answered the question -- for customer's who took their business elsewhere -- is it safe to do business with Supermicro? Apparently a lot of people still think so because "None of these intrusions, individually or in the aggregate, has had a material adverse effect on our business, operations, or products." Perhaps it's an unusual disclosure, but you could say the same about a good chunk of the disclosures we ended up putting together during compliance. [0] "The thing" was always some reporting artifact that appeared to indicate a serious financial issue but was easily normalized -- i.e. an unexpected domain controller was added, an artifact of our reporting caused devices that logged in via that DC to report two of every license required, causing an $40 million gap in the budget. Tweak a SQL query and it's fixed, add the DC to the knowns and it's fixed, but spending an hour arguing why the original, wrong, report should not be disclosed was often the next required step.
francoisp 6y ago
my question is: who benefits? Follow the money. About if this hack is true or not: It should have been simple to prove true. Just show a single compromised article with an extra chip, at least one is bound to show up on ebay? Can three letter agencies round up all compromised hardware in all of America in secrecy?? To this day none has shown up, it's all theoretically true. A compromised sample is worth at least 1M vues on youtube, it's worth real money, yet it remains elusive. A compromised BIOS update is more likely, a BMC IMPI infected by a trojan thing; the new piece is hinting to that in the FUD. Then again, that should be possible to find in a compromised board on ebay (prolly worth less yt vues since nothing physical to look at), and therefore prove this article is not a hit piece for someone with a short position. I think WSB best look into this... :-) Cheers! edit: typo
- jstrong 6y ago
  I don't think this is as easy as you say it is. from the article: > The machines turned out to be loaded with unauthorized instructions directing each one to secretly copy data about itself and its network and send that information to China, according to six former senior officials who described a confidential probe of the incident. The Pentagon found the implant in thousands of servers, one official said; another described it as “ubiquitous.” assuming this is true, there is a universe of "thousands" of supermicro servers purchased by the pentagon that were targeted. my expectation is that most supermicro servers would not be targeted, just those sold to certain buyers. does the pentagon sell used supermicro servers on ebay? is it easy to obtain a used supermicro server from the pentagon? (I don't know the answer to those - genuine questions). even if you had one in your possession, it wouldn't be easy to find the exploit, which was (again, assuming it exists) installed by nation state with the intention of concealing it from another nation state (the world's most powerful). for example, it might only turn on under certain conditions. I wouldn't know where to start. I'm not saying it's impossible, but I am saying it seems much more daunting then you make it out to be ("should have been simple to prove").
  - imglorp 6y ago
    The article said something about messing with traces on the circuit board to hide a component. I think it would be far more likely to start with a well known component like a network or bus drive and produce a modified chip with identical packaging and markings. Only one person in the board vendor's supply chain needs to swap spools of tampered chips into the manufacturing stream. It could sit dormant in most situations unless it saw, say, Pentagon LAN traffic. This means the EBay case is covered; the machine would be normal for everyone else, including the board vendor's QA. You'd have to simulate the target's traffic to see the board doing something wrong. Or decap the chip and read it out.
elisbce 6y ago
It's so simple: You need to be credible to make valid claims. If you get caught for faking photo evidence on a story accusing China bugging the motherboard, your story is done. And even if they did, they are getting away with it because you lost credibility in the first place.
deleted 6y ago
[deleted]
cheaprentalyeti 6y ago
I have been thinking since the first time this report went around... what if it's remarkably clever disinformation? If you search for "China backdoor computers" this report comes up as the first zillion hits on google, there's no physical evidence attached, and if some fraction of the target population believes it anyway, it's pointing at a Taiwanese company, and not a mainland one.
neilv 6y ago
> Two people with direct knowledge said the manipulation combined two pieces of code: The first was embedded in instructions that manage the order of the startup and can’t be easily erased or updated. That code fetched additional instructions that were tucked into the BIOS chip’s unused memory, where they were unlikely to be found even by security-conscious customers. When the server was turned on, the implant would load into the machine’s main memory, where it kept sending out data periodically. Asking the obvious... If this description is accurate, would the second piece of code probably be pretty easy to identify, as a suspicious extraneous block of bits, by a curious ordinary techie who rigged up a RasPi to read the Supermicro's BIOS flash? (Using a tutorial intended for Coreboot installation, for example.) And does anyone know whether the first piece of code would be in that same flash (perhaps harder to find, as part of a blob of BIOS/init code), or stored in the BMC package, or somewhere else? If it turned out that (alleged) backdoored units were widespread, or some rare (alleged) backdoored units possibly were mixed into the supply of cheap used Supermicro servers on eBay, or among units taken home when retired from IT people's workplaces... then might some random techie fiddling around at home find a backdoor? And if someone did find a backdoor that way, would their first call be to their national authorities (to alert, and ask whether it would be bad if they talked about it), or to a journalist, or to post on social media, or to write a haxor paper/post? I'm not going to look myself; just wondering whether this story might suddenly get more credible and problematic that way.
gyf304 6y ago
I would like to plop this link here. Bloomberg News Pays Reporters More If Their Stories Move Markets: https://www.businessinsider.com/bloomberg-reporters-compensation-2013-12 https://www.businessinsider.com/bloomberg-reporters-compensa... Bloomberg reporters have every incentive to publish a story like this, even if it's nonsense.

402 points by kenneth 6y ago

I previously submitted this story a few days ago[1], where it garnered some discussion and a bit over 100 upvotes, but never made the front-page due to some down-weights in HN's algorithm. I'm reposting this story at Daniel's suggestion. He agreed it deserved a second chance to break out. -- I noticed that it's commonly accepted that Bloomberg's 2018 stories on the Supermicro hack were bogus, costing them a huge amount of reputational damage. However, Bloomberg stood by the stories. I'm very curious to see how this one will be received. I was never quite convinced by the naysayers or the denials by the government, Apple, or Amazon. I think it's quite likely that Bloomberg will be proven right in the end, this story having been accurate but suppressed for "secrecy" reasons all along. Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. This time, it seems they have been able to do so. Either way, I'm thrilled to see an outlet do original reporting and stand by their work in the face of universal condemnation. We are better off for having strong dissenting views informing us and expanding the narrative. I'm finding myself increasingly distrustful of the work of journalism outlets, but this (and those gone independent on Substack) gives me hope. [1]: Previous discussion here: https://news.ycombinator.com/item?id=26112436 https://news.ycombinator.com/item?id=26112436

deleted 6y ago
[deleted]
stevemk14ebr 6y ago
I think this twitter thread is a very reasonable analysis of this article: https://twitter.com/pwnallthethings/status/1360232753623629824 https://twitter.com/pwnallthethings/status/13602327536236298.... I think critically there are a lot of claims here, and none of them provide _concrete_ proof of any form. There's a lot of 'senior official said X' and X number of people in the know declined to comment, but these are just appeals to authority/credentials. People are flawed and second hand rumours of rumours can easily bend the truth. I don't think it's necessarily fair to put out a story claiming this is 'the truth' when alot of the sourcing is indirect and 'declined to comment'. It's just not there with the facts! True or not, we can't know, but this report need more facts.
- jorblumesea 6y ago
  This is `usually how national security problems are reported on, due to the classified nature of the work. You don't have to believe it, but it's naive to think that you're going to see actual chips. Currents and formers can talk about the what, but not the how. I mean even China knows the "what". Methods and means are a big deal, PRB kills entire chapters because of it.
- datavirtue 6y ago
  Head in sand. A outfit like bloomberg isn't going going to screw up this bad and then double down by citing more sources. Get a clue.
- jstrong 6y ago
  > Alarmed by the devices’ sophistication, officials opted to warn a small number of potential targets in briefings that identified Supermicro by name. Executives from 10 companies and one large municipal utility told Bloomberg News that they’d received such warnings. in my book that counts as "concrete proof."
  - deftnerd 6y ago
    Only if you believe that the warnings went out because of the "alarm over the devices' sophistication" and not "alarm over the idea this could happen" or even "alarm over a misidentification of a legitimate component and now we're too embarrassed to issue a retraction to those 10 CEOs"
    - koheripbal 6y ago
      Ok, but now you're making another argument with also zero evidence. I think it's fair to say there are multiple circumstantial pieces of evidence that SuperMicro is inserting security vulnerabilities. That should be enough to take the same decision that both the US gov't and Apple and others have made to avoid that manufacturer.
  - michaelt 6y ago
    The article certainly quotes a wealth of sources - but all of them seem to be vague, third-hand stuff. An unnamed "adviser" to security firms that analyzed Supermicro equipment. An executive for some unnamed company, who received a briefing. A venture capitalist who received a briefing. A retired FBI agent who was told there was an "additional little component" by someone he can't name. Some former FBI officials that refuse to name supermicro, and say only that supply chain attacks are possible. Fifty interviews with officials, all of whom asked not to be named. So apparently this information is so public that everyone and their dog is happy confirm it - yet at the same time, so classified that the victims and the 50 sources can't be named? That's pretty vague compared reports of hardware implants like credit card skimmers [1] which put pictures of the hardware front and centre and make it clear that the author has personally seen it and knows (basically) how it works. [1] https://krebsonsecurity.com/all-about-skimmers/ https://krebsonsecurity.com/all-about-skimmers/
ikeboy 6y ago
>Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. It's not just that - it's that no other reputable outlet was able to confirm the story, and many tried. This just doesn't happen with controversial but true stories with many sources - some of those sources will be willing to talk to other outlets.
- jtbayly 6y ago
  Bruce Schneier said last time that he didn’t believe it. This time he said he was wrong. When pressed by a skeptic in the comments, he said, “Independent from this article, I know that the DoD believes this threat is real and is giving away R&D funding for security solutions. So I have more than the Bloomberg reporting to go on.” https://www.schneier.com/blog/archives/2021/02/chinese-supply-chain-attack-on-computer-systems.html https://www.schneier.com/blog/archives/2021/02/chinese-suppl...
  - Daho0n 6y ago
    That "the DoD believes this threat" is not the same as it actually happened. The threat is real, the article is very likely fluff.
    - jtbayly 6y ago
      Yes, but everybody already knows the threat is real, most especially Schneier. Something made him change his mind.
    - datavirtue 6y ago
      All you people are in denial. The first bloomberg story was credible but was protecting sources. They go further and get people on the record and double down....literally stretching their necks out, and you people keep propping up strawmen from the original article. Admit it. You were skeptical, determined that it couldn't be true, ran around shooting your mouth off about how it was fake news and now you can't help but continue smearing the egg all over your face.
ncmncm 6y ago
For a story claiming physical alteration of products, they should have had photographs of altered products. Otherwise it's just "anonymous loudmouths blow smoke". Everything that would be done with the extra component could more easily be done with BIOS code, attracting no attention. So it doesn't pass the sniff test.
- gruez 6y ago
  >Everything that would be done with the extra component could more easily be done with BIOS code This is tricky because on newer platforms the BIOS is signed and verified by the CPU. The signing keys are likely going to be located in the engineering offices (in the US) rather than just lying around in the factories, so getting them would require much more access than just bribing/threatening a few technicians at the factory. > attracting no attention. So it doesn't pass the sniff test. Compromised BIOS is a known threat, so I'd presume paranoid customers would verify/reflash the BIOS upon receiving them. This can be done without booting the motherboard at all (ie. attaching SPI clips to the flash chip and reading/writing directly). A tampered bios would get detected this way so it's not exactly "no attention".
- mdip 6y ago
  I don't think you deserved the downvotes as I felt somewhat the same way. Part of that comes from the reporting, which appears to have been done by someone who doesn't understand the things he's reporting on (or, at least, some of the people quoted are saying things that are nonsense that someone outside of our industry wouldn't necessary recognize) i.e. "had a chip encrypted on the motherboard that would record all the data" ... one does not simply ... encrypt a chip ... With these kinds of explanations or statements used as evidence, it's frustrating trying to figure out what "really happened". Personally, I don't doubt there's something to all of this. It's a "real threat" as has been reported; whether or not it's "theoretically real" or "actually used" isn't that relevant: if it's a "real threat" someone has figured out precisely how to do it or has seen it (or close-enough variations of the "it") being done that it's worth taking action. My hunch is that it's a firmware-related hack; no hardware added to the boards. The article talks around BIOS and such, indicating that some of the code involved was inserted by employees directly connected to the company. It explains the lack of photographic evidence--what's the evidence[0]? And wouldn't the attacker prefer it that way? It also helps explain the "encrypted chip" -- perhaps code, encrypted on the chip (decrypted/executed at boot) was what was intended by that statement[1]. [0] Disassembled code on Github would have been nice, but the US government isn't likely to drop that. [1] And maybe it was said in that bizarre manner intentionally, who knows?
marcan_42 6y ago
It's not just the lack of sources, it's the fact that Bloomberg made up complete nonsense to fill in the bits of the picture that they didn't have. Off the top of my head from that time, I remember they asked someone about the plausibility of some part of the story about the component types that might have been altered, he pointed them at some random example from Digi-Key, and that example became their photoshoot prop. All of their photos were provably fake and staged, and made no technical sense. There was that whole sub-story about how supposedly Ethernet jacks having metal shields was one of the indicators of compromise (what? almost every piece of datacenter kit uses Ethernet jacks with metal shields). The more you looked into the details, the less they added up. The only thing we could confirm was that, at some point, Supermicro shipped compromised drivers. That part I can absolutely believe, and like the last bit of this story update claims, that may well have been an APT hack from a state-actor. That side of the story is entirely believable and self-consistent. But the hardware modifications? Sorry, but the way that story has been reported is complete garbage. I'm not saying it isn't true, I'm saying Bloomberg provided no credible evidence that it is true, and plenty of evidence that they don't have the slightest clue what they're doing, and that their reporting is dishonest. Originally I gave them the benefit of the doubt, but when they published the Ethernet jack story with less than 5 days to check anything from that guy, they lost all semblance of credibility.
- plorkyeran 6y ago
  Yeah, I'm confused by all the posts acting like the objections were just that Bloomberg's first story didn't provide any evidence. It was quite a bit worse than that; they included some very obviously faked evidence and a lot of utter nonsense. I wouldn't be surprised if it turned out to be "based on a true story" but even if every single one of their claims turns out to have been a distorted retelling of something real then I'll still stand by my opinion that it was terrible reporting.
- kenneth 6y ago
  Oftentimes, media will use imagery or illustration that are there for illustrative purposes. I don't think Bloomberg claimed to be showing actual photographic evidence. Not to mention, oftentimes the story and the presentation come from separate sources — the editors taking the written story and deciding the headline, and how to present and illustrate it.
Number157 6y ago
Well actually kenneth is behind everything and we can prove is because we have the sources to back it up. No of course we can't give out the sources, our journalistic integrity requires us to protect our sources. But we fact checked everything and it's 100% true.
cheph 6y ago
> Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. Wait is this all of a sudden a prerequisite for something being believable?!?!?! What the hell did I live through since 2016?
JumpCrisscross 6y ago
As a bicoastal American, there is a strong East-West schism in that. West Coast techies, largely disconnected from D.C., being (rightfully albeit overconfidently) sceptical. East Coasters being (almost always overconfidently) confident in their friend at such and such (almost always unrelated) agency vouching for the story.
Puts 6y ago
This was published almost one and a half year before the Bloomberg story: https://www.theinformation.com/articles/apple-severed-ties-with-server-supplier-after-security-concern https://www.theinformation.com/articles/apple-severed-ties-w... Why do you completely cut tie with a big supplier over security concerns and at the same time don't disclose why? I'd say this is exceptional in the business of IT-security.
geofft 6y ago
> We are better off for having strong dissenting views informing us and expanding the narrative. Strong dissenting views is a means to an end, not an end. The truth is some point in the space of plausible ideas. If the region covered by existing ideas doesn't overlap the truth, then yes, you need to expand it. If it does, then looking elsewhere is guaranteed to bring you farther away from the truth. If the story is false (or, more precisely, Bloomberg's reporters are talking to people who aren't technically qualified to analyze the subject and are misinterpreting it and Bloomberg is putting its own spin of misinterpretation on it), then Bloomberg's contribution to the discourse - to the pursuit of truth - is of no more value than the National Enquirer saying that Batboy hacked all our computers. Possibly of less value, in that people know not to take the Enquirer seriously. The ability to have a wide range of views expressed is good for the pursuit of truth, yes. That doesn't mean that a dissenting view is of merit because it is dissenting. And in the case of this article, when it was based on a previous one that was attacked on the merits and not because of how dissenting it was, and seems to be more of the same, a commitment to the search for truth requires us to dismiss it.
vl 6y ago
This is interesting how and why reasonably credible stories instead of being investigated get ignored by mainstream media all the time, recent example being NY Post. In this case Bloomberg comes back with the vengeance, but we need to see if it will picked up or will be buried again.
- stjohnswarts 6y ago
  NYP is garbage, quite famous for splashing completely untrue stories on the front (or top article on WWW) and then retracting it a few days later in the most remote areas of their media.
stjohnswarts 6y ago
Thanks! I didn't see it before. I'd been following it a bit but this fleshed out more details for me. Kudos.
TwoNineFive 6y ago
> I'm finding myself increasingly distrustful of the work of journalism outlets You can't say something like this about Bloomberg News and what happened with the Bloomberg presidential campaign and have credibility.

throwaway888abc 6y ago

Unpaywalled: https://archive.is/xewlX https://archive.is/xewlX

gbin 6y ago

Can anyone show us any code? Or an actual chip? Cool infographics don't cut it for me after the first time around with this.

deleted 6y ago
[deleted]
pfundstein 6y ago
No. As with the previous article I am yet to see a single shred of hard evidence. I would take this series with a healthy dose of skepticism. Speculation: I read last time that Bloomberg rewards the authors of stories that cause stock swings and the last time this came up there was a sizeable swing which had almost returned to normal when this story was released.
- shalmanese 6y ago
  > I read last time that Bloomberg rewards the authors of stories that cause stock swings They ended that practice well before the previous story was published.
- deleted 6y ago
  [deleted]
- Lammy 6y ago
  > As with the previous article I am yet to see a single shred of hard evidence. I would take this series with a healthy dose of skepticism. "As long as knowledge has not been attained, the skeptics aim not to affirm anything." I would ask HN readers if they believe the Snowden leaks about NSA's TAO unit? If so, why so much doubt that other superpowers practice similar operations?
  - PixyMisa 6y ago
    This particular story should be verifiable if it is true. Nobody has been able to verify it, including the journalists who wrote the story. Nobody doubts that China engages in a broad range of hacking attempts. It's just that this story is entirely unsupported by evidence.

kennethfriedman 6y ago

John Gruber at Daring Fireball has covered the meta-story of the publication of these articles extensively. Here's his take on the most recent update: https://daringfireball.net/linked/2021/02/12/bloomberg-big-con https://daringfireball.net/linked/2021/02/12/bloomberg-big-c...

amanzi 6y ago
Gruber is the least likely to have an unbiased opinion on this since Apple was part of the story. I don't know what to make of this, but I'm finding it more difficult to believe that the story is not true.
- PixyMisa 6y ago
  I don't trust Gruber to be free of bias, but on the other hand, everything he says in his response is correct. This is a non-followup to a non-story.
jstrong 6y ago
Gruber's article says > Today’s follow-up from Bloomberg offers no evidence either. The follow-up article actually has quite a bit of evidence. e.g. > “In early 2018, two security companies that I advise were briefed by the FBI’s counterintelligence division investigating this discovery of added malicious chips on Supermicro’s motherboards,” said Mike Janke, a former Navy SEAL who co-founded DataTribe, a venture capital firm. maybe there are reasons not to believe the testimony of Janke. but saying the article "offers no evidence" is just bunk.
- lorenzhs 6y ago
  The word of someone who's not an expert in the subject, who wasn't in the meetings and only heard about them via an unspecified number of intermediates, and doesn't even work there but "advises" the companies? Forgive me, but for the only sourcing of their main claim, that's a bit too weak to clear my standard of evidence.

JMY1 6y ago

Since Supermicro mother boards are selling everywhere, it should be very easy to find one such board and take a picture right?

gruez 6y ago
Not really, neither this nor the original article claimed it was done on a mass sale (ie. every machine coming off the line). It was likely only done to juicy targets only.
- pfundstein 6y ago
  Surely a "juicy target" then would have sufficient resources to confirm or deny this? Last time this came out though, both Apple and Amazon -- who use SuperMicro servers -- explicitly denied that the servers were compromised.
  - JohnJamesRambo 6y ago
    I’m surprised you are surprised by this. Did you expect them to admit their servers were compromised?
    - pfundstein 6y ago
      On one hand, no, but on the other hand I would expect that they preempt inevitable leaks of such information.
    - PixyMisa 6y ago
      The admitted it when they discovered the NSA was tapping their fiber links. They not only admitted it, they were furious, and encrypted all their internal traffic. What's more, they didn't just keep quiet, they made very strong public denials, the kind that would result in SEC and shareholder lawsuits if they were proven to be false.
      - paganel 6y ago

kmeisthax 6y ago

>They shared one other trait; U.S. spymasters discovered the manipulations but kept them largely secret as they tried to counter each one and learn more about China’s capabilities. Putting aside the concerns with the believability of this particular Bloomberg article... how many legitimate security holes are ignored in software purely on the basis of "the NSA figures it's NOBUS (nobody knows but us) and it'd be good to use it on China?" I'm personally convinced that the spymasters are more worried about keeping a good stock of security holes in reserve instead of actually securing infrastructure.

urfuebrjcydy 6y ago
Are you telling me that a spymaster prioritized intelligence gathering?
- pdpi 6y ago
  Espionage and counter-espionage are two concerns that need to be balanced against each other. They’re both handled by the same organisations (sort of), so it’s reasonable to ask where those organisations are setting the balance
  - owenmarshall 6y ago
    Fascinating question that I doubt we will ever know the answer to.
  - BelenusMordred 6y ago
    Can't see what they'd ever gain from going public. Counter-intelligence is their job and I'd be highly surprised if they'd alert their opposition simply for some free PR. Far better to try work out what has been compromised and try feed misinformation into that data exfil for as long as possible. That's what we pay them to do, not gallivant around in the media tooting their own horn.
    - michaelt 6y ago
      > Can't see what they'd ever gain from going public 0. It went public with the initial Bloomberg article, so it was lost as a misinformation channel years ago. 1. To get the security problem fixed, thus protecting US interests 2. To support US foreign policy goals like "Europe should reject Huawei 5G equipment" with concrete evidence 3. To demonstrate that, if a US company thinks they've discovered a different supply chain attack attempt, that they're interested, competent to help, and able to speak to you. 4. To show potential hires that that they're protecting the country from real threats, and that there are opportunities to do work that's neither illegal nor unethical 5. To demonstrate to the taxpayer that they're doing their job

kbrosnan 6y ago

Joe Fitz does not think much of this article. https://twitter.com/securelyfitz/status/1360266293190873090 https://twitter.com/securelyfitz/status/1360266293190873090 Worth reviewing the B-Sides PDX 2018 panel on the Supermicro "hack". The reporter was mirroring and testing for plausibility of comments from two or more security researchers attacks on each other. The reporter would take the attack that Joe came up with and ask another security researcher does this seem like a real threat. Then take the attack that the other researcher came up with and test Joe. https://www.youtube.com/watch?v=8omlNyUVllY https://www.youtube.com/watch?v=8omlNyUVllY

yjftsjthsd-h 6y ago
> The reporter was mirroring and testing for plausibility of comments from two or more security researchers attacks on each other. That seems completely reasonable? How else would a reporter tell if something is plausible in a field where they lack personal experience?
- kbrosnan 6y ago
  Reporters do and should use this technique to understand what their article is about and verify a base understanding. They should be careful when it becomes an awkward game of telephone. [1] As Joe Fitz and Joe Grand say in the panel it is a theoretical attack. There are plenty of ways to do an attack with similar effectiveness for cheaper and with more precision. See NSA's ANT catalog where individual boards and devices were created to target specific individuals or organizations. [1] https://en.wikipedia.org/wiki/Telephone_(game) https://en.wikipedia.org/wiki/Telephone_(game)

deleted 6y ago

[deleted]

gigel82 6y ago

A follow up devoid of any concrete evidence to a flaming article devoid of any concrete evidence. Why are they even doubling down on this? If this is as wide-spread as they claim, I'm sure someone donated a "bugged" board for them to have prodded by experts, right?

rincebrain 6y ago
It depends. If the assertion is that the customers targeted are a number of very high-profile companies and the US gov't, how often does either group refresh and then eventually sell off or recycle their surplus hardware publicly? I would expect, if this is true, a lot of the affected hardware to still be running for many years to come, and the majority of the private hardware to be disposed of in a recycling pile rather than showing up on the secondhand market. The government, as far as I know, does resell their used hardware sometimes in large lots, so perhaps some lucky customer cheaping out on buying hardware will find some exciting packets in their future...
ChrisRR 6y ago
Follow the money

hellotomyrars 6y ago

Its weird to see a follow-up to this that doesn't even begin to acknowledge the broad skepticism of claims except for saying that the previous push-back from the alleged targets was a drop in the bucket. I don't doubt there are highly-targeted supply chain attacks that happen at the whims of state level actors but the specifics presented by this and its previous reporting still are difficult at best to believe with the reporting as it is presented.

Lammy 6y ago
It's weird to see how the skepticism is so one-sided on this issue. Any time I've commented that I believe the hack is probably largely true even if the story details aren't 100% accurate I just get downvoted to oblivion and/or called names. My kind of skepticism is open to all possibilities.
- PixyMisa 6y ago
  How can you say that the story is "probably true" when there is no evidence to back up any of the claims?
  - Lammy 6y ago
    Forgive me for answering a question with another question, but may I ask if you believe in the NSA's Tailored Access Operations unit based on the leaks we got? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... I do, and based on that it feels perfectly reasonable to believe that every other superpower probably has an equivalent. It also feels perfectly reasonable that server BMCs would be a common target for all such units considering the ludicrous access they provide, e.g. remote BIOS flashing, continuous screen recording, etc.
    - rcxdude 6y ago
      That's a great reason for believing some BMCs have been compromised, but it's not a good reason for believing these BMCs specifically have been compromised (and in this way).

areoform 6y ago

Reading these articles and the history of tradecraft has pushed me in Bloomberg's corner. Even without access to any privileged information, I am highly certain that history will come down on Bloomberg's side. It is simply more likely - from first principles reasoning alone - that Bloomberg's story is true than it is false. A famous example is Operation GUNMAN. At the height of the Cold War, the KGB bugged typewriters used by the US Consulate in Leningrad. The breach was so significant that it took some time for them to figure out what had happened, but eventually the NSA got involved (as did the NYT). They of course denied that anything like this ever happened (until a few decades had passed), and they tried to reverse it/control what the soviets saw etc. Here's the NSA's report, https://cryptome.org/2012/05/nsa-gunman.pdf https://cryptome.org/2012/05/nsa-gunman.pdf Here's a LA Times article published around the same time, https://www.latimes.com/archives/la-xpm-1987-04-13-mn-504-story.html https://www.latimes.com/archives/la-xpm-1987-04-13-mn-504-st... Some choice excerpts, > “He wanted the Soviets to hear 95% of what he had to say--when he briefed a congressman, for example,” the diplomat said. “This was one way he had of getting his ideas across to the Soviets. For the other 5%, you had the secure rooms.” > The wife of a former security officer at the American Embassy, for instance, recalls complaining long and distinctly to her kitchen walls several years ago about the disappearance of her favorite butcher knife, seemingly purloined by the Soviet maid. She came home from work a few days later to find a lump under the living room rug. It was the knife. It is difficult to find citations for this, but the NSA knew about the typewriters since at least 1982. However, the State Department "refused comment" on the stories published in '87, and the NSA (which wasn't well known at the time) IIRC denied it, > Embassy officials have refused comment on a CBS News report last March that the Soviets spied on the U.S. embassy from 1982-84 by slipping eavesdropping devices into typewriters. https://apnews.com/article/d79106674e3cac8460d3f8035f1e70fc https://apnews.com/article/d79106674e3cac8460d3f8035f1e70fc For a more modern example, there's STUXNET. Sure we know a lot about it, and they've more or less gloated on background, but they still technically deny any involvement. The official line is that it didn't happen. And there is no real confirmation that it was the US or Israel. Just assumptions. As the decades pass, and the utility and political impact fades, STUXNET will be written about and redacted reports about it will be published. This timeline exists for a success. The timeline for a failure is likely to be longer. None of the participants involved have the incentive to confirm this story. Apple and other companies will lose face. The NSA and FBI would inadvertently disclose sources and methods. SuperMicro would lose customers. It is more believable to me that a state that has billions of dollars at its disposal has deployed such methods against major US companies than it is to believe that such an event hasn't happened. It becomes far more believable given the push to bring back foundries etc to the States. Is this a shot across the bow? A way to let most of congress know that this is a real concern? Who knows? The balance of probabilities falls on the side of this being true rather than false. If you and I could think of this as a method to capture incidental usage data to map out US facilities etc and catch OPSEC fails, then the Chinese security apparatus can do so as well. However, unlike us, they have the ability to print money and throw both capital and labor at the problem until it resolves in their favour.

1970-01-01 6y ago

No proof anywhere! None! Until Bloomberg has actual details, and not bland quotes as proof, I actually believe China: "The chip was blended into the trace on a multilayered board" “What I was told was there was an additional little component on the Supermicro motherboards that was not supposed to be there,”

jstrong 6y ago
> “In early 2018, two security companies that I advise were briefed by the FBI’s counterintelligence division investigating this discovery of added malicious chips on Supermicro’s motherboards,” said Mike Janke, a former Navy SEAL who co-founded DataTribe, a venture capital firm. is that a "bland quote"? do you think that meeting did not happen? do you think the fbi was wrong?
- 1970-01-01 6y ago
  No, I would describe this quote as a giving the story the illusion of truth. Adding a 3 letter agency does nothing but add sizzle and sensation instead of substance and truth. I have no way of knowing if that meeting happened. I do not trust the FBI or any other 3 letter agency to tell the truth at all times.
- renewiltord 6y ago
  Haha, this is what I'd say if I wanted to ascribe more importance to myself than is worthy. Two security companies I advise = companies I have a brief relationship with, as a consultant were briefed by = were questioned as a matter of routine the FBI's counterintelligence division = some FBI agent's 400th cold lead on this investigating the discovery of = looking to see if some loony internal theory is real Of course you read it and conclude "Oh, the FBI thinks this is credible enough that they told security companies it's happening and they should watch out for it" but that's because that's intentional.

aaron695 6y ago

You know how the state department 'thinks' its diplomats are being zapped by magic sonic laser weapons in Cuba and China. Same thing. There's enough useful idiots within the agencies to keep this going with zero evidence. And since no-one will get a promotion dispelling these rumours, since it'd be like supporting China/Russia, here we are. A good run down on the 'evidence' and hows it's created here - https://twitter.com/pwnallthethings/status/1360232753623629824 https://twitter.com/pwnallthethings/status/13602327536236298...

em3rgent0rdr 6y ago

> As military experts investigated the Pentagon breach, they determined that the malicious instructions guiding the Pentagon’s servers were hidden in the machines’ basic input-output system, or BIOS, part of any computer that tells it what to do at startup. If concerned about this, get a computer that can run the free-opensource Libreboot firmware: https://libreboot.org/docs/hardware/ https://libreboot.org/docs/hardware/

yjftsjthsd-h 6y ago
I wonder if there's any way to swing these kinds of problems into getting government funding for coreboot/libreboot.
- Mindless2112 6y ago
  coreboot was created at a government lab. https://www.coreboot.org/FAQ#Who_is_working_on_coreboot.3F https://www.coreboot.org/FAQ#Who_is_working_on_coreboot.3F

renewiltord 6y ago

Haha yes, these guys have returned. Looking forward to buying some discount SMCI. Last time I doubled my money. Can't wait for the suckers who read Bloomberg News to give me more money.

renewiltord 6y ago
Haha, looks like a "Fool me once, shame on you. Fool me twi- you can't fool me again" situation. No one listened to Bloomberg. Sad day. I was hoping to rob infants of their candy.

Loic 6y ago

If you combine the tradition of "ghost" run and drop-shipping, you do not need that many control of points in the production and delivery chain to inject your payload. The payload can be at the Bios or hardware level.

aneutron 6y ago

At this point, this seems to fall into one of two categories: - A childish fixation on spy novels with no journalistic work put behind, or evidence for that matter. - A concerted effort to actively and timely harm Supermicro. How does one write an article, TWICE, unsubstantiated, both times, and tanks the compaby's stock TWICE, and still get away with it. Hell, half of the facts or occurrences in the article are not even related to Supermicro. What the hell is even this article

turbinerneiter 6y ago
Not sure if it is an urban legend, but some people say "journalists" at Bloomberg get a bonus depending on how much their articles move the stock price of their target^^
jstrong 6y ago
we must have read different articles. I read one where multiple credible people went on the record to say the FBI had warned them that supermicro servers were compromised.
- aneutron 6y ago
  Hence the "half" part. We have yet to see 1ny condemning evidence. No code, no written report, nothing.

Brian_K_White 6y ago

The Occam's Razor for this is that you have to work harder to disbelieve it than to believe it. You actually have to actively avoid knowing or recognizing things, and have to actively construct rationalizations to explain not taking things seriously. Additionally, completely seperately and standing on itcs own: There is no benefit to you or me to disregard it rather than regard it. That is a whole sufficient argument all by itself. Additionally, completely seperately and standing on it's own: There is no benefit to Bloomberg to fabricate a story like this that they know can't at least eventually be backed up, especially not twice. It has only cost them so far. Did they not know it would cost them? That's a whole sufficient argument all by itself. What is the scam if we are tricked into being careful about hardware supply chains really (1)? China and a dozen others are NOT trying to hack in any way they possibly can? It's NOT perfectly possible to do everything claimed? (1) We're being manipulated! In what direction and for what purpose and how is it against our interests?

h2odragon 6y ago
It must be true because Bloomberg wouldn't lie twice? You recall the "Bloomberg for President" campaign? And their multiple incidents of "vandalism" across the country on the same night? Which was all oddly respectful of property...
gimmeThaBeet 6y ago
If they were just saying that there were BIOS alterations, code injection, something soft, I have no trouble accepting that as a credible threat. It's feasible, and probably quite hard to detect. But they made fairly specific claims that named companies had discovered extra/altered chips on their boards. So they are saying someone has the mobos, Supermicro has the BOM. Is this part on the BOM? Where did we buy this part from? This is a resistor package, why is there an IC inside? Altered firmware/software would be an admitted beast to wrestle. But the easiest work of all these should be to find the funky part in boards.
5560675260 6y ago
> There is no benefit to Bloomberg to fabricate a story like this that they know can't at least eventually be backed up, especially not twice. There is a real benefit for the author of the story - he gets paid. There is a small benefit for Bloomberg - they get clicks. What I assume is happening here is a mix of incompetence and confidence that they can just get away with this even if the story is false.

afrcnc 6y ago

I need a downvote button for this. See here for the reasons why this article is pure garbage: https://twitter.com/craiu/status/1360242489962221570 https://twitter.com/craiu/status/1360242489962221570

mcosta 6y ago

Trends in mainstream believing. Intel is backdooring all their chips: true. NSA is spying on all of us: true. Marketers are fingerprinting us in sophisticated ways (example: browser cache timing attacks): true. China is bugging motherboards: false.

johnklos 6y ago
...and you know this for a fact how, exactly? Where's your data? Where's your research?
sudosysgen 6y ago
The first three aren't believed. They were proven. The Intel ME (and AMD PSP) are literally physically indistinguishable from a backdoor. NSA spying was proven by Snowden et al. Marketers fingerprinting us to the level that personal targeting is possible was proven. Is it possible that China is bugging motherboards? Yes. But if they are, it should not be difficult at all to prove. Just buy some motherboards and analyze the chips to find where the backdoor is. The fact that in over two years that still hasn't been done is just very suspicious. If someone is making a large claim but not providing information that can be found using public, verifiable sources, then it's very reasonable to doubt it. Evidence isn't based purely on what seems right. If hard evidence can be provided but isn't, why should I believe you?
- evilos 6y ago
  > Just buy some motherboards and analyze the chips to find where the backdoor is If you were bugging motherboards, you would surely anticipate this. Some possible mitigations include only bugging a subset of the motherboards, and bugging them in ways that make them physically indistinguishable from a normal unit. Modified silicon or firmware would be very hard to detect. > The fact that in over two years that still hasn't been done is just very suspicious. If someone is making a large claim but not providing information that can be found using public, verifiable sources, then it's very reasonable to doubt it. If the bugged hardware is rare (it would be if the attackers were smart), then the public would not have access to it and the government agencies looking into this may still well be investigating this or keeping it quiet for whatever reason. I'm not convinced either way on this situation, but it's far from impossible that the allegations are true and it is seems worth discussing.

mdip 6y ago

> In an unusual disclosure for any public company ... We experienced unauthorized intrusions into our network between 2011 and 2018 Seems like the author is trying to create drama where there isn't any, here. Is that an unusual disclosure given that it was made in 2019? I know very little about this subject having never worked (at least directly) in financials/compliance. I've participated in various parts of these things (mostly centered around IT SOX compliance about a decade ago). Something I recall about those days, though, was to "err on the side of disclosure". The game was always "The Department doesn't want to say (this thing) but the auditors want us to[0]". Even if it was based on very little, it's better to explain it than have it come up in a lawsuit. By 2019, this Supermicro story was considered "fact" despite there being enough questions as to call the whole thing into question. The disclosure, from my perspective, served to help the company in two ways: (1) Whatever Supermicro's official position about "being breached" up to that point were, they weren't clear. Whether or not upper management's official position was "we were breached/we were not breached" is irrelevant. In a lawsuit, discovery would likely turn up piles of e-mail from people far down the chain speculating on a breach in a manner that implies "the organization knew all along!" So they've put it to bed "we've been breached" is the official position. That's the starting point of "moving on"... (2) Assuming it's true, they've now answered the question -- for customer's who took their business elsewhere -- is it safe to do business with Supermicro? Apparently a lot of people still think so because "None of these intrusions, individually or in the aggregate, has had a material adverse effect on our business, operations, or products." Perhaps it's an unusual disclosure, but you could say the same about a good chunk of the disclosures we ended up putting together during compliance. [0] "The thing" was always some reporting artifact that appeared to indicate a serious financial issue but was easily normalized -- i.e. an unexpected domain controller was added, an artifact of our reporting caused devices that logged in via that DC to report two of every license required, causing an $40 million gap in the budget. Tweak a SQL query and it's fixed, add the DC to the knowns and it's fixed, but spending an hour arguing why the original, wrong, report should not be disclosed was often the next required step.

francoisp 6y ago

my question is: who benefits? Follow the money. About if this hack is true or not: It should have been simple to prove true. Just show a single compromised article with an extra chip, at least one is bound to show up on ebay? Can three letter agencies round up all compromised hardware in all of America in secrecy?? To this day none has shown up, it's all theoretically true. A compromised sample is worth at least 1M vues on youtube, it's worth real money, yet it remains elusive. A compromised BIOS update is more likely, a BMC IMPI infected by a trojan thing; the new piece is hinting to that in the FUD. Then again, that should be possible to find in a compromised board on ebay (prolly worth less yt vues since nothing physical to look at), and therefore prove this article is not a hit piece for someone with a short position. I think WSB best look into this... :-) Cheers! edit: typo

jstrong 6y ago
I don't think this is as easy as you say it is. from the article: > The machines turned out to be loaded with unauthorized instructions directing each one to secretly copy data about itself and its network and send that information to China, according to six former senior officials who described a confidential probe of the incident. The Pentagon found the implant in thousands of servers, one official said; another described it as “ubiquitous.” assuming this is true, there is a universe of "thousands" of supermicro servers purchased by the pentagon that were targeted. my expectation is that most supermicro servers would not be targeted, just those sold to certain buyers. does the pentagon sell used supermicro servers on ebay? is it easy to obtain a used supermicro server from the pentagon? (I don't know the answer to those - genuine questions). even if you had one in your possession, it wouldn't be easy to find the exploit, which was (again, assuming it exists) installed by nation state with the intention of concealing it from another nation state (the world's most powerful). for example, it might only turn on under certain conditions. I wouldn't know where to start. I'm not saying it's impossible, but I am saying it seems much more daunting then you make it out to be ("should have been simple to prove").
- imglorp 6y ago
  The article said something about messing with traces on the circuit board to hide a component. I think it would be far more likely to start with a well known component like a network or bus drive and produce a modified chip with identical packaging and markings. Only one person in the board vendor's supply chain needs to swap spools of tampered chips into the manufacturing stream. It could sit dormant in most situations unless it saw, say, Pentagon LAN traffic. This means the EBay case is covered; the machine would be normal for everyone else, including the board vendor's QA. You'd have to simulate the target's traffic to see the board doing something wrong. Or decap the chip and read it out.

elisbce 6y ago

It's so simple: You need to be credible to make valid claims. If you get caught for faking photo evidence on a story accusing China bugging the motherboard, your story is done. And even if they did, they are getting away with it because you lost credibility in the first place.

deleted 6y ago

[deleted]

cheaprentalyeti 6y ago

I have been thinking since the first time this report went around... what if it's remarkably clever disinformation? If you search for "China backdoor computers" this report comes up as the first zillion hits on google, there's no physical evidence attached, and if some fraction of the target population believes it anyway, it's pointing at a Taiwanese company, and not a mainland one.

neilv 6y ago

> Two people with direct knowledge said the manipulation combined two pieces of code: The first was embedded in instructions that manage the order of the startup and can’t be easily erased or updated. That code fetched additional instructions that were tucked into the BIOS chip’s unused memory, where they were unlikely to be found even by security-conscious customers. When the server was turned on, the implant would load into the machine’s main memory, where it kept sending out data periodically. Asking the obvious... If this description is accurate, would the second piece of code probably be pretty easy to identify, as a suspicious extraneous block of bits, by a curious ordinary techie who rigged up a RasPi to read the Supermicro's BIOS flash? (Using a tutorial intended for Coreboot installation, for example.) And does anyone know whether the first piece of code would be in that same flash (perhaps harder to find, as part of a blob of BIOS/init code), or stored in the BMC package, or somewhere else? If it turned out that (alleged) backdoored units were widespread, or some rare (alleged) backdoored units possibly were mixed into the supply of cheap used Supermicro servers on eBay, or among units taken home when retired from IT people's workplaces... then might some random techie fiddling around at home find a backdoor? And if someone did find a backdoor that way, would their first call be to their national authorities (to alert, and ask whether it would be bad if they talked about it), or to a journalist, or to post on social media, or to write a haxor paper/post? I'm not going to look myself; just wondering whether this story might suddenly get more credible and problematic that way.

gyf304 6y ago

I would like to plop this link here. Bloomberg News Pays Reporters More If Their Stories Move Markets: https://www.businessinsider.com/bloomberg-reporters-compensation-2013-12 https://www.businessinsider.com/bloomberg-reporters-compensa... Bloomberg reporters have every incentive to publish a story like this, even if it's nonsense.