5 ms·
Given that this looks to be just a particular build of Supermicro server, I wonder what mechanism the malware uses to achieve persistence such that a reformat o
by nickdothutton 3y ago
Given that this looks to be just a particular build of Supermicro server, I wonder what mechanism the malware uses to achieve persistence such that a reformat or FS restore wouldn’t take care of it. Does anyone know if these devices have supermicro IPMIs on them? Those are notoriously insecure (like most lights out managers) and a great place to hide malware persistently.
Edit: Typo.
- rvba 3y agoIs this the same super micro that hadd physical backdoors inplemeted by china? https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies#xj4y7vzkg https://www.bloomberg.com/news/features/2018-10-04/the-big-h...
- ocdtrekkie 3y agoYes except that article has remained wholly unsubstantiated by facts for five years. It seems to have been bunk.
- greggsy 3y agoThat article captured the imagination of the public, but has been derided by any and every cyber security professional worth their salt almost from day dot. Despite this, Bloomberg have refused to retract it or supply any credible sources, presumably because and continues to draw traffic.
- technion 3y agoAnd yet "do we have any backdoored supermicro hardware" is a common question from non technical management, even today. It's infuriating that it hasn't been retracted as I'm still talking about it. It's also at the forefront of insurance questions
- RealityVoid 3y agoJust goes to show how much of this word is theater rather than pragmatic improvement.
- hypothesis 3y agoGiven that outsize influence, you would think they would sue Bloomberg… I guess they don’t really care…
- rvba 3y agoCan this be interpreted as "they dont sue because they can lose - the article is true"?
- ransackdev 3y agoEasily solved by said security professionals auditing the security of the devices, refuting the claims in the Bloomberg article, and throwing it all up on a blog with catchy “No, china didn’t backdoor servers headed to US gov datacenter racks” title.
- blitzar 3y agoIt would get awkward when they find the US backoor built in to every server headed everywhere ... I guess technically outside the scope of the headline so you can just leave it out.
- ransackdev 3y agoThe point is, if the original article is bogus and full of lies it should be trivial for the security community to debunk any back door claims and set the record straight, yet that isn’t being done while still calling for the original article lacking any proof be taken down. Someone on one of these sides needs to provide evidence to support their claims. Clearly the authors of the original article have no intention or it would have been done already.
- greggsy 3y agoThey haven’t taken it down because it continues to draw in traffic. It’s trivial to debunk because the story was a hack job with no sources to begin with: the burden on proof is on the accuser in this case.
- greggsy 3y agoYou’re describing every follow-up podcast on the matter.
- technion 3y agoWrite ups reviewing the malware never suggested such persistence. This seems to be something done out of caution rather than a specific finding.
- greggsy 3y agoThe writeups I’m reading suggest that the malware was specifically designed to maintain persistence via firmware (i.e. rootkits), typically attributable to state actors.
- kotaKat 3y agoThey're not all Supermicro servers. Some are other mobo vendors, I've seen some ESG 400s with MSI boards in them.
- greggsy 3y agoIf your IPMI is in any way exposed to anyone other than your administrators, then you have other problems. These interfaces should be segmented away from all other networks, irrespective of any vulnerabilities they could have.
- jwiz 3y agoSome supermicro will default to put IPMI on the shared primary nic if the dedicated IPMI nic has no link at poweron.
- SoftTalker 3y agoSome? Every one that I’ve ever worked with, which is several hundred.
- KennyBlanken 3y agoand why would IPMI port ranges and IP addresses be accessible outside of the DMZ, if you're an even half competent sysadmin?
- c00lio 3y agoIf you are halfway competent, you do not use inband IPMI at all. IPMI belongs on a separate ethernet jack or at least a separate VLAN, connected only to a separate secured admin network. Which sysadmins can connect to, but which doesn't have connectivity to other parts of your network or the internet. But I agree that you should filter all the relevant ports in all networks, just in case somebody screws up.
- dicknuckle 3y agoThat's great and all, but if there was a known barracuda OS vuln that allowed attackers to gain root access, then they could gather information about the hardware, which includes the ability to interact with the IPMI (which runs it's own separate OS) to update the firmware or whichever way they're able gain persistent access to the IPMI device's OS.
- Animats 3y agoThis points out a major issue with IPMI and "management engine" components on motherboards. If a vulnerability is found at the lower levels, you may have to replace the hardware. Vendors may be more reluctant to put that stuff in if it leads to legal liability.
- KennyBlanken 3y agoIPMI firmware can be patched, as can the BIOS which contains the microcode that is loaded. Once the OS boots, updating the running microcode included is trivial (in Linux and I believe also FreeBSD?) and can be done before the system's network interfaces come up.
- Animats 3y agoYou can't patch the management engine without the cooperation of the management engine itself, right?
- wolfwyrd 3y agoShouldn’t[0] be able to. It’s all still fallible software written by humans. [0] https://www.theregister.com/AMP/2022/06/02/conti_rasomware_intel_firmware/ https://www.theregister.com/AMP/2022/06/02/conti_rasomware_i...