4 ms·

So, what, some time after the line, after a sale was made, during fulfillment, a Chinese super-spy managed to open up specific server that the juicy target was

So, what, some time after the line, after a sale was made, during fulfillment, a Chinese super-spy managed to open up specific server that the juicy target was getting and solder some special chip onto the board somehow in a way that worked instead of bricking the board? I mean, honestly, hats off if that's the case. That would be pretty cool. But you need actual evidence for such a tale.

crispyambulance 6y ago
> a Chinese super-spy managed to open up specific server that the juicy target was getting and solder some special chip onto the board ... That's pretty much it (if the story is not bullshit). That, or cooperation from Supermicro or whoever was their distributor to the target.
redis_mlc 6y ago
I guess you didn't get the memo. The interception is done during shipping, and no soldering is needed - the item just gets replaced en route. This has been the story for literally decades. Also, if your board has IPMI enabled, then you're already pwned without any soldering.
gruez 6y ago
>So, what, some time after the line, after a sale was made, during fulfillment, a Chinese super-spy managed to open up specific server that the juicy target was getting and solder some special chip onto the board somehow in a way that worked instead of bricking the board? I'm not sure why you're implying that you need a super-spy to pull this off. If this was done at the factory level they likely had access to the same manufacturing equipment used to make the motherboards, so there's no need to manually solder anything. The implant was alleged to be a surface-mount component so it could be as simple as reprogramming the pick-and-place machine or swaping out the reels. Given that this is china enlisting a couple of technicians to your cause wouldn't be too hard[1]. From there once they figure out a particular order is going to a juicy target they can ship the bugged boards in place of the untampered boards. > But you need actual evidence for such a tale. Agreed. My main takeway from the article is that this hack could happen, not necessarily that it has happened. [1] it's not unlike the concerns that there are NSA backdoors in intel cpus (eg. AMT/vpro, or RDRAND), or windows (NSAKEY).
- refenestrator 6y ago
  > I'm not sure why you're implying that you need a super-spy to pull this off. The factory doesn't have assembly lines marked like 'for apple', 'for the nsa'. It's just an assembly line making a bunch of identical boards. You'd have to identify a specific board way after it's left the assembly line, and probably after being integrated into a chassis to put your spy chip on it if it's targeted at a specific customer.
  - gruez 6y ago
    1. Make a batch of bugged boards 2. Wait for an order from apple 3. Add the bugged boards If the warehouses and manufacturing lines are all in China (as is the case with just in time manufacturing) I don't see why this is difficult to pull off.
    - deleted 6y ago
      [deleted]
    - yorwba 6y ago
      I'd expect shipments across the Pacific to be aggregated into the smallest possible number of containers and only subdivided into batches for individual customers at the last possible moment, in order to minimize both transportation cost and the risk that any single customer loses their entire order when a container falls off the ship. Is that not how it works? If so, I'd like to know why.
      - gruez 6y ago
        That'd depend on how the shipping is done. What you described would apply for something like retail, where the factory only deals/sells to a distributor (stateside), which then sells/ship them to retailers. Under that setup it would be hard to accurately predict where a particular motherboard would end up at the factory. However, I suspect for large orders, they won't bother with that and would send an entire shipping container or pallet to the customer straight from the factory.
  - 6y ago
rblatz 6y ago
Google “NSA Interdiction”, tons of news articles detailing them “upgrading” target shipments of laptops, networking gear, and other electronics.

crispyambulance 6y ago

> a Chinese super-spy managed to open up specific server that the juicy target was getting and solder some special chip onto the board ... That's pretty much it (if the story is not bullshit). That, or cooperation from Supermicro or whoever was their distributor to the target.

redis_mlc 6y ago

I guess you didn't get the memo. The interception is done during shipping, and no soldering is needed - the item just gets replaced en route. This has been the story for literally decades. Also, if your board has IPMI enabled, then you're already pwned without any soldering.

gruez 6y ago

>So, what, some time after the line, after a sale was made, during fulfillment, a Chinese super-spy managed to open up specific server that the juicy target was getting and solder some special chip onto the board somehow in a way that worked instead of bricking the board? I'm not sure why you're implying that you need a super-spy to pull this off. If this was done at the factory level they likely had access to the same manufacturing equipment used to make the motherboards, so there's no need to manually solder anything. The implant was alleged to be a surface-mount component so it could be as simple as reprogramming the pick-and-place machine or swaping out the reels. Given that this is china enlisting a couple of technicians to your cause wouldn't be too hard[1]. From there once they figure out a particular order is going to a juicy target they can ship the bugged boards in place of the untampered boards. > But you need actual evidence for such a tale. Agreed. My main takeway from the article is that this hack could happen, not necessarily that it has happened. [1] it's not unlike the concerns that there are NSA backdoors in intel cpus (eg. AMT/vpro, or RDRAND), or windows (NSAKEY).

refenestrator 6y ago
> I'm not sure why you're implying that you need a super-spy to pull this off. The factory doesn't have assembly lines marked like 'for apple', 'for the nsa'. It's just an assembly line making a bunch of identical boards. You'd have to identify a specific board way after it's left the assembly line, and probably after being integrated into a chassis to put your spy chip on it if it's targeted at a specific customer.
- gruez 6y ago
  1. Make a batch of bugged boards 2. Wait for an order from apple 3. Add the bugged boards If the warehouses and manufacturing lines are all in China (as is the case with just in time manufacturing) I don't see why this is difficult to pull off.
  - deleted 6y ago
    [deleted]
  - yorwba 6y ago
    I'd expect shipments across the Pacific to be aggregated into the smallest possible number of containers and only subdivided into batches for individual customers at the last possible moment, in order to minimize both transportation cost and the risk that any single customer loses their entire order when a container falls off the ship. Is that not how it works? If so, I'd like to know why.
    - gruez 6y ago
      That'd depend on how the shipping is done. What you described would apply for something like retail, where the factory only deals/sells to a distributor (stateside), which then sells/ship them to retailers. Under that setup it would be hard to accurately predict where a particular motherboard would end up at the factory. However, I suspect for large orders, they won't bother with that and would send an entire shipping container or pallet to the customer straight from the factory.
- 6y ago

rblatz 6y ago

Google “NSA Interdiction”, tons of news articles detailing them “upgrading” target shipments of laptops, networking gear, and other electronics.