3 ms·

That was such an incredibly ridiculous story. I spoke with more than a few supposed infosec "professionals" who believed it entirely too. Never mind that there

That was such an incredibly ridiculous story. I spoke with more than a few supposed infosec "professionals" who believed it entirely too. Never mind that there were zero reports from other journals (you know, like anything even slightly technical), that none of the cited sources would reiterate what they had supposedly said, or that the claimed mode of operation wasn't even possible. Their follow-up, despite having been disproven numerous times over, was even more ridiculous.

toast0 3y ago
If I'm assuming everyone involved had good intentions, the best thing I can guess is someone was speaking to the writer about the potential of the BMC being used for spying and got some details mixed up. Consider: the BMC has access to the system via PCI-e, as well as kvm and comport. In some systems, the BMC is in the path of the main NIC. There have been some major software flaws in BMC software, including revisions that SuperMicro shipped, where passwords could be bypassed in the network interface. Stuff like this https://web.archive.org/web/20140625065505/http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/ https://web.archive.org/web/20140625065505/http://blog.cari.... and other things on this page http://fish2.com/ipmi/ http://fish2.com/ipmi/ are all pretty nasty if you thought IPMI was secure in the neighborhood of 2014.
- WarOnPrivacy 3y ago
  > If I'm assuming everyone involved had good intentions, the best thing I can guess is someone was speaking to the writer about the potential of the BMC being used for spying and got some details mixed up. I can't judge their intentions. But Bloomberg doubling down on the story in 2021 strongly discounts the possibility that the original reporting was based on any kind of bad info. ref: https://www.datacenterdynamics.com/en/news/years-later-bloomberg-doubles-down-disputed-supermicro-supply-chain-hack-story/ https://www.datacenterdynamics.com/en/news/years-later-bloom... Three years is a long time to believe in bad data, with everyone everywhere pointing out the same issues with their story.
  - toast0 3y ago
    > “This wasn’t a case of a guy stealing a board and soldering a chip on in his hotel room; it was architected onto the final device,” he said, declining to reveal which company he worked for at the time. Still kind of reads like someone told us there was a bad chip on the motherboard. And there was, and it was the BMC/firmware for the BMC. Did SuperMicro (or their suppliers) just write shitty firmware with zero security for their BMCs because that was the industry standard, or was it a Chinese Ministry of State Security plant who did it as part of an evil plot? Did big companies pull out of SuperMicro because of poor BMC security? Sometimes, a bit, often as just one more checkbox on the way to OCP style defluffed machines; in an early revision of OCP, rather than a BMC, the NIC's wake on lan signal was rerouted to reset, to become reboot on lan. But then OpenBMC happened, cause reboot on lan isn't enough for everyone.
  - zettabomb 3y ago
    >But Bloomberg doubling down on the story in 2021 strongly discounts the possibility that the original reporting was based on any kind of bad info. How so? If there was an ulterior motive (I don't know if there was, but it's been suggested) then they'd also double down. They also didn't even attempt to respond to the issues. If they had good information based in reality, a lot of the claims would've been trivial to refute.

toast0 3y ago

If I'm assuming everyone involved had good intentions, the best thing I can guess is someone was speaking to the writer about the potential of the BMC being used for spying and got some details mixed up. Consider: the BMC has access to the system via PCI-e, as well as kvm and comport. In some systems, the BMC is in the path of the main NIC. There have been some major software flaws in BMC software, including revisions that SuperMicro shipped, where passwords could be bypassed in the network interface. Stuff like this https://web.archive.org/web/20140625065505/http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/ https://web.archive.org/web/20140625065505/http://blog.cari.... and other things on this page http://fish2.com/ipmi/ http://fish2.com/ipmi/ are all pretty nasty if you thought IPMI was secure in the neighborhood of 2014.

WarOnPrivacy 3y ago
> If I'm assuming everyone involved had good intentions, the best thing I can guess is someone was speaking to the writer about the potential of the BMC being used for spying and got some details mixed up. I can't judge their intentions. But Bloomberg doubling down on the story in 2021 strongly discounts the possibility that the original reporting was based on any kind of bad info. ref: https://www.datacenterdynamics.com/en/news/years-later-bloomberg-doubles-down-disputed-supermicro-supply-chain-hack-story/ https://www.datacenterdynamics.com/en/news/years-later-bloom... Three years is a long time to believe in bad data, with everyone everywhere pointing out the same issues with their story.
- toast0 3y ago
  > “This wasn’t a case of a guy stealing a board and soldering a chip on in his hotel room; it was architected onto the final device,” he said, declining to reveal which company he worked for at the time. Still kind of reads like someone told us there was a bad chip on the motherboard. And there was, and it was the BMC/firmware for the BMC. Did SuperMicro (or their suppliers) just write shitty firmware with zero security for their BMCs because that was the industry standard, or was it a Chinese Ministry of State Security plant who did it as part of an evil plot? Did big companies pull out of SuperMicro because of poor BMC security? Sometimes, a bit, often as just one more checkbox on the way to OCP style defluffed machines; in an early revision of OCP, rather than a BMC, the NIC's wake on lan signal was rerouted to reset, to become reboot on lan. But then OpenBMC happened, cause reboot on lan isn't enough for everyone.
- zettabomb 3y ago
  >But Bloomberg doubling down on the story in 2021 strongly discounts the possibility that the original reporting was based on any kind of bad info. How so? If there was an ulterior motive (I don't know if there was, but it's been suggested) then they'd also double down. They also didn't even attempt to respond to the issues. If they had good information based in reality, a lot of the claims would've been trivial to refute.