7 ms·

It's not just the lack of sources, it's the fact that Bloomberg made up complete nonsense to fill in the bits of the picture that they didn't have. Off the top

It's not just the lack of sources, it's the fact that Bloomberg made up complete nonsense to fill in the bits of the picture that they didn't have. Off the top of my head from that time, I remember they asked someone about the plausibility of some part of the story about the component types that might have been altered, he pointed them at some random example from Digi-Key, and that example became their photoshoot prop. All of their photos were provably fake and staged, and made no technical sense. There was that whole sub-story about how supposedly Ethernet jacks having metal shields was one of the indicators of compromise (what? almost every piece of datacenter kit uses Ethernet jacks with metal shields). The more you looked into the details, the less they added up. The only thing we could confirm was that, at some point, Supermicro shipped compromised drivers. That part I can absolutely believe, and like the last bit of this story update claims, that may well have been an APT hack from a state-actor. That side of the story is entirely believable and self-consistent. But the hardware modifications? Sorry, but the way that story has been reported is complete garbage. I'm not saying it isn't true, I'm saying Bloomberg provided no credible evidence that it is true, and plenty of evidence that they don't have the slightest clue what they're doing, and that their reporting is dishonest. Originally I gave them the benefit of the doubt, but when they published the Ethernet jack story with less than 5 days to check anything from that guy, they lost all semblance of credibility.

plorkyeran 6y ago
Yeah, I'm confused by all the posts acting like the objections were just that Bloomberg's first story didn't provide any evidence. It was quite a bit worse than that; they included some very obviously faked evidence and a lot of utter nonsense. I wouldn't be surprised if it turned out to be "based on a true story" but even if every single one of their claims turns out to have been a distorted retelling of something real then I'll still stand by my opinion that it was terrible reporting.
kenneth 6y ago
Oftentimes, media will use imagery or illustration that are there for illustrative purposes. I don't think Bloomberg claimed to be showing actual photographic evidence. Not to mention, oftentimes the story and the presentation come from separate sources — the editors taking the written story and deciding the headline, and how to present and illustrate it.
- unwind 6y ago
  That is a huge pet peeve of mine, using images for "illustrative purposes" does NOT mean "to illustrate, i.e. show in images, what we're talking about". Instead, it means "to give you an image to rest your eyes on, so reading all of these annoying letters doesn't make them catch on fire" or something. This is so weird.
  - thgaway17 6y ago
    From MW Definition of illustrative : serving, tending, or designed to illustrate illustrative examples art that is illustrative of provincial life
  - koheripbal 6y ago
    I agree, it annoys me too - especially in astronomy posts. ...but the point in this case is that it should not be used to discredit the Bloomberg article.
  - bigbizisverywyz 6y ago
    I would agree, if you have no photographic evidence, then don't include a photograph, but instead make an illustrative diagram to show what you mean.
- himinlomax 6y ago
  > Oftentimes, media will use imagery or illustration that are there for illustrative purposes "Hitler was a really bad man. Here is a picture of Hackernews user `kenneth` for illustrative purposes." Something like that happened in France a few years ago. A TV channel illustrated a news segment about cybercrime with the first B-roll of computers they could put their hands on. It turned out to be shots from a segment on a not-for-profit org teaching computer skills to the poor (including former inmates). The org was pissed, the TV channel just said it was "for illustrative purposes", as if that was justification enough.
  - bartvk 6y ago
    I worked at a scientific institute. Every time we got some airtime, they asked the director to dress in a cleanroom suit. This man has never worked in a cleanroom, ever. But hey, it looks interesting for the layman. I've gotten extremely sceptical at whatever images the news is showing. They don't date nor give source for their material.
cm2187 6y ago
How is that different from any other article on any other topic? Everytime I read an article on a topic I am familiar with, it is full of approximations, misunderstanding of why things work in a particular way, exaggerations, etc. The standard you apply would remove any credential to every newspaper.
- FDSGSG 6y ago
  Unlike most articles, this one is making rather significant accusations.
  - blaser-waffle 6y ago
    Yeah unlike all of those allegations of fraud, murder, etc. that newspapers post. Nothing significant about those accusations...
    - FDSGSG 6y ago
      I don't think it's very common for newspapers to post comparable allegations of fraud or murder. Do you? When reporting that someone has been arrested, indicted or is under investigation for such crimes newspapers aren't actually alleging that they did the thing. That seems quite different from what happened here.
K0balt 6y ago
The reason that the information about hardware was vauge is probably because it was (is) most likely classified. IMHO Bloomberg is trying to break this story without giving malicious actors useful information. As a proof of concept experiment, I hacked together an Mcu, a few caps, resistors, diodes, and a small power transistor to see what could be done on a "single component" attack. I was able to receive data and inject malicious messaging into the data from a serial eeprom using a "filter capacitor" made up of my device (only 2 wires, 1 to signal, 1 to ground) Obviously, not having access to a fab or able to integrate microscale circuits, my device would have been trivially detected (about 1 cubic centimeter) but with access to a fab and a bespoke lab, I have no doubt it could be manufactured down to the size of a standard filter capacitor (~3mm3). I do not know if this is what malicious actors would do or not, but if I can build a 2 wire device to compromise the data loaded from serial flash, then any state actor can. If you compromise this data on the control firmware for a PC, you own the board. All of the claims that the hardware attack is fanciful are clearly naieve, based on my experiment. It is worth mentioning that the attack that I experimentally replicated is the hard version. The easy one is to substitute a modified device for the serial eeprom itself... Also invisible, and orders of magnitude more potent. A compromised eeprom could include advanced features including large amounts of storage and built in rf communication capabilities. The naysayers in this case saying that the attack would be technically infeasible or excessively difficult to implement undetected are simply wrong from a technical point of view. Compromised devices could be mass manufactured for < 10usd each, and if you can get a reel of them into a manufacturers supply chain, you can permenantly compromise thousands of devices with a single attack. The required tech is within reach of any state actor with access to a fab.
- Daho0n 6y ago
  >The reason that the information about hardware was vauge is probably because it was (is) most likely classified. This is irelevant to the article though. The article was clearly written by someone who didn't even know what an Ethernet cable looks like and someone who provided fake photos for the article. It makes no difference if it could have happened to the clearly fakenews article. There's a discussion to be had about the implecications of something like this happening but baseing it on a fluff piece is not the way to get anything useful.

plorkyeran 6y ago

Yeah, I'm confused by all the posts acting like the objections were just that Bloomberg's first story didn't provide any evidence. It was quite a bit worse than that; they included some very obviously faked evidence and a lot of utter nonsense. I wouldn't be surprised if it turned out to be "based on a true story" but even if every single one of their claims turns out to have been a distorted retelling of something real then I'll still stand by my opinion that it was terrible reporting.

kenneth 6y ago

Oftentimes, media will use imagery or illustration that are there for illustrative purposes. I don't think Bloomberg claimed to be showing actual photographic evidence. Not to mention, oftentimes the story and the presentation come from separate sources — the editors taking the written story and deciding the headline, and how to present and illustrate it.

unwind 6y ago
That is a huge pet peeve of mine, using images for "illustrative purposes" does NOT mean "to illustrate, i.e. show in images, what we're talking about". Instead, it means "to give you an image to rest your eyes on, so reading all of these annoying letters doesn't make them catch on fire" or something. This is so weird.
- thgaway17 6y ago
  From MW Definition of illustrative : serving, tending, or designed to illustrate illustrative examples art that is illustrative of provincial life
- koheripbal 6y ago
  I agree, it annoys me too - especially in astronomy posts. ...but the point in this case is that it should not be used to discredit the Bloomberg article.
- bigbizisverywyz 6y ago
  I would agree, if you have no photographic evidence, then don't include a photograph, but instead make an illustrative diagram to show what you mean.
himinlomax 6y ago
> Oftentimes, media will use imagery or illustration that are there for illustrative purposes "Hitler was a really bad man. Here is a picture of Hackernews user `kenneth` for illustrative purposes." Something like that happened in France a few years ago. A TV channel illustrated a news segment about cybercrime with the first B-roll of computers they could put their hands on. It turned out to be shots from a segment on a not-for-profit org teaching computer skills to the poor (including former inmates). The org was pissed, the TV channel just said it was "for illustrative purposes", as if that was justification enough.
- bartvk 6y ago
  I worked at a scientific institute. Every time we got some airtime, they asked the director to dress in a cleanroom suit. This man has never worked in a cleanroom, ever. But hey, it looks interesting for the layman. I've gotten extremely sceptical at whatever images the news is showing. They don't date nor give source for their material.

cm2187 6y ago

How is that different from any other article on any other topic? Everytime I read an article on a topic I am familiar with, it is full of approximations, misunderstanding of why things work in a particular way, exaggerations, etc. The standard you apply would remove any credential to every newspaper.

FDSGSG 6y ago
Unlike most articles, this one is making rather significant accusations.
- blaser-waffle 6y ago
  Yeah unlike all of those allegations of fraud, murder, etc. that newspapers post. Nothing significant about those accusations...
  - FDSGSG 6y ago
    I don't think it's very common for newspapers to post comparable allegations of fraud or murder. Do you? When reporting that someone has been arrested, indicted or is under investigation for such crimes newspapers aren't actually alleging that they did the thing. That seems quite different from what happened here.

K0balt 6y ago

The reason that the information about hardware was vauge is probably because it was (is) most likely classified. IMHO Bloomberg is trying to break this story without giving malicious actors useful information. As a proof of concept experiment, I hacked together an Mcu, a few caps, resistors, diodes, and a small power transistor to see what could be done on a "single component" attack. I was able to receive data and inject malicious messaging into the data from a serial eeprom using a "filter capacitor" made up of my device (only 2 wires, 1 to signal, 1 to ground) Obviously, not having access to a fab or able to integrate microscale circuits, my device would have been trivially detected (about 1 cubic centimeter) but with access to a fab and a bespoke lab, I have no doubt it could be manufactured down to the size of a standard filter capacitor (~3mm3). I do not know if this is what malicious actors would do or not, but if I can build a 2 wire device to compromise the data loaded from serial flash, then any state actor can. If you compromise this data on the control firmware for a PC, you own the board. All of the claims that the hardware attack is fanciful are clearly naieve, based on my experiment. It is worth mentioning that the attack that I experimentally replicated is the hard version. The easy one is to substitute a modified device for the serial eeprom itself... Also invisible, and orders of magnitude more potent. A compromised eeprom could include advanced features including large amounts of storage and built in rf communication capabilities. The naysayers in this case saying that the attack would be technically infeasible or excessively difficult to implement undetected are simply wrong from a technical point of view. Compromised devices could be mass manufactured for < 10usd each, and if you can get a reel of them into a manufacturers supply chain, you can permenantly compromise thousands of devices with a single attack. The required tech is within reach of any state actor with access to a fab.

Daho0n 6y ago
>The reason that the information about hardware was vauge is probably because it was (is) most likely classified. This is irelevant to the article though. The article was clearly written by someone who didn't even know what an Ethernet cable looks like and someone who provided fake photos for the article. It makes no difference if it could have happened to the clearly fakenews article. There's a discussion to be had about the implecications of something like this happening but baseing it on a fluff piece is not the way to get anything useful.