3 ms·

Isn't the fear that they are imitation parts?

mxxx 5y ago
Yes, but they’re not. It was just a typo.
Am_I_Right 5y ago
I'm not entirely sure what the fear is. The AST2600 the sticker seems to have been pasted to is a pretty complicated IC with (and this is the important part) user-upgradeable flash to begin with. So, you want to do a supply-chain attack? Simply reflash the genuine modules. No need to spend more. On the other hand: you want to save a few bucks? Possibly do a knock-off chip, but you're definitely not going to bother with the firmware. Too expensive! This is definitely a case of "trying to save a few bucks". Both Dell and HPE are in a race to the bottom, and the sticker being indicative of anything significant beyond that is... unlikely...
NAR8789 5y ago
I think so, but assuming that is the case... what's to stop a shady chipmaker from printing properly-spelled "American Megatrends" stickers? More generally... are there any actual protections offered by genuine stickers? The article makes this out to be a major supply chain security issue, and that only makes sense if branding stickers are actually reliable for validation purposes. But that seems... nonsensical? Wouldn't stickers be very easy to forge? But, I don't work in supply chains. Anyone with better expertise in this area able to chime in? I will admit I skimmed the article, because it is long and overly-detailed for my level of interest, and because it lacks summary sections.
- jcrawfordor 5y ago
  It's not at all that a properly spelled sticker gives assurance that it's not counterfeit... it's just that a misspelled sticker is such an obvious sign of a potential counterfeit that it's basically the #1 thing that any counterfeit/suspect items program teaches people to look for. Most people working on counterfeits don't speak English so it's very easy for these kinds of mistakes to slip through, and on the other hand they're rarely made by the genuine manufacturer which usually has a process to check for this kind of thing even if the engineering work is done in a non-English speaking country (most of all that the logos usually come from off-the-shelf art files from the marketing department, so no one's even typing the name to make a mistake). Almost any corporate or institutional counterfeit or supply chain security program will explicitly teach you: if anything is misspelled or shows other obvious mistakes, hold the part as a suspected counterfeit. It's a pretty good quality indication. So of course manufacturers do genuinely make spelling mistakes sometimes, but this context makes it a pretty embarrassing and serious thing to do. It's like your bank misspelling their name in an account notification: sure, in some extremely theoretical sense it doesn't mean anything, but in practice they're giving you exactly the signal that everyone tells you to check for to identify phishing, and it raises questions about their processes that they let it slip through.

mxxx 5y ago

Yes, but they’re not. It was just a typo.

I'm not entirely sure what the fear is. The AST2600 the sticker seems to have been pasted to is a pretty complicated IC with (and this is the important part) user-upgradeable flash to begin with. So, you want to do a supply-chain attack? Simply reflash the genuine modules. No need to spend more. On the other hand: you want to save a few bucks? Possibly do a knock-off chip, but you're definitely not going to bother with the firmware. Too expensive! This is definitely a case of "trying to save a few bucks". Both Dell and HPE are in a race to the bottom, and the sticker being indicative of anything significant beyond that is... unlikely...

NAR8789 5y ago

I think so, but assuming that is the case... what's to stop a shady chipmaker from printing properly-spelled "American Megatrends" stickers? More generally... are there any actual protections offered by genuine stickers? The article makes this out to be a major supply chain security issue, and that only makes sense if branding stickers are actually reliable for validation purposes. But that seems... nonsensical? Wouldn't stickers be very easy to forge? But, I don't work in supply chains. Anyone with better expertise in this area able to chime in? I will admit I skimmed the article, because it is long and overly-detailed for my level of interest, and because it lacks summary sections.

jcrawfordor 5y ago
It's not at all that a properly spelled sticker gives assurance that it's not counterfeit... it's just that a misspelled sticker is such an obvious sign of a potential counterfeit that it's basically the #1 thing that any counterfeit/suspect items program teaches people to look for. Most people working on counterfeits don't speak English so it's very easy for these kinds of mistakes to slip through, and on the other hand they're rarely made by the genuine manufacturer which usually has a process to check for this kind of thing even if the engineering work is done in a non-English speaking country (most of all that the logos usually come from off-the-shelf art files from the marketing department, so no one's even typing the name to make a mistake). Almost any corporate or institutional counterfeit or supply chain security program will explicitly teach you: if anything is misspelled or shows other obvious mistakes, hold the part as a suspected counterfeit. It's a pretty good quality indication. So of course manufacturers do genuinely make spelling mistakes sometimes, but this context makes it a pretty embarrassing and serious thing to do. It's like your bank misspelling their name in an account notification: sure, in some extremely theoretical sense it doesn't mean anything, but in practice they're giving you exactly the signal that everyone tells you to check for to identify phishing, and it raises questions about their processes that they let it slip through.