6 ms·

Oof. SuperMicro also had it's hardware supply chain compromised back in the 2010s [0][1][2][3] [0] - https://www.bloomberg.com/news/features/2018-10-04/the-big

Oof. SuperMicro also had it's hardware supply chain compromised back in the 2010s [0][1][2][3] [0] - https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies https://www.bloomberg.com/news/features/2018-10-04/the-big-h... [1] - https://www.bloomberg.com/features/2021-supermicro/ https://www.bloomberg.com/features/2021-supermicro/ [2] - https://www.schneier.com/blog/archives/2021/02/chinese-supply-chain-attack-on-computer-systems.html https://www.schneier.com/blog/archives/2021/02/chinese-suppl... [3] - https://www.theinformation.com/articles/apple-severed-ties-with-server-supplier-after-security-concern https://www.theinformation.com/articles/apple-severed-ties-w...

progbits 7mo ago
Those claims were never confirmed, no? Some of it might be true or trueish but I'm not talking Bloomberg's anonymous sources word for it, and with so much supermicro gear out there you would think some other evidence would show up.
- alephnerd 7mo ago
  A supply chain attack similar to Supermicro's would be much more targeted and recalls with national security implications do get flagged via a separate chain.
- protimewaster 7mo ago
  It depends on what you consider confirmed. It was kind of corroborated, at least. There was a CEO of a hardware security firm that came forward after the original article. He claimed that his firm had actually found a hardware implant on a board during a security audit. It wasn't exactly as Bloomberg described, though. His take was that it was very unlikely that it impacted exclusively Supermicro, though. It was covered various places, including The Register https://www.theregister.com/2018/10/09/bloomberg_super_micro_china_spy_chip_scandal/ https://www.theregister.com/2018/10/09/bloomberg_super_micro...
  - kantselovich 7mo ago
    I don't think it was a confirmed story. That is, the tiny "grain of rice" size Ethernet module that CEO of a security audit company allegedly found, was not present in other SuperMicro servers. SuperMicro itself, as well as it's buggest customers did not confirm the findings. From what i recall, the story was very vague, there were no pictures of the specific chip, no pictures of the motherboard of the motherboard that would include serial, i.e. no details that would accompany a serious security research.
    - monocasa 7mo ago
      Did they originally say it was a grain of rice Ethernet module? I thought it was supposed to be an incredibly tiny micro sitting on the bmc's boot flash to break inject vulnerabilities.
      - kantselovich 7mo ago
        I recall, at the time Bloomberg and their source were taking about tiny chip on the bmc that was masking as a resistor. However they did not produce any concrete evidence, citing NDA between that security company and their client.
      - BobbyTables2 7mo ago
        Even that makes little sense. A malicious modification to the flash content would leave no physical evidence…
    - CamperBob2 7mo ago
      The only photo I saw of the "hidden Ethernet module" was a ceramic RF filter or diplexer, basically a passive $2 part that does nothing on its own, and that would have stuck out like a sore thumb if actually installed in the area where it was depicted. Just a random surface-mount component that someone pulled off another board or found on the floor behind a workbench. Allegedly.
throwa356262 7mo ago
Didn't that turn out to be incorrect? Multiple security companies looked into this and found nothing malicious.
- alephnerd 7mo ago
  Nope. Bloomberg doubled down on it and even Bruce Schneider accepted it despite initially being a skeptic.
  - tumult 7mo ago
    No evidence was ever presented and nobody ever found anything, as far as I can tell?
    - protimewaster 7mo ago
      There was a security auditing firm that came out a few days later claiming they'd found a chip, similar to the one Bloomberg described, during a security audit. It's still nothing concrete, though. Their CEO basically said that they'd found one and that they couldn't say much more about it due to an NDA.
      - BobbyTables2 7mo ago
        Reminds me of how movies portray someone pretending to be a secret agent… “Can’t give any more details - it’s hush hush !”
  - protimewaster 7mo ago
    There also was a CEO of a hardware security company that came out and said that his firm had found an implanted chip during an audit. IIRC, he was convinced that it was very unlikely to be limited to Supermicro hardware.
    - alephnerd 7mo ago
      > he was convinced that it was very unlikely to be limited to Supermicro hardware Yep. This was why there was a significant movement around mandating Hardware BOMs in both US and EU procurement in the early 2020s. Also, the time period that the Bloomberg story took place was the late 2000s and early 2010s, when hardware supply chain security was much less mature.
frenchtoast8 7mo ago
Bloomberg's claims sound like science fiction: https://www.servethehome.com/investigating-implausible-bloomberg-supermicro-stories/ https://www.servethehome.com/investigating-implausible-bloom... Bloomberg's tech coverage is not great from what I've seen. Last year they published a video which was intended to investigate GPUs being smuggled into China, but they couldn't get access to a data center so they basically said we don't know if it's true or not. Meanwhile an independent Youtuber with a fraction of the resources actually met and filmed the smugglers and the middlemen brokering the sales between them and the data centers. Bloomberg responded by filing a DMCA takedown of that video.
- timschmidt 7mo ago
  What Bloomberg proposed - sniffing the TTL signal between BMC and boot ROM and flipping a few bits in transit - is far from science fiction. It would be easy to implement in the smallest of microcontrollers using just a few lines of code: a ring buffer to store the last N bits observed, and a trigger for output upon observing the desired bits. 256 bytes of ROM/SRAM would probably be plenty. Appropriately tiny microcontrollers can also power themselves parasitically from the signal voltage as https://en.wikipedia.org/wiki/1-Wire https://en.wikipedia.org/wiki/1-Wire chips do. SMBus is clocked from 10khz to 1mhz, assuming that's what the ROM was hanging off of, which is comfortably within the nyquist limit on an 8 - 20mhz micro. Something similar has been done in many video game console mod chips. IIRC, some of the mod chips manage it on an encrypted bus (which Bloomberg's claims do not require). Here's one example of a mod chip for the PS1 which sniffs and modifies BIOS code in transit: https://github.com/kalymos/PsNee https://github.com/kalymos/PsNee "On PsNee, there are two separate mechanisms. One is the classic PS1 trick of watching the subchannel/Q data stream and injecting the SCEx symbols only when the drive is at the right place; the firmware literally tracks the read pattern with a hysteresis counter and then injects the authentication symbols on the fly. You can see the logic that watches the sector/subchannel pattern and then fires inject_SCEX(...) when the trigger condition is met. PsNee also includes an optional PSone PAL BIOS patch mode which tells the installer to connect to the BIOS chip’s A18 and D2 pins, then waits for a specific A18 activity pattern and briefly drives D2 low for a few microseconds before releasing it back to high-impedance. That is not replacing the BIOS; it is timing a very short intervention onto the ROM data bus during fetch."
fidotron 7mo ago
From thousands of miles away you can hear the fans at the NSA data center as they spin up checking the background to all responses to this posting.
- nebula8804 7mo ago
  I'd like to think that modern centers are water cooled so it'd be more quiet these days unless you are implying that this application of theirs is running on legacy hardware? :P
  - jacquesm 7mo ago
    I have it on good authority they only use SuperMicro ;)

progbits 7mo ago

Those claims were never confirmed, no? Some of it might be true or trueish but I'm not talking Bloomberg's anonymous sources word for it, and with so much supermicro gear out there you would think some other evidence would show up.

alephnerd 7mo ago
A supply chain attack similar to Supermicro's would be much more targeted and recalls with national security implications do get flagged via a separate chain.
protimewaster 7mo ago
It depends on what you consider confirmed. It was kind of corroborated, at least. There was a CEO of a hardware security firm that came forward after the original article. He claimed that his firm had actually found a hardware implant on a board during a security audit. It wasn't exactly as Bloomberg described, though. His take was that it was very unlikely that it impacted exclusively Supermicro, though. It was covered various places, including The Register https://www.theregister.com/2018/10/09/bloomberg_super_micro_china_spy_chip_scandal/ https://www.theregister.com/2018/10/09/bloomberg_super_micro...
- kantselovich 7mo ago
  I don't think it was a confirmed story. That is, the tiny "grain of rice" size Ethernet module that CEO of a security audit company allegedly found, was not present in other SuperMicro servers. SuperMicro itself, as well as it's buggest customers did not confirm the findings. From what i recall, the story was very vague, there were no pictures of the specific chip, no pictures of the motherboard of the motherboard that would include serial, i.e. no details that would accompany a serious security research.
  - monocasa 7mo ago
    Did they originally say it was a grain of rice Ethernet module? I thought it was supposed to be an incredibly tiny micro sitting on the bmc's boot flash to break inject vulnerabilities.
    - kantselovich 7mo ago
      I recall, at the time Bloomberg and their source were taking about tiny chip on the bmc that was masking as a resistor. However they did not produce any concrete evidence, citing NDA between that security company and their client.
    - BobbyTables2 7mo ago
      Even that makes little sense. A malicious modification to the flash content would leave no physical evidence…
  - CamperBob2 7mo ago
    The only photo I saw of the "hidden Ethernet module" was a ceramic RF filter or diplexer, basically a passive $2 part that does nothing on its own, and that would have stuck out like a sore thumb if actually installed in the area where it was depicted. Just a random surface-mount component that someone pulled off another board or found on the floor behind a workbench. Allegedly.

throwa356262 7mo ago

Didn't that turn out to be incorrect? Multiple security companies looked into this and found nothing malicious.

alephnerd 7mo ago
Nope. Bloomberg doubled down on it and even Bruce Schneider accepted it despite initially being a skeptic.
- tumult 7mo ago
  No evidence was ever presented and nobody ever found anything, as far as I can tell?
  - protimewaster 7mo ago
    There was a security auditing firm that came out a few days later claiming they'd found a chip, similar to the one Bloomberg described, during a security audit. It's still nothing concrete, though. Their CEO basically said that they'd found one and that they couldn't say much more about it due to an NDA.
    - BobbyTables2 7mo ago
      Reminds me of how movies portray someone pretending to be a secret agent… “Can’t give any more details - it’s hush hush !”
- protimewaster 7mo ago
  There also was a CEO of a hardware security company that came out and said that his firm had found an implanted chip during an audit. IIRC, he was convinced that it was very unlikely to be limited to Supermicro hardware.
  - alephnerd 7mo ago
    > he was convinced that it was very unlikely to be limited to Supermicro hardware Yep. This was why there was a significant movement around mandating Hardware BOMs in both US and EU procurement in the early 2020s. Also, the time period that the Bloomberg story took place was the late 2000s and early 2010s, when hardware supply chain security was much less mature.

frenchtoast8 7mo ago

Bloomberg's claims sound like science fiction: https://www.servethehome.com/investigating-implausible-bloomberg-supermicro-stories/ https://www.servethehome.com/investigating-implausible-bloom... Bloomberg's tech coverage is not great from what I've seen. Last year they published a video which was intended to investigate GPUs being smuggled into China, but they couldn't get access to a data center so they basically said we don't know if it's true or not. Meanwhile an independent Youtuber with a fraction of the resources actually met and filmed the smugglers and the middlemen brokering the sales between them and the data centers. Bloomberg responded by filing a DMCA takedown of that video.

timschmidt 7mo ago
What Bloomberg proposed - sniffing the TTL signal between BMC and boot ROM and flipping a few bits in transit - is far from science fiction. It would be easy to implement in the smallest of microcontrollers using just a few lines of code: a ring buffer to store the last N bits observed, and a trigger for output upon observing the desired bits. 256 bytes of ROM/SRAM would probably be plenty. Appropriately tiny microcontrollers can also power themselves parasitically from the signal voltage as https://en.wikipedia.org/wiki/1-Wire https://en.wikipedia.org/wiki/1-Wire chips do. SMBus is clocked from 10khz to 1mhz, assuming that's what the ROM was hanging off of, which is comfortably within the nyquist limit on an 8 - 20mhz micro. Something similar has been done in many video game console mod chips. IIRC, some of the mod chips manage it on an encrypted bus (which Bloomberg's claims do not require). Here's one example of a mod chip for the PS1 which sniffs and modifies BIOS code in transit: https://github.com/kalymos/PsNee https://github.com/kalymos/PsNee "On PsNee, there are two separate mechanisms. One is the classic PS1 trick of watching the subchannel/Q data stream and injecting the SCEx symbols only when the drive is at the right place; the firmware literally tracks the read pattern with a hysteresis counter and then injects the authentication symbols on the fly. You can see the logic that watches the sector/subchannel pattern and then fires inject_SCEX(...) when the trigger condition is met. PsNee also includes an optional PSone PAL BIOS patch mode which tells the installer to connect to the BIOS chip’s A18 and D2 pins, then waits for a specific A18 activity pattern and briefly drives D2 low for a few microseconds before releasing it back to high-impedance. That is not replacing the BIOS; it is timing a very short intervention onto the ROM data bus during fetch."

fidotron 7mo ago

From thousands of miles away you can hear the fans at the NSA data center as they spin up checking the background to all responses to this posting.

nebula8804 7mo ago
I'd like to think that modern centers are water cooled so it'd be more quiet these days unless you are implying that this application of theirs is running on legacy hardware? :P
- jacquesm 7mo ago
  I have it on good authority they only use SuperMicro ;)