12 ms·

Its weird to see a follow-up to this that doesn't even begin to acknowledge the broad skepticism of claims except for saying that the previous push-back from th

Its weird to see a follow-up to this that doesn't even begin to acknowledge the broad skepticism of claims except for saying that the previous push-back from the alleged targets was a drop in the bucket. I don't doubt there are highly-targeted supply chain attacks that happen at the whims of state level actors but the specifics presented by this and its previous reporting still are difficult at best to believe with the reporting as it is presented.

Lammy 6y ago
It's weird to see how the skepticism is so one-sided on this issue. Any time I've commented that I believe the hack is probably largely true even if the story details aren't 100% accurate I just get downvoted to oblivion and/or called names. My kind of skepticism is open to all possibilities.
- PixyMisa 6y ago
  How can you say that the story is "probably true" when there is no evidence to back up any of the claims?
  - Lammy 6y ago
    Forgive me for answering a question with another question, but may I ask if you believe in the NSA's Tailored Access Operations unit based on the leaks we got? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... I do, and based on that it feels perfectly reasonable to believe that every other superpower probably has an equivalent. It also feels perfectly reasonable that server BMCs would be a common target for all such units considering the ludicrous access they provide, e.g. remote BIOS flashing, continuous screen recording, etc.
    - rcxdude 6y ago
      That's a great reason for believing some BMCs have been compromised, but it's not a good reason for believing these BMCs specifically have been compromised (and in this way).
  - Puts 6y ago
    "No evidence" is maybe a little harsh? They have government sources testifying, they have people working for semiconductor manufacturers testifying on getting briefings from FBI. They have court documents on similar incidents with Lenovo? I get that this story very much is about who you chose to believe, but to say "no evidence" makes me think you didn't bother to read the article.
  - koheripbal 6y ago
    When it comes to estimating unverifiable classified truths, your personal estimates are a exercise in balancing probabilities. So based on motive, means, and some circumstantial evidence, we can estimate that this is likely happening. Enough truth, at least, to guide purchasing choices away from SuperMicro.
- refenestrator 6y ago
  Two things can be true simultaneously: 1) The US and China have lots of espionage going both ways and both countries are always trying to do something like this. 2) The Bloomberg story had no evidence whatsoever for any of the specific claims they made, not even "the nice NSA man told me to trust him". And for a bonus, 3), there are probably other stories that happened and didn't get reported in media.
  - Lammy 6y ago
    > 3), there are probably other stories that happened and didn't get reported in media. Agreed 100%, that's why it feels so weird that conversation around this story always seems to drift toward reasons it must not have happened instead of looking for the islands of truth in a story that's probably way way way worse than any of us realize.
    - mr_toad 6y ago
      > instead of looking for the islands of truth in a story You’re shifting the burden of proof. https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy) https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)
      - tlb 6y ago
        If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (You should also do your own checks)
        simonh 6y ago
        Nobody can prove a negative like that. We're talking about data centre servers here, that's what the Bloomberg story is about. For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure (which isn't impossible if there are specific targets) but there's no way to do that without the transmissions being visible. I think a hack like this is much more likely to be viable against consumer and mobile devices. Given that this is all a genuine risk, the Bloomberg story is particularly harmful. It creates the real risk that reports of genuine hacks or vulnerabilities will be sidelined due to reporting on issues like this being tarnished by association. Crying wolf is not good preparation for dealing with real wolves.
- rfoo 6y ago
  Please short $SMCI, thanks!
  - Lammy 6y ago
    I'm sad this story focused so much negative attention on Supermicro, not only because I'm a big fan of their products but because it will surely stop other companies from coming forward or cooperating with investigations for similar attacks now and in the future.
- xref 6y ago
  That’s the kind of faux-skepticism that leads to Qanon, pizzagate, and broad xenophobia. “Oh China must be doing this stuff, I mean we can’t produce a shred of evidence but foreigners == bad so that’s proof enough for me”
  - FriendlyNormie 6y ago
    I would love to slowly grind you to death with a cheese grater over the course of months. Your only food for the remainder of your life will be your own chunks of ground flesh cooked and served back to you.
- redprince 6y ago
  China has a motive and they have the means. That much is undeniably true. What I expect to see is actual proof and not a case built on hearsay. My brand of skepticism requires it.
  - jryle70 6y ago
    Before Snowden revealing NSA's shadowy campaigns, any claims of such effort was met with strong skepticism, just like yours. Which may have been justified at the time. But that was eight years ago. This is 2021. You are absolutely right to raise your skepticism, but dismissing it outright because proofs haven't been presented is naive. Many many classified information didn't see the light decades after they happened. I don't see why this isn't such a case.
    - Daho0n 6y ago
      If Bloomberg had written about "this is happening according to sources" people would not be reacting as they do to an "this happened, look at these pictures that are obviously fake" article. This is nothing like a pre-Snowden talk about NSA where someone theorised what was happening. This would be like if Snowden was quoted anonymously in an article and proof that was clearly fake was shown as actual leaks. Sure hardware modifications like this is happening (we know NSA does so) but this particular article (well, two now) is pure fluff and FUD pretending to have real proof. There's an interesting discussion to be had about this topic but those articles would make anyone a laughingstock if used as facts in the discussion.
      - sangnoir 6y ago
        > This is nothing like a pre-Snowden talk about NSA where someone theorised what was happening. There was something visceral about seeing a picture[1] of the NSA giving an intercepted Cisco router a hardware "upgrade" (beacon) in the Snowden files. Bloomberg tried to something similar for their story, but with fake pictures - that was a terrible idea. 1. Probably don't open this link if you have a security clearance - I haven't been following the status of the Snowden files, but it probably is still considered to be classified info https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
- dvfjsdhgfv 6y ago
  I was of the same mind ant the beginning. Then time passed and Bloomberg failed to provide any evidence. And independent security researches expressed their doubts, too. Of course Apple and AWS issued strong statements without any room for discussion. So at this point, if Bloomberg really had anything to back up their claims, they should have told us so, but they didn't. So I'm more of the opinion their story is inaccurate but they just don't want to admit it.
  - kevin_thibedeau 6y ago
    The consultant straight up admitted that he presented his hacking scenario as merely a hypothetical example. This all got embroidered by an unethical journalist looking to make a splash by "moving markets".
- holstvoogd 6y ago
  Perhaps because the person that they used as their main source said they completely misquoted him and that he believes it was complete BS?
- boringg 6y ago
  Downvoted by the pro-china online click farm army? (downvotes incoming)
  - dang 6y ago
    You can't post like this here. Please read the rules: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. If you need further explanation: https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme... https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20-recycling%20chin&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- necheffa 6y ago
  These low value articles about such-and-such security vulnerability that provide zero technical information allowing me to identify signs of impact or remediation steps really piss me off. Do enough people have their heads firmly planted in the sand that they believe there is no state sponsored bumps in the night? That is the only reasonable defense for such low value publication.
SpicyLemonZest 6y ago
Well, the push back was a huge part of the skepticism. It just wasn’t plausible that tech companies would lie so strongly and in such detail to protect a government investigation, especially not Apple after their famous controversies with the FBI. The follow up doesn’t claim to confirm that part of the original, and they did find tech industry people willing to go on the record about this. Speaking for myself, I’m still not gonna just take three letter agencies at their word, but the source article shifted me from “probably false” to “probably true”.
neximo64 6y ago
The skepticism doesn't have to be acknowledged explicitly when it can be done implicitly. Like with this article.
outsomnia 6y ago
Supply-chain vulnerability is no different than a software vuln, if it looks exploitable it should be patched regardless of if Bloomberg can show you a photo of an attack in the wild. There are a lot of these soft underbellies around, like the fact your browser trusts CAs from potential adversaries, people walking around with phones whose firmware is entirely controlled by potential adversaries. It's painful to think about what would happen should a war ever break out.
jstrong 6y ago
it does acknowledge it though? > Supermicro, Apple and Amazon publicly called for a retraction. U.S. government officials also disputed the article.
- hellotomyrars 6y ago
  Yes. That is what I said in my post. They mentioned the denials, and then in the next paragraph went on to say it was bigger than they'd previously reported. They didn't at any point address the broad degree of skepticism that exists among security researchers. This is a story which was met with a pretty wide swath of knowledgeable and credentialed people (much like the primarily alleged sources in the article) who pushed back on it, let alone the alleged targets. In fact, one of the few named sources from the original article (Joe Fitzpatrick) made statements after the publication of the article against his contributions to the piece after its publication. Again, I don't doubt for a second that these types of attacks happen/exist but I have a hard time accepting the `facts` as they are presented in this case and I think that is how a lot of people feel.

Lammy 6y ago

It's weird to see how the skepticism is so one-sided on this issue. Any time I've commented that I believe the hack is probably largely true even if the story details aren't 100% accurate I just get downvoted to oblivion and/or called names. My kind of skepticism is open to all possibilities.

PixyMisa 6y ago
How can you say that the story is "probably true" when there is no evidence to back up any of the claims?
- Lammy 6y ago
  Forgive me for answering a question with another question, but may I ask if you believe in the NSA's Tailored Access Operations unit based on the leaks we got? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... I do, and based on that it feels perfectly reasonable to believe that every other superpower probably has an equivalent. It also feels perfectly reasonable that server BMCs would be a common target for all such units considering the ludicrous access they provide, e.g. remote BIOS flashing, continuous screen recording, etc.
  - rcxdude 6y ago
    That's a great reason for believing some BMCs have been compromised, but it's not a good reason for believing these BMCs specifically have been compromised (and in this way).
- Puts 6y ago
  "No evidence" is maybe a little harsh? They have government sources testifying, they have people working for semiconductor manufacturers testifying on getting briefings from FBI. They have court documents on similar incidents with Lenovo? I get that this story very much is about who you chose to believe, but to say "no evidence" makes me think you didn't bother to read the article.
- koheripbal 6y ago
  When it comes to estimating unverifiable classified truths, your personal estimates are a exercise in balancing probabilities. So based on motive, means, and some circumstantial evidence, we can estimate that this is likely happening. Enough truth, at least, to guide purchasing choices away from SuperMicro.
refenestrator 6y ago
Two things can be true simultaneously: 1) The US and China have lots of espionage going both ways and both countries are always trying to do something like this. 2) The Bloomberg story had no evidence whatsoever for any of the specific claims they made, not even "the nice NSA man told me to trust him". And for a bonus, 3), there are probably other stories that happened and didn't get reported in media.
- Lammy 6y ago
  > 3), there are probably other stories that happened and didn't get reported in media. Agreed 100%, that's why it feels so weird that conversation around this story always seems to drift toward reasons it must not have happened instead of looking for the islands of truth in a story that's probably way way way worse than any of us realize.
  - mr_toad 6y ago
    > instead of looking for the islands of truth in a story You’re shifting the burden of proof. https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy) https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)
    - tlb 6y ago
      If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (You should also do your own checks)
      - simonh 6y ago
        Nobody can prove a negative like that. We're talking about data centre servers here, that's what the Bloomberg story is about. For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure (which isn't impossible if there are specific targets) but there's no way to do that without the transmissions being visible. I think a hack like this is much more likely to be viable against consumer and mobile devices. Given that this is all a genuine risk, the Bloomberg story is particularly harmful. It creates the real risk that reports of genuine hacks or vulnerabilities will be sidelined due to reporting on issues like this being tarnished by association. Crying wolf is not good preparation for dealing with real wolves.
rfoo 6y ago
Please short $SMCI, thanks!
- Lammy 6y ago
  I'm sad this story focused so much negative attention on Supermicro, not only because I'm a big fan of their products but because it will surely stop other companies from coming forward or cooperating with investigations for similar attacks now and in the future.
xref 6y ago
That’s the kind of faux-skepticism that leads to Qanon, pizzagate, and broad xenophobia. “Oh China must be doing this stuff, I mean we can’t produce a shred of evidence but foreigners == bad so that’s proof enough for me”
- FriendlyNormie 6y ago
  I would love to slowly grind you to death with a cheese grater over the course of months. Your only food for the remainder of your life will be your own chunks of ground flesh cooked and served back to you.
redprince 6y ago
China has a motive and they have the means. That much is undeniably true. What I expect to see is actual proof and not a case built on hearsay. My brand of skepticism requires it.
- jryle70 6y ago
  Before Snowden revealing NSA's shadowy campaigns, any claims of such effort was met with strong skepticism, just like yours. Which may have been justified at the time. But that was eight years ago. This is 2021. You are absolutely right to raise your skepticism, but dismissing it outright because proofs haven't been presented is naive. Many many classified information didn't see the light decades after they happened. I don't see why this isn't such a case.
  - Daho0n 6y ago
    If Bloomberg had written about "this is happening according to sources" people would not be reacting as they do to an "this happened, look at these pictures that are obviously fake" article. This is nothing like a pre-Snowden talk about NSA where someone theorised what was happening. This would be like if Snowden was quoted anonymously in an article and proof that was clearly fake was shown as actual leaks. Sure hardware modifications like this is happening (we know NSA does so) but this particular article (well, two now) is pure fluff and FUD pretending to have real proof. There's an interesting discussion to be had about this topic but those articles would make anyone a laughingstock if used as facts in the discussion.
    - sangnoir 6y ago
      > This is nothing like a pre-Snowden talk about NSA where someone theorised what was happening. There was something visceral about seeing a picture[1] of the NSA giving an intercepted Cisco router a hardware "upgrade" (beacon) in the Snowden files. Bloomberg tried to something similar for their story, but with fake pictures - that was a terrible idea. 1. Probably don't open this link if you have a security clearance - I haven't been following the status of the Snowden files, but it probably is still considered to be classified info https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
dvfjsdhgfv 6y ago
I was of the same mind ant the beginning. Then time passed and Bloomberg failed to provide any evidence. And independent security researches expressed their doubts, too. Of course Apple and AWS issued strong statements without any room for discussion. So at this point, if Bloomberg really had anything to back up their claims, they should have told us so, but they didn't. So I'm more of the opinion their story is inaccurate but they just don't want to admit it.
- kevin_thibedeau 6y ago
  The consultant straight up admitted that he presented his hacking scenario as merely a hypothetical example. This all got embroidered by an unethical journalist looking to make a splash by "moving markets".
holstvoogd 6y ago
Perhaps because the person that they used as their main source said they completely misquoted him and that he believes it was complete BS?
boringg 6y ago
Downvoted by the pro-china online click farm army? (downvotes incoming)
- dang 6y ago
  You can't post like this here. Please read the rules: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. If you need further explanation: https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme... https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20-recycling%20chin&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
necheffa 6y ago
These low value articles about such-and-such security vulnerability that provide zero technical information allowing me to identify signs of impact or remediation steps really piss me off. Do enough people have their heads firmly planted in the sand that they believe there is no state sponsored bumps in the night? That is the only reasonable defense for such low value publication.

SpicyLemonZest 6y ago

Well, the push back was a huge part of the skepticism. It just wasn’t plausible that tech companies would lie so strongly and in such detail to protect a government investigation, especially not Apple after their famous controversies with the FBI. The follow up doesn’t claim to confirm that part of the original, and they did find tech industry people willing to go on the record about this. Speaking for myself, I’m still not gonna just take three letter agencies at their word, but the source article shifted me from “probably false” to “probably true”.

neximo64 6y ago

The skepticism doesn't have to be acknowledged explicitly when it can be done implicitly. Like with this article.

outsomnia 6y ago

Supply-chain vulnerability is no different than a software vuln, if it looks exploitable it should be patched regardless of if Bloomberg can show you a photo of an attack in the wild. There are a lot of these soft underbellies around, like the fact your browser trusts CAs from potential adversaries, people walking around with phones whose firmware is entirely controlled by potential adversaries. It's painful to think about what would happen should a war ever break out.

jstrong 6y ago

it does acknowledge it though? > Supermicro, Apple and Amazon publicly called for a retraction. U.S. government officials also disputed the article.

hellotomyrars 6y ago
Yes. That is what I said in my post. They mentioned the denials, and then in the next paragraph went on to say it was bigger than they'd previously reported. They didn't at any point address the broad degree of skepticism that exists among security researchers. This is a story which was met with a pretty wide swath of knowledgeable and credentialed people (much like the primarily alleged sources in the article) who pushed back on it, let alone the alleged targets. In fact, one of the few named sources from the original article (Joe Fitzpatrick) made statements after the publication of the article against his contributions to the piece after its publication. Again, I don't doubt for a second that these types of attacks happen/exist but I have a hard time accepting the `facts` as they are presented in this case and I think that is how a lot of people feel.