4 ms·

Didn't that turn out to be incorrect? Multiple security companies looked into this and found nothing malicious.

by throwa356262 7mo ago

alephnerd 7mo ago
Nope. Bloomberg doubled down on it and even Bruce Schneider accepted it despite initially being a skeptic.
- tumult 7mo ago
  No evidence was ever presented and nobody ever found anything, as far as I can tell?
  - protimewaster 7mo ago
    There was a security auditing firm that came out a few days later claiming they'd found a chip, similar to the one Bloomberg described, during a security audit. It's still nothing concrete, though. Their CEO basically said that they'd found one and that they couldn't say much more about it due to an NDA.
    - BobbyTables2 7mo ago
      Reminds me of how movies portray someone pretending to be a secret agent… “Can’t give any more details - it’s hush hush !”
- protimewaster 7mo ago
  There also was a CEO of a hardware security company that came out and said that his firm had found an implanted chip during an audit. IIRC, he was convinced that it was very unlikely to be limited to Supermicro hardware.
  - alephnerd 7mo ago
    > he was convinced that it was very unlikely to be limited to Supermicro hardware Yep. This was why there was a significant movement around mandating Hardware BOMs in both US and EU procurement in the early 2020s. Also, the time period that the Bloomberg story took place was the late 2000s and early 2010s, when hardware supply chain security was much less mature.
  - BobbyTables2 7mo ago
    I wonder what impact that kind of publicity had on their firms’ business… I’m sure a brief glance at his shares and the company’s share price was enough to convince him that the “problem” was unlikely to be limited to just SuperMicro. Amazing coincidence that his company could help others find out if they were impacted!
- unsnap_biceps 7mo ago
  I don't believe that there was ever extra chips being added to the boards, but what I could believe is that they shipped with firmware on specific chips that enabled data exfiltration for specific customers and due to a game of telephone with non technical people it turned into "they're adding chips inside the pcb layers!"
  - monocasa 7mo ago
    I thought the point was an extra chip in the place of a pull up resistor or something that would edit the firmware image as it made its way across the bus, so you wouldn't see the modifications even if you pulled the flash chip and read it out manually, and would also be persistent across flash updates.
- greedo 7mo ago
  Schneier was simply taking at face value the contents of the Bloomberg article, especially the statement by Mike Quinn who claimed he was told by the Air Force not to include any Supermicro gear in a bid.
- WillPostForFood 7mo ago
  What was the last thing Schneier wrote on it? I thought it was this: I don’t think it’s real. Yes, it’s plausible. But first of all, if someone actually surreptitiously put malicious chips onto motherboards en masse, we would have seen a photo of the alleged chip already. And second, there are easier, more effective, and less obvious ways of adding backdoors to networking equipment. https://www.schneier.com/blog/archives/2018/11/that_bloomberg_.html https://www.schneier.com/blog/archives/2018/11/that_bloomber...
  - alephnerd 7mo ago
    https://www.schneier.com/blog/archives/2021/02/chinese-supply-chain-attack-on-computer-systems.html https://www.schneier.com/blog/archives/2021/02/chinese-suppl... HNers are acting reflexively skeptical (which isn't always a bad thing), but targeted supply chain based attacks conducted by a nation statein the manner described are actually doable, and back when I was still a line-level SWE this was when we started putting significant engineering effort into hardware tampering protections back in the 2015-17 period. The hardware supply chain incident itself most likely happened in the late 2000s to early 2010s when hardware supply chain security wasn't top of mind as an attack surface. Modchips targeting contemporaneous gaming systems like the PS1 and PS2 use a similar approach to the SuperMicro incident.

Didn't that turn out to be incorrect? Multiple security companies looked into this and found nothing malicious.

alephnerd 7mo ago

Nope. Bloomberg doubled down on it and even Bruce Schneider accepted it despite initially being a skeptic.

tumult 7mo ago
No evidence was ever presented and nobody ever found anything, as far as I can tell?
- protimewaster 7mo ago
  There was a security auditing firm that came out a few days later claiming they'd found a chip, similar to the one Bloomberg described, during a security audit. It's still nothing concrete, though. Their CEO basically said that they'd found one and that they couldn't say much more about it due to an NDA.
  - BobbyTables2 7mo ago
    Reminds me of how movies portray someone pretending to be a secret agent… “Can’t give any more details - it’s hush hush !”
protimewaster 7mo ago
There also was a CEO of a hardware security company that came out and said that his firm had found an implanted chip during an audit. IIRC, he was convinced that it was very unlikely to be limited to Supermicro hardware.
- alephnerd 7mo ago
  > he was convinced that it was very unlikely to be limited to Supermicro hardware Yep. This was why there was a significant movement around mandating Hardware BOMs in both US and EU procurement in the early 2020s. Also, the time period that the Bloomberg story took place was the late 2000s and early 2010s, when hardware supply chain security was much less mature.
- BobbyTables2 7mo ago
  I wonder what impact that kind of publicity had on their firms’ business… I’m sure a brief glance at his shares and the company’s share price was enough to convince him that the “problem” was unlikely to be limited to just SuperMicro. Amazing coincidence that his company could help others find out if they were impacted!
unsnap_biceps 7mo ago
I don't believe that there was ever extra chips being added to the boards, but what I could believe is that they shipped with firmware on specific chips that enabled data exfiltration for specific customers and due to a game of telephone with non technical people it turned into "they're adding chips inside the pcb layers!"
- monocasa 7mo ago
  I thought the point was an extra chip in the place of a pull up resistor or something that would edit the firmware image as it made its way across the bus, so you wouldn't see the modifications even if you pulled the flash chip and read it out manually, and would also be persistent across flash updates.
greedo 7mo ago
Schneier was simply taking at face value the contents of the Bloomberg article, especially the statement by Mike Quinn who claimed he was told by the Air Force not to include any Supermicro gear in a bid.
WillPostForFood 7mo ago
What was the last thing Schneier wrote on it? I thought it was this: I don’t think it’s real. Yes, it’s plausible. But first of all, if someone actually surreptitiously put malicious chips onto motherboards en masse, we would have seen a photo of the alleged chip already. And second, there are easier, more effective, and less obvious ways of adding backdoors to networking equipment. https://www.schneier.com/blog/archives/2018/11/that_bloomberg_.html https://www.schneier.com/blog/archives/2018/11/that_bloomber...
- alephnerd 7mo ago
  https://www.schneier.com/blog/archives/2021/02/chinese-supply-chain-attack-on-computer-systems.html https://www.schneier.com/blog/archives/2021/02/chinese-suppl... HNers are acting reflexively skeptical (which isn't always a bad thing), but targeted supply chain based attacks conducted by a nation statein the manner described are actually doable, and back when I was still a line-level SWE this was when we started putting significant engineering effort into hardware tampering protections back in the 2015-17 period. The hardware supply chain incident itself most likely happened in the late 2000s to early 2010s when hardware supply chain security wasn't top of mind as an attack surface. Modchips targeting contemporaneous gaming systems like the PS1 and PS2 use a similar approach to the SuperMicro incident.