Chinese manufacturer puts hardware backdoor onto Supermicro server boards.

[TimNJ]

It's worth noting that the NSA chip in bd's post is much, much larger  than the "grain of rice" sized chip claimed in the Bloomberg article.  Of course that published NSA chip data is several years old now - so no doubt similar tech could be smaller now - but "grain of rice sized"?. Dunno.

You could argue about that. As you say, the information we have is dated at this point and the budget is ridiculous. But I too simply don't know.

And then we just come back to the point that even if it is possible, is that the smartest  way to achieve the goal?  Why such an easily detectable and traceable tactic? If you're China, why jeopardize the technology supply chain that is the keystone to your economic power?

I suppose whether or not its hardware or software, it’s still a supply chain infiltration, since someone in the supply chain would have to install malicious firmware/software. That said, it does seemdifferent in some way.

[tooki]

I don’t think anyone has claimed the technology isn’t available. What is not credible is the many layers of corporate bureaucracy that would have to be penetrated to alter so many corporate divisions simultaneously. For crying out loud, change management is hard in the best of times. Infiltrating that so that you can change the schematic, the PCB, the testing jigs and test routines, and the validation processes back at the home office in USA for the production samples that are pulled for spot testing? That simply does not sound possible to pull off. Such changes are hard enough when they’re legitimate; doing them covertly just defied credibility.

The article claims that this happened on boards that SuperMicro contract out, so that means you only have to compromise that narrow bottleneck where the two companies communicate.  Say you compromise Super Micro's account manager at the subcontractor: He passes you SuperMicro's design package, you tweak it, and send it back, and he passes it on to engineering for validation, DFM review, and eventual production as if it came directly from his customer--and in fact, he very likely has an email from his contact at Super Micro saying "sorry, that design package wasn't the latest revision, please use this new one instead", because surely anyone who would commission such an exploit knows how to spoof emails.  Easy peasy.  In fact, since this purportedly happened at subcontractors to subcontractors, you have a further level of insulation, and excuse for delays in communication and misunderstandings that give you some leeway to operate.

But as I said, testing and verification doesn’t stop there. Do you think the client (such as SuperMicro) of a contract manufacturer doesn’t look at production samples taken periodically? Do you think they don’t regularly visit their contract manufacturers’ facilities, especially during ramp-up of a new product?

As I said, too many layers of corporate bureaucracy you’d have to penetrate. And not even all within one company...

[Bud]

"Appleboum said his concern is that there are countless points in the supply chain in China where manipulations can be introduced, and deducing them can in many cases be impossible. “That's the problem with the Chinese supply chain,” he said."

Bingo

I d trust a single Israeli Armi intelligence officer more than all 3 letter agencies all together

[coppercone2]

if a company has a hiccup in design and some guys can figure out how to make money then stuff is just gonna be shipped regardless sometimes. weird schematics mysteriously show up in public folders 2 months later.

you might get a production document and some stuff but the same set of eyes won't be looking at it. adherence to ISO etc varies sometimes. it gets interpreted differently sometimes when there are pressures. every place is like that...

you need a neurotic guy to notice that kind of shit. good company will have some redundant engineer thats not too interested and not too advanced but pays attention. WHo here actually keeps mental track of things like BOM document changes etc? I did sometimes but usually I just fired up what was on the computer and trusted the servers and coworkers to notify me, the place was too busy to investigate everything. You get 5 revs in 2 weeks  that are flipping some component around... that can over ride something like a database notification filter easily. Yea that part has been here for 5 revs, someone has probobly looked at it (but its just a buncha revs trying to make something fit mechanically by someone in a hurry because of production problems.

It's hard enough to keep coordinated WITHOUT being paranoid about intrusion/hackers.. no one tells you that it turns out one of your side duties is fighting chinese spies.

I don't think companies are too focused on state level security in general with investor pressures for profit.

show me a company thats not run like Fury 161 LOL

[bitseeker]

The sources aren't as obscured as they hoped.

https://risky.biz/RB517_feature/

Joe sheds some very interesting light on the original Bloomberg story...

[Benta]

I still say it's an RFID tag (UHF with slot antenna) for production and product tracking. No mere, no less.

Bloomberg is completely out on a limb here.

[chris_leyson]

Totally agree, if there is a chip buried in the SuperMicro board it's most likely going to be an RFID tag. After listening to Joe Fitzpatrick's interview, which does indeed shed an interesting light on things, I'm begining to wonder if there ever was a hacked SuperMicro board in the first place.

[bitseeker]

That interview certainly makes it sound like the journalist who interviewed him was just looking for anything to make a sensational story. 

[Mr. Scram]

That interview certainly makes it sound like the journalist who interviewed him was just looking for anything to make a sensational story. 

Standard practice for journalists, you mean? There are people out there that try to write solid stories, but it's practically impossible to shield yourself from the pressure having to sell and of dwindling numbers.

[bitseeker]

Yes, unfortunately.

[Cerebus]

That interview certainly makes it sound like the journalist who interviewed him was just looking for anything to make a sensational story. 

Standard practice for journalists, you mean? There are people out there that try to write solid stories, but it's practically impossible to shield yourself from the pressure having to sell and of dwindling numbers.

To be fair to some journalists, and to some journals, there are journalists who will steadfastly refuse pressure to do anything but a proper job, and there are journals that work hard to create and keep a culture that resists the kind of pressures that you're describing. Although I'll grant that in many places ethics are noted more in the breach than the observance thereof, they do still exist in some places and people thankfully.

[Mr. Scram]

To be fair to some journalists, and to some journals, there are journalists who will steadfastly refuse pressure to do anything but a proper job, and there are journals that work hard to create and keep a culture that resists the kind of pressures that you're describing. Although I'll grant that in many places ethics are noted more in the breach than the observance thereof, they do still exist in some places and people thankfully.

Absolutely. There are a lot of people who write with a passion and many initiatives to encourage good journalism have sprung up. Unfortunately, many pay the price and nobody seems isolated from the realities of the market. Too few people seem to realise a properly functioning society hinges upon quality journalism, even if the latter is democratised by social media.

[donotdespisethesnake]

So Bloomberg's follow up is "Ok, so you didn't believe our story about unicorns. But Leprechauns, amiright?"

Normally when faced with a scoop of this magnitude all the other news outlets are racing around trying to tap their own sources, in this case no one has come up with anything.

I wouldn't be surprised if Sacha Baron Cohen is revealed to have played all 17 anonymous sources...

[MK14]

Apparently, Bloomberg is run by Aliens.
Yes, real life Aliens!

There is 100% conclusive photographic proof. As seen by my 17 anonymous sources.
They include 100% trustworthy ones, such as the Trump Administration.

If you challenge the validity of it. I will tell you another story, about aliens found in another organisation. This time backed up by 30 anonymous sources.

tl;dr
Photographs or it didn't happen.
I want to see the evidence, the witnesses (information sources) to come forward and to have a so called "hardware hacked" server. Investigated by proper independent security organisation(s).

What we have so far, is a number of published, strong, very believable denials, from the very sources that Bloomberg, themselves, provided (Apple, Amazon and Super-Micro).

tl;dr
Photographs/Witnesses or it is (assumed to be) fake news until proven otherwise.

Even the UK GCHQ (and at least another big source) seems to have published information, indicating that the story is false news.

[Halcyon]

I still say it's an RFID tag (UHF with slot antenna) for production and product tracking. No mere, no less.

Bloomberg is completely out on a limb here.

Don't worry, I'm sure it won't be long until Bloomberg breaks the "news" about encrypted Motorola two-way radios used by Government agencies having "secret" chips embedded into their volume/power knobs.

(They are used for inventory/asset tracking.)

[coppercone2]

why do only some boards have it then, and why was it not immediately elaborated on by the project manager?

If they use an inventory system in their company using RF then it would be widely known in the company.. did this company not take a financial hit immediately ?where is the PR?

response to a serious international scandal accusation takes more then a week? seriously?
that could be solved with 10 seconds on a telephone.

i call bullshit. and wired to a SPI line? come on. Companies stock prices dropping drastically, fucking senators demanding inquires and someones gonna try to chalk it up to a inventory control system that took a week to explain?
seriously??

[mnementh]

https://youtu.be/-l5tpY6SXMc

Here's your typical Congressional hearing on ANYTHING higher tech than an incandescent light bulb... 

mnem
You know the concept of "The Marching Chinese"... we live in the age of "The Marching Morons".

[FrankBuss]

The security of the  Supermicro boards is really bad, like buffer overflow in the web interface of the boards, which allows to get root access, and storing the administrator password in plaintext. So it wouldn't make sense to implant a chip to do things you can do with a webbrowser without the chip. Details here:

https://arstechnica.com/information-technology/2018/10/supermicro-boards-were-so-bug-ridden-why-would-hackers-ever-need-implants/

[bd139]

LOL that’s pretty terrible. Makes me feel slightly better about HPE now and that’s saying something.

[mnementh]

You have no idea how many animated gifs/flash of Carly Fiorina's horrible demise in one fashion or another were circulating when I was an ASP. I remember one serious conversation about how if someone successfully ordered a retailiatory nuclear strike on her home town of Austin, it would wipe out San Antonio (where I lived at the time) as well. 

The counterargument was that it would also take out the Dell campus, so twofer and good riddance. 

mnem
"I feel... cold as a razor blade... tight as a tourniquet... dry as a funeral drum..."

[Halcyon]

The security of the  Supermicro boards is really bad, like buffer overflow in the web interface of the boards, which allows to get root access, and storing the administrator password in plaintext. So it wouldn't make sense to implant a chip to do things you can do with a webbrowser without the chip. Details here:

https://arstechnica.com/information-technology/2018/10/supermicro-boards-were-so-bug-ridden-why-would-hackers-ever-need-implants/

I have to say I don't agree with that statement or the article in the slightest. I've used Supermicro boards since the mid 1990's and they are pretty rock solid.

According to mitre.org (which I trust a lot more than some article on Ars Technica). There are 7 vulnerabilities listed for Supermicro boards, 6 of them are from 2013 and mostly relate to buffer overflows in the IPMI interface and another vulnerability discovered in 2018. All of the reported vulnerabilities have been resolved by Supermicro through BIOS updates.

Vulnerabilities and exploits occur even in the best products that money can buy. If you search for vulnerabilities in HP products, you'll get over 3400 results that cover just about every one of their product categories. Same with Cisco (3869 results), Dell (138 results), IBM (4038 results) and even Cray (4 results).

If you're one of these silly individuals who think that firmware and software updates don't apply to you, then you should have no business in IT. For the rest of us, I think picking on a company with a relatively small number of old vulnerabilities is a bit rich.

Until I discover evidence to the contrary, there is nothing wrong with using Supermicro boards, even in high-security or sensitive applications.

[ruffy91]

There are recent issues with Dell iDRAC and HPE iLO where remote code execution and authentication bypass are possible.

Also all Intel CPU have the ME which is running minix with tons of vulnerabilities exploitable over the network. (there were 2 or 3 critical vulnerabilities per year in the ME for the last few years.)
So you not even have to target a specific server manufacturer when Intel delivers the backdoors for all server manufacturers..

[LapTop006]

Pretty much all the management boards are terrible security-wise. There is hope on the horizon, a bunch of folk I know are working on the OpenBMC project which has a hope of being better.

[tooki]

The security of the  Supermicro boards is really bad, like buffer overflow in the web interface of the boards, which allows to get root access, and storing the administrator password in plaintext. So it wouldn't make sense to implant a chip to do things you can do with a webbrowser without the chip. Details here:

https://arstechnica.com/information-technology/2018/10/supermicro-boards-were-so-bug-ridden-why-would-hackers-ever-need-implants/

Yep. As the guy at the end of the article says: yes, it’s technically possible. But it’s not plausible.

But of course conspiracy theorists are never bothered by such arguments. To them, the allure of being knowers of the “truth” outweighs any arguments in favor of an alternative explanation, no matter how much more sensible the alternative is.

[mnementh]

The same exact thing can be said of all you would-be "Amazing Randis" debunkers out there; the desire to "Know better" than others makes you overlook obvious shit that just doesn't add up.

I'm not saying that I believe Bloomberg's story is 100% biblical truth, anymore than I believe the Bible in the same way. But CLEARLY there was SOMETHING going on, that people in a position to know felt was important enough to take the chance on telling such a convoluted story and bothered to provide enough corroborating evidence that a well-respected journalist and the paper he worked for felt it was worth bringing to our attention.

The way in which the denials were presented are what makes me call "shenanigans..." like the kid caught with crumbs leading all the way to his bedroom taking umbrage and denying that he'd raided the cookie jar, then coming down to the living room 15 minutes later with some utter BS story about what happened to the cookies.

The problem with the arguments against lie squarely in misapplication of Occam's Razor; lazy things that we are, we tend to abbreviate everything, even philosophical constructs.

Occam's Razor states that The simplest solution which answers all relevant questions is most likely the correct one. Therein lies the rub; we almost ALWAYS forget that most CRUCIAL part of the Razor, and attempt to simplify EVERYTHING by discarding facts which defy our preferred simple answer. 

2 simple facts...

1) Chinese manufacturers pwn!!! our supply chain. To them, altering hardware in a malicious manner is no harder, probably easier, actually, than hacking someone else's code... and much easier to keep the machine itself and those operating it from discovering the mod in normal operation, where FW and SW are CONSTANTLY being reviewed and scrutinized and upgraded.

A person would have to BOTH have intimate knowledge of an entire motherboard design (which really, only they have once they've been through revision a time or six) AND be on the lookout for a component that doesn't belong.

It is a matter of WHEN, not IF this will happen.

why do only some boards have it then, and why was it not immediately elaborated on by the project manager?

If they use an inventory system in their company using RF then it would be widely known in the company.. did this company not take a financial hit immediately ?where is the PR?

response to a serious international scandal accusation takes more then a week? seriously?
that could be solved with 10 seconds on a telephone.

i call bullshit. and wired to a SPI line? come on. Companies stock prices dropping drastically, fucking senators demanding inquires and someones gonna try to chalk it up to a inventory control system that took a week to explain?
seriously??

2)coppercone's argument above is dead on...

It took them a week to come up with this weak-ass story? Companies losing tens of points, Congress shitting bricks, all over what would have been common knowledge to anyone in the supply chain?

mnem
"Allright Beatrice, there was no alien. The flash of light you saw in the sky was not a UFO; swamp gas from a weather balloon was trapped in a thermal pocket and refracted the light from Venus..."