3 ms·

Remember when HN collectively lost their minds and questioned journalists integrity for suggesting that the Chinese government could have put a backdoor chip ga

by mike_d 5y ago

Remember when HN collectively lost their minds and questioned journalists integrity for suggesting that the Chinese government could have put a backdoor chip gasp the size of a grain of rice on Supermicro motherboards?

wmf 5y ago
Everyone agrees that they could; the question is whether they did.
- monocasa 5y ago
  No, everyone did not agree with that. Phrases like "against the laws of physics" were being thrown around. And for nearly every other computer security issue, simply the presence of the possibility is enough to take action.
- dragontamer 5y ago
  This. Those Bloomberg reporters showing pictures of lol capacitors did them no favors. We know the difference between processors and capacitors around here. ------- The picture in this article is actually plausible. It's not just a capacitor that is getting hyped up by ignorant reporters.
  - monocasa 5y ago
    The picture in the Bloomberg article was obviously thrown together by some graphic designer because they didn't have actual pictures, and modern journalism wants many forms of media for a front page article. That doesn't take away from the claims the article made.
  - danellis 5y ago
    > We know the difference between processors and capacitors around here. Maybe for a two-legged device like a capacitor, but for something in, say, a SOT-23 package, you can't be sure what it is from the outside. Then again, maybe even something in a capacitor-like package could both communicate and be powered.
    - dragontamer 5y ago
      But Bloomberg didn't show an SOT-23 package. They showed something like an 0402 or maybe 0201 capacitor on the tip of a pencil. Could China be hacking motherboards and then shipping them to the USA? Maybe. I'm certain that they're trying to figure out a plan at least. But the Bloomberg article was fully bunk and just FUD from the start. And I think we all know how we'd hack Supermicro motherboards anyway: those BMCs are well known to be poorly updated, proprietary chips with full access to the keyboard / mouse / display of every single Supermicro motherboard ever made. One would _assume_ that a Supermicro motherboard hack would involve a BMC attack, if it were to exist at all. If there's news that some hacker is using some other means than the "obvious" BMC, it'd be news, but you gotta be really, really technical and explain just how it works... so that you know, it'd be useful to IT departments to know how to defend against? (Ex: put BMC on its own VLAN at least)
      - mike_d 5y ago
        It sounds like you are having difficulty drawing a distinction in your mind between the journalist who did the reporting on the story and the art department that had to come up with something that conveys "small chip" to an average reader without having actual photos. Most stories about COVID include inaccurate artistic renditions of the virus, but that does not discredit the reporting.
        dragontamer 5y ago
        There's a big difference between a physical hardware attack (that is fully unspecified and fully FUD), and an actual threat to IT departments (ex: insecure BMC that needs to be isolated into its own VLAN). The minute you start thinking about "how do I protect my company's computers from this attack?" is the minute the Bloomberg article falls apart. Asking for further details just resulted in Bloomberg clamming up and remaining silent on any additional details. Bloomberg has had multiple years at this point to provide the details needed to be useful to IT departments everywhere about their purported attack. At some point, we just gotta assume that they were making things up. ----- Lets say Bloomberg is correct about these hypothetical chips being placed into ill-specified motherboards. No attack is perfect: this is all computer equipment after all. It needs to be powered, it needs to have communications to the outside world, it needs to have spy-information (aka: taking information from the motherboard). Its unlikely that a small chip with low-power could interface with high-speed components (ie: RAM, PCIe, Southbridge, SATA), it wouldn't have enough power. Etc. etc. Whatever the hypothetical attack is, there would be physical requirements it needs to satisfy. All point back to the BMC: a low-bandwidth interface with huge amounts of information, with highly proprietary / likely insecure code running. So we think about how hardware could be used to hack this interface. At which point, we immediately enter the realm of ridiculousness, because BMCs are CPUs in their own rights and simply run software to do their job. For a "zero-hardware" attack, China could just be rewriting BMC firmware or something way, way, waaaaay easier than what was described in the Bloomberg article. Now China doesn't have to worry about replacing chips at all, and they still get all their spy-craft working. ------ But guess what? I think most IT departments are well aware of the proprietary and possibly insecure BMC interface. That's why there's a lot of discussions online about how to protect that interface.

by mike_d 5y ago

wmf 5y ago

Everyone agrees that they could; the question is whether they did.

monocasa 5y ago
No, everyone did not agree with that. Phrases like "against the laws of physics" were being thrown around. And for nearly every other computer security issue, simply the presence of the possibility is enough to take action.
dragontamer 5y ago
This. Those Bloomberg reporters showing pictures of lol capacitors did them no favors. We know the difference between processors and capacitors around here. ------- The picture in this article is actually plausible. It's not just a capacitor that is getting hyped up by ignorant reporters.
- monocasa 5y ago
  The picture in the Bloomberg article was obviously thrown together by some graphic designer because they didn't have actual pictures, and modern journalism wants many forms of media for a front page article. That doesn't take away from the claims the article made.
- danellis 5y ago
  > We know the difference between processors and capacitors around here. Maybe for a two-legged device like a capacitor, but for something in, say, a SOT-23 package, you can't be sure what it is from the outside. Then again, maybe even something in a capacitor-like package could both communicate and be powered.
  - dragontamer 5y ago
    But Bloomberg didn't show an SOT-23 package. They showed something like an 0402 or maybe 0201 capacitor on the tip of a pencil. Could China be hacking motherboards and then shipping them to the USA? Maybe. I'm certain that they're trying to figure out a plan at least. But the Bloomberg article was fully bunk and just FUD from the start. And I think we all know how we'd hack Supermicro motherboards anyway: those BMCs are well known to be poorly updated, proprietary chips with full access to the keyboard / mouse / display of every single Supermicro motherboard ever made. One would _assume_ that a Supermicro motherboard hack would involve a BMC attack, if it were to exist at all. If there's news that some hacker is using some other means than the "obvious" BMC, it'd be news, but you gotta be really, really technical and explain just how it works... so that you know, it'd be useful to IT departments to know how to defend against? (Ex: put BMC on its own VLAN at least)
    - mike_d 5y ago
      It sounds like you are having difficulty drawing a distinction in your mind between the journalist who did the reporting on the story and the art department that had to come up with something that conveys "small chip" to an average reader without having actual photos. Most stories about COVID include inaccurate artistic renditions of the virus, but that does not discredit the reporting.
      - dragontamer 5y ago
        There's a big difference between a physical hardware attack (that is fully unspecified and fully FUD), and an actual threat to IT departments (ex: insecure BMC that needs to be isolated into its own VLAN). The minute you start thinking about "how do I protect my company's computers from this attack?" is the minute the Bloomberg article falls apart. Asking for further details just resulted in Bloomberg clamming up and remaining silent on any additional details. Bloomberg has had multiple years at this point to provide the details needed to be useful to IT departments everywhere about their purported attack. At some point, we just gotta assume that they were making things up. ----- Lets say Bloomberg is correct about these hypothetical chips being placed into ill-specified motherboards. No attack is perfect: this is all computer equipment after all. It needs to be powered, it needs to have communications to the outside world, it needs to have spy-information (aka: taking information from the motherboard). Its unlikely that a small chip with low-power could interface with high-speed components (ie: RAM, PCIe, Southbridge, SATA), it wouldn't have enough power. Etc. etc. Whatever the hypothetical attack is, there would be physical requirements it needs to satisfy. All point back to the BMC: a low-bandwidth interface with huge amounts of information, with highly proprietary / likely insecure code running. So we think about how hardware could be used to hack this interface. At which point, we immediately enter the realm of ridiculousness, because BMCs are CPUs in their own rights and simply run software to do their job. For a "zero-hardware" attack, China could just be rewriting BMC firmware or something way, way, waaaaay easier than what was described in the Bloomberg article. Now China doesn't have to worry about replacing chips at all, and they still get all their spy-craft working. ------ But guess what? I think most IT departments are well aware of the proprietary and possibly insecure BMC interface. That's why there's a lot of discussions online about how to protect that interface.