5 ms·

And yet people loudly denounced Bloomberg for "The Big Hack" story every time it came up on HN: https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-

by Lammy 5y ago

And yet people loudly denounced Bloomberg for "The Big Hack" story every time it came up on HN: https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies https://www.bloomberg.com/news/features/2018-10-04/the-big-h... I believed it then, and I still believe it now. An "evil" BMC (like the ASPEED AST2600 mentioned in this article) is game over security-wise. BMCs are capable of flashing the BIOS/UEFI, capable of inserting arbitrary disk images as virtual CD/etc drives, capable of arbitrary keyboard/mouse input equivalent to having a hardware keyboard/mouse attached, like a remote evil-maid. If you had to pick one single thing to "pwn" in a server it would be the BMC. There's no way it's just a typo.

wmf 5y ago
It's obvious that an evil BMC would be game over because the BMC is the most trusted component in the system (for normal servers that don't have Titan or whatever). But there's no evidence of compromised BMCs actually happening.
- Lammy 5y ago
  Is there evidence of it not happening? Can I do a reproducible build of a verified AMI BMC firmware and compare it against what comes flashed on my motherboard? They have a "MegaRAC Open Edition" but it says it's only for "OCP compliant platforms": https://github.com/opencomputeproject/HWMgmt-MegaRAC-OpenEdition https://github.com/opencomputeproject/HWMgmt-MegaRAC-OpenEdi...
  - wmf 5y ago
    Honestly the industry is a decade away from meeting that standard. And given that AMI is the lowest bidder we shouldn't even expect them to meet current best practices.
rcxdude 5y ago
It's very believable, but that's basically all that the bloomberg story had going for it. None of the actual concrete details (of which there were few) made any sense.
rp1 5y ago
This exploit was found within a year of Bloomberg's article being published: https://www.wired.com/story/supermicro-bug-virtual-usb/ https://www.wired.com/story/supermicro-bug-virtual-usb/ Whether or not that was the exploit being referred to by Bloomberg is unknown, but suspicious.
- detaro 5y ago
  I'm curious how you fit a bug in firmware to the Bloomberg story of additional components being added to boards?
  - chithanh 5y ago
    As the source of the report and the communication between them and Bloomberg remains undisclosed, we can only speculate. Perhaps there was a Chinese whispers (no pun intended) style miscommunication and while the original source meant "software component", it became "hardware component" somewhere along. Or the attack was actually developed as proof-of-concept but never applied in the wild. The attack is feasible as other security researchers have shown: https://media.ccc.de/v/35c3-9597-modchips_of_the_state https://media.ccc.de/v/35c3-9597-modchips_of_the_state
    - detaro 5y ago
      Yeah, but after Bloombergs repeated insistence that they got it right and stand behind their reporting I'm really only willing to give them credit it something that actually matches what they claimed gets revealed. Because "BMCs are vulnerable" is not a big story, they don't get to claim that as evidence for their wild claims.
alliao 5y ago
whatever became of it? I thought at the time security experts would swarm and dissect it to death to give us articles after articles of concrete tampering examples... but it just vanished?
- fckgw 5y ago
  Security researchers did swarm on it and none of them could corroborate the story. It's been widely discredited in security researcher circles.
  - jandrese 5y ago
    If it was an attack that one guy was specifically being attacked.
  - rp1 5y ago
    This exploit was found after the article was published: https://www.wired.com/story/supermicro-bug-virtual-usb/ https://www.wired.com/story/supermicro-bug-virtual-usb/
    - paulryanrogers 5y ago
      That is an unintended vulnerability which can be exploited. While also bad it's not evidence of a malicious hardware installed before leaving the factory.
- dogecoinbase 5y ago
  No one has ever found or been shown one of the affected boards.
  - Lammy 5y ago
    When it's a plausible attack against an obviously-critical component it seems most prudent to assume the worst and hope to be wrong :)
    - 5y ago
detaro 5y ago
Bloomberg didn't just claim "evil" BMC, but very specific things that nobody ever could confirm, and Bloomberg never supplied any evidence about. If the Bloomberg reporting, or any followup, had been anywhere close to e.g. the reporting in this blog post in detail, then they would have a believable case.
- hef19898 5y ago
  Nah, thing is everyone jumped on Bloomberg for a "shitty" story back then Now all we have is one blog post and some typos and the majority opinion is ether bad quality control / sloppy organization / indicator of systematic issues or b) potential supply chain attack. Which doesn't make a lot of sense.
  - detaro 5y ago
    Of course it makes sense to treat reporting that claims a thing and provides evidence of the thing differently from reporting that claims something less likely without providing any evidence.
InfiniteRand 5y ago
Worth noting that the original post mentioned the Bloomberg story and if you click through to the blog post related to that, the post’s author found Bloomberg’s focus on Supermicro irresponsible even though the general issue is a problem. I myself don’t have much of an opinion on this

by Lammy 5y ago

wmf 5y ago

It's obvious that an evil BMC would be game over because the BMC is the most trusted component in the system (for normal servers that don't have Titan or whatever). But there's no evidence of compromised BMCs actually happening.

Lammy 5y ago
Is there evidence of it not happening? Can I do a reproducible build of a verified AMI BMC firmware and compare it against what comes flashed on my motherboard? They have a "MegaRAC Open Edition" but it says it's only for "OCP compliant platforms": https://github.com/opencomputeproject/HWMgmt-MegaRAC-OpenEdition https://github.com/opencomputeproject/HWMgmt-MegaRAC-OpenEdi...
- wmf 5y ago
  Honestly the industry is a decade away from meeting that standard. And given that AMI is the lowest bidder we shouldn't even expect them to meet current best practices.

rcxdude 5y ago

It's very believable, but that's basically all that the bloomberg story had going for it. None of the actual concrete details (of which there were few) made any sense.

rp1 5y ago

This exploit was found within a year of Bloomberg's article being published: https://www.wired.com/story/supermicro-bug-virtual-usb/ https://www.wired.com/story/supermicro-bug-virtual-usb/ Whether or not that was the exploit being referred to by Bloomberg is unknown, but suspicious.

detaro 5y ago
I'm curious how you fit a bug in firmware to the Bloomberg story of additional components being added to boards?
- chithanh 5y ago
  As the source of the report and the communication between them and Bloomberg remains undisclosed, we can only speculate. Perhaps there was a Chinese whispers (no pun intended) style miscommunication and while the original source meant "software component", it became "hardware component" somewhere along. Or the attack was actually developed as proof-of-concept but never applied in the wild. The attack is feasible as other security researchers have shown: https://media.ccc.de/v/35c3-9597-modchips_of_the_state https://media.ccc.de/v/35c3-9597-modchips_of_the_state
  - detaro 5y ago
    Yeah, but after Bloombergs repeated insistence that they got it right and stand behind their reporting I'm really only willing to give them credit it something that actually matches what they claimed gets revealed. Because "BMCs are vulnerable" is not a big story, they don't get to claim that as evidence for their wild claims.

alliao 5y ago

whatever became of it? I thought at the time security experts would swarm and dissect it to death to give us articles after articles of concrete tampering examples... but it just vanished?

fckgw 5y ago
Security researchers did swarm on it and none of them could corroborate the story. It's been widely discredited in security researcher circles.
- jandrese 5y ago
  If it was an attack that one guy was specifically being attacked.
- rp1 5y ago
  This exploit was found after the article was published: https://www.wired.com/story/supermicro-bug-virtual-usb/ https://www.wired.com/story/supermicro-bug-virtual-usb/
  - paulryanrogers 5y ago
    That is an unintended vulnerability which can be exploited. While also bad it's not evidence of a malicious hardware installed before leaving the factory.
dogecoinbase 5y ago
No one has ever found or been shown one of the affected boards.
- Lammy 5y ago
  When it's a plausible attack against an obviously-critical component it seems most prudent to assume the worst and hope to be wrong :)
  - 5y ago

detaro 5y ago

Bloomberg didn't just claim "evil" BMC, but very specific things that nobody ever could confirm, and Bloomberg never supplied any evidence about. If the Bloomberg reporting, or any followup, had been anywhere close to e.g. the reporting in this blog post in detail, then they would have a believable case.

hef19898 5y ago
Nah, thing is everyone jumped on Bloomberg for a "shitty" story back then Now all we have is one blog post and some typos and the majority opinion is ether bad quality control / sloppy organization / indicator of systematic issues or b) potential supply chain attack. Which doesn't make a lot of sense.
- detaro 5y ago
  Of course it makes sense to treat reporting that claims a thing and provides evidence of the thing differently from reporting that claims something less likely without providing any evidence.

InfiniteRand 5y ago

Worth noting that the original post mentioned the Bloomberg story and if you click through to the blog post related to that, the post’s author found Bloomberg’s focus on Supermicro irresponsible even though the general issue is a problem. I myself don’t have much of an opinion on this