3 ms·

This was also content in today's Money Stuff [0]. Middle section, "Super Micro". [0] https://www.bloomberg.com/opinion/articles/2024-10-30/florida-banned-some-

This was also content in today's Money Stuff [0]. Middle section, "Super Micro". [0] https://www.bloomberg.com/opinion/articles/2024-10-30/florida-banned-some-banks https://www.bloomberg.com/opinion/articles/2024-10-30/florid... or https://archive.is/SGhLe https://archive.is/SGhLe

Hilift 2y ago
Bloomberg was the source that claimed SuperMicro servers were compromised by a grain of rice sized chip that only had two conductor leads on it. https://www.theregister.com/2021/02/12/supermicro_bloomberg_spying/ https://www.theregister.com/2021/02/12/supermicro_bloomberg_...
- mikestew 2y ago
  …and most notably, never retracted the story.
- tivert 2y ago
  > Bloomberg was the source that claimed SuperMicro servers were compromised by a grain of rice sized chip that only had two conductor leads on it. In a similar vein, Bloomberg was the source that Continental and United passenger jets were humping mid-air: https://www.reddit.com/r/unitedairlines/comments/13xq64x/this_bloomberg_businessweek_cover_from_when/ https://www.reddit.com/r/unitedairlines/comments/13xq64x/thi.... ... You're talking about this cover, right? https://westoahu.hawaii.edu/cyber/vulnerability-research/did-china-secretly-install-microchips-to-spy-on-u-s-companies/ https://westoahu.hawaii.edu/cyber/vulnerability-research/did... I think you're making the mistake of confusing a cover image for a claim. If you have any experience with magazine cover images, you shouldn't take them that literally, because they're not meant to be.
  - rcxdude 2y ago
    Well, the biggest problem was that they basically had no details whatsoever in their report, and it was completely unverifiable.
    - Lammy 2y ago
      I always assumed they were talking about vulnerabilities slipped into BMC firmware or maybe into (counterfeit?) ASPEED BMC chips themselves. If there was one thing an attacker would want to pwn to pwn an entire server, it would be the BMC. Verifiable fact: SuperMicro BMC firmwares (really all BMC firmwares from all manufacturers) have and will continue to have exploits: https://www.supermicro.com/en/support/security_BMC_virtual_media https://www.supermicro.com/en/support/security_BMC_virtual_m... Verifiable fact: SuperMicro BMCs' default behavior is to expose itself on the LAN0 port if the dedicated BMC interface has no link: https://www.supermicro.com/manuals/other/IPMI_Users_Guide.pdf#page=65 https://www.supermicro.com/manuals/other/IPMI_Users_Guide.pd... It's really weird to me how desperate so many people are to shut down any mention of this story instead of adopting a “if it were true, what would it look like?”-and-hope-to-be-wrong approach.
      - rcxdude 2y ago
        The issue I have with it is that they make specific claims about a single manufacturer and certain of their customers, with no evidence to back up what specifically they think was done, and in fact the details they do give don't really make much sense. The general claim, that these sorts of attacks are possible, and likely do happen, is not really in dispute, and you can of course imagine all kinds of details that would fit with the vague claims that they make (though, this also tends to require making up extra hoops or just assuming they invented some of the details that they did give, like you've just done by assuming it's a firmware attack, when they specifically mention an extra chip), but that's not really the point. If they run a story about an attack, it should have some credibility about that specific attack beyond that it's the kind of thing that could happen. To use an analogy, it's much like running a story that Mrs Perkin's dog bit Mr Jones. It's not exactly something that in the abstract anyone would consider particularly unusual, but if they don't even tell you where such canine attack took place, or how they came to know about it, or indeed anything else, and Mrs Perkins and Mr Jones deny it happened, you might quite reasonably want more details before you believe that it did happen (or indeed, get any real value at all from the story, even if you believe it did, given that, again, the general concept that a dog might bite someone isn't particularly interesting or surprising).
  - echoangle 2y ago
    Also, I see 3, not 2 pins on that chip.

Hilift 2y ago

Bloomberg was the source that claimed SuperMicro servers were compromised by a grain of rice sized chip that only had two conductor leads on it. https://www.theregister.com/2021/02/12/supermicro_bloomberg_spying/ https://www.theregister.com/2021/02/12/supermicro_bloomberg_...

mikestew 2y ago
…and most notably, never retracted the story.
tivert 2y ago
> Bloomberg was the source that claimed SuperMicro servers were compromised by a grain of rice sized chip that only had two conductor leads on it. In a similar vein, Bloomberg was the source that Continental and United passenger jets were humping mid-air: https://www.reddit.com/r/unitedairlines/comments/13xq64x/this_bloomberg_businessweek_cover_from_when/ https://www.reddit.com/r/unitedairlines/comments/13xq64x/thi.... ... You're talking about this cover, right? https://westoahu.hawaii.edu/cyber/vulnerability-research/did-china-secretly-install-microchips-to-spy-on-u-s-companies/ https://westoahu.hawaii.edu/cyber/vulnerability-research/did... I think you're making the mistake of confusing a cover image for a claim. If you have any experience with magazine cover images, you shouldn't take them that literally, because they're not meant to be.
- rcxdude 2y ago
  Well, the biggest problem was that they basically had no details whatsoever in their report, and it was completely unverifiable.
  - Lammy 2y ago
    I always assumed they were talking about vulnerabilities slipped into BMC firmware or maybe into (counterfeit?) ASPEED BMC chips themselves. If there was one thing an attacker would want to pwn to pwn an entire server, it would be the BMC. Verifiable fact: SuperMicro BMC firmwares (really all BMC firmwares from all manufacturers) have and will continue to have exploits: https://www.supermicro.com/en/support/security_BMC_virtual_media https://www.supermicro.com/en/support/security_BMC_virtual_m... Verifiable fact: SuperMicro BMCs' default behavior is to expose itself on the LAN0 port if the dedicated BMC interface has no link: https://www.supermicro.com/manuals/other/IPMI_Users_Guide.pdf#page=65 https://www.supermicro.com/manuals/other/IPMI_Users_Guide.pd... It's really weird to me how desperate so many people are to shut down any mention of this story instead of adopting a “if it were true, what would it look like?”-and-hope-to-be-wrong approach.
    - rcxdude 2y ago
      The issue I have with it is that they make specific claims about a single manufacturer and certain of their customers, with no evidence to back up what specifically they think was done, and in fact the details they do give don't really make much sense. The general claim, that these sorts of attacks are possible, and likely do happen, is not really in dispute, and you can of course imagine all kinds of details that would fit with the vague claims that they make (though, this also tends to require making up extra hoops or just assuming they invented some of the details that they did give, like you've just done by assuming it's a firmware attack, when they specifically mention an extra chip), but that's not really the point. If they run a story about an attack, it should have some credibility about that specific attack beyond that it's the kind of thing that could happen. To use an analogy, it's much like running a story that Mrs Perkin's dog bit Mr Jones. It's not exactly something that in the abstract anyone would consider particularly unusual, but if they don't even tell you where such canine attack took place, or how they came to know about it, or indeed anything else, and Mrs Perkins and Mr Jones deny it happened, you might quite reasonably want more details before you believe that it did happen (or indeed, get any real value at all from the story, even if you believe it did, given that, again, the general concept that a dog might bite someone isn't particularly interesting or surprising).
- echoangle 2y ago
  Also, I see 3, not 2 pins on that chip.