Dell Ships Infected Motherboards

An anonymous reader writes "Computer maker Dell is warning that some of its server motherboards have been delivered to customers carrying an unwanted extra: computer malware. It could be confirmation that the 'hardware trojans' long posited by some security experts are indeed a real threat."

Comments

Wow, Dell...

[gorzek]

That's some great QA you've got going on over there.

Re:Wow, Dell...

[hedwards]

Dude, I'm getting a GENERIC VIAGRA!

Re:Wow, Dell...

[gorzek]

Just because you have a third party manufacture your hardware doesn't mean you shouldn't do your own QA. After all, it's your reputation on the line, not that of the nameless sweatshop contractor.

So, yeah, this is thoroughly Dell's fault for not caring about their brand or reputation.

Re:Wow, Dell...

[Richard_at_work]

Unfortunately you cannot QA 100% of everything you ship without significantly affecting costs - as the article states, Dell is saying that this affects a small number of motherboards sent out in a particular manner, so its quite possible that this slipped through a random item QA testing net out into the open without there being any real QA procedure issue.

Dude, you're getting...

[Farmer Tim]

pwned.

why spend millions when you can spend billions?

[roman_mir]

The Pentagon is spending millions on research designed to ensure it can trust the microchips in critical systems, especially those made outside the US.

- I think the only true way to be sure is to manufacture the microchips yourself, of-course this costs much more than millions.

This comes down to the old question raised by Ken Thompson of Trusting Trust.

Re:why spend millions when you can spend billions?

[roman_mir]

Ken Thompson would show you how you'd fail in this anyway. You'd THINK you flashed the chips, but there would be some other code somewhere in the chip that would contain a Trojan. Unless you are in the loop 100% of the time and nobody can inject any modifications into any manufacturing processes, you can't be certain that nothing at all was modified.

It's not a hardware trojan

[lseltzer]

It's firmware, meaning software in a ROM. It's only slightly unconventional.

And they say it's only on motherboards sent out as replacements. Interesting, you would think this would make it fairly easy to identify the source.

Re:It's not a hardware trojan

[Lumpy]

Incorrect. It's firmware, meaning it's software in a FLASH or EEPROM on rare occasions. That means it can be re-written by applications that know how to talk to it. Writing to a FLASH is not hard or a secret, in fact I wrote a self destruct years ago to screw with a kid that kept trying to break into our dial up server. It was called "Router Passwords.exe" and it simply tried to write FF FF FF to the beginning of the Bios flash chip for several different common motherboards.

it worked, the kid never tried to connect again after he downloaded that bomb.

If it was a ROM, my trick would not work as you can not update or write to ROM's.

Re:It's not a hardware trojan

[Rogerborg]

There's no schooling like the old schooling. Say, could you hear him screaming down his acoustic coupler?

Bad Article

[Co0Ps]

From TFA:

This malware code has been detected on the embedded server management firmware.

Firmware != Hardware It would have been impressive if it was a real hardware virus though e.g. some malicious chip that opens a backdoor on the network cards and allows remote code execution.

Re:Bad Article

[hedwards]

That's bullshit and hardly relevant. Firmware is installed on a chip in the hardware. The significance is that even if you were to reinstall the OS, you'd still have the code pop up every time you try to use it. Hardware in this case indicates that it doesn't reside on the HDD or in some other removable portion of the computer. While you can change motherboards, that's a serious enough operation that you're essentially ending up with a different computer once finished.

Re:Bad Article

[fuzzyfuzzyfungus]

Arguably the IPMI is one step easier than just the motheboard firmware. Those suckers are basically little embedded computers, typically running linux or vxworks, with their own processor and everything. They happen to be physically coupled to the motherboards of larger devices; but, architecturally, they are basically the same as any of the "little bitty plastic box" style embedded network appliances.

Given the fact that embedded appliances frequently have security made of pure shit, and servers are rather high value targets, the only real surprise is that they aren't targeted more often. Especially, if you are super lucky, the IPMI card will be connected to the oh-so-special-and-physically-separate-for-security "management network", which is where all the juicy; but often vulnerable, management interfaces live. Nice place to have an attack platform silently embedded...

What did you expect?

[Chas]

Basically the entire computer's assembled in a sweatshop by barely literate people who are being paid jack-shit to assemble a "rich-boy toy" for some perceived fat cat in the US who sleeps on piles of money.

How the hell would they know if someone decided to pull a dick move like this?
And for what they're being *COUGH*paid*COUGH*, why the hell would they even care?

Re:What did you expect?

[Elbowgeek]

You do raise a good point. *We* the consumer have demanded the cheap prices of the hardware we buy, thus squeezing the profit margins of companies like Dell. Thus Dell is forced to outsource their firmware development and manufacture to China with too little oversight, leaving greater opportunity for exploitation by those with malicious intent.

Re:What did you expect?

[Taco Cowboy]

Thus Dell is forced to outsource their firmware development and manufacture to China with too little oversight, leaving greater opportunity for exploitation by those with malicious intent.

Does it follow that if the servers are manufactured in the U. S. of A. there will be no people "with malicious intent" and thus the servers would surely be guaranteed safe?

Re:What did you expect?

[Bill_the_Engineer]

*We* the consumer have demanded the cheap prices of the hardware we buy, thus squeezing the profit margins of companies like Dell.

Half truth. Dell did not add any value to their products and decided to compete on price. In order to lower their prices and retain their profit margins they outsourced their assembly to countries with lower labor costs. Dell was not forced to lower their price, they choose to compete on price alone.

*We* the consumer did not demand cheap prices, instead we purchased whatever gave us the better value. Which for some means the cheapest machine that runs stock Windows 7 for home, but for others features and/or better components may be deciding factor (eq. Apple, Alienware, Voodoo PC, Sony, etc.)

Re:What did you expect?

[somersault]

So it's our fault for being prudent with our spending? I guess we should all pay over the odds for our electronics to make sure that all these international businesses aren't feeling the pinch too much in their profit margins! Let's buy from someone like Apple who we know are making a hefty profit on their products! Oh wait, Apple do their manufacturing in China too.. hmm.

Re:What did you expect?

[mwvdlee]

Here's a clue for those clueless people - demanding the lowest price in a global economy ensures that those products will be manufactured where the cost of labor and material is lowest, and that ain't America or Western Europe

So if those people would be willing to pay more, the products would be manufactured in more expensive countries instead of the companies continuing cheap labor manufacturing and simply making a bigger profit?

Re:What did you expect?

[evildarkdeathclicheo]

Is there even an option to purchase a "high quality" motherboard, or any computer components for that matter? Cheap mass-produced goods abound in many types of products, however there are usually options. I can buy a cheap Korean car or guitar, but I might choose not to, paying a premium for an item designed and assembled in Germany, the US, or even Japan. I realize that it's very expensive to produce electronics in the US, and environmental laws make it highly unlikely to happen here, but it seems there would be a strong niche market for "computerphile" goods given how damned cheap the mass produced junk is these days. I'd rather pay a premium for a high-quality home-produced video card based on last years model, then pay a premium for the "latest and greatest" mass produced piece of Chinese junk. Am I alone here?

Re:What did you expect?

[twoallbeefpatties]

People talk about Detroit autoworkers exactly the same way. Doesn't mean much, really.

Actually, we say that Detroit autoworkers were overpaid and got way too many benefits for their unskilled labor due to inflexible, corrupt unions - sort of the opposite thing to what we're saying about offshored labor. But who's counting?

Re:What did you expect?

[Tom]

No we haven't, and no they weren't forced.

Dell decided to produce cheaper, in order to compete on price. They could have decided to compete on, say, quality, service, security, or any other area. They didn't.

The "we the customer" meme should be shot on sight. It's from the 50s when we had something resembling free markets. Quick, how many major computer hardware manufacturers are there? So what are your choices, really? What are the choices of the general public, who know very little about computers or what goes into them?

There's no such thing as customer decision. If at all, there is customer choice, among the products that are offered. The people who decide what kinds of products are available to be chosen from aren't the customers, it's some dudes in the marketing and product management departments.

Don't make it too easy for them to avoid the blame. Nobody forced them to outsource to China. They decided to do it, because it would improve their bottom line. There are some - not many, but they exist - companies who made a different choice. Just because everyone else does it does not mean you have to do it - it just gives a manager with little interest beyond his yearly bonus a very easy excuse.

Re:What did you expect?

[localman57]

If you consider being able to recognize a McDonalds sign as a sign for McDonalds as your criterion for literacy, then yes, I'd say we've achieved 99% literacy.

Re:What did you expect?

[Waffle Iron]

The next time a WalMart shopper complains about job outsourcing, offer to show them the cause of the problem and hand them a mirror.

The problem is that the "global free market" is a multi-player version of the Prisoner's Dilemma game. It's been proven that in absence of communication between the players, the rational choice in this game is to always "defect". In this case, it means buying cheap imported crap at Wal Mart. If you don't defect, most others continue to do so, and you just end up being a sucker.

Complaining about individuals' choices is going to accomplish nothing, because they're all making the most rational individual decisions. The only way to change the situation is to include the external costs of cheap offshore production into the retail price, which alters the individual's most rational choice. The most obvious way to do that is slap a tariff on the goods.

Re:What did you expect?

[Skuld-Chan]

That's a myth - the biggest reason companies outsource manufacturing to 3rd world countries is a greater return on profit. Instead of making 150 dollars per machine you might make 20 or 30.

Good example of this - up until very recently Dell's corporate desktops (Optiplex line - in fact I'm typing this on a 745 that has a "Assembled in the USA" sticker on it) were made right here in the USA, and didn't cost all that much more than Vostro machines which are made in China. These are rock solid machines (haven't had to replace a single major component on any one of the 200 or so I'm responsible for).

My brother used to work for an importer of Chinese goods (pens/no name tv's [I see them at fry's all the time]/toys) you wouldn't believe the markup some of these goods have. Pens that sell for a dollar for instance they were buying for as little as 5 cents. 5 cents - think about how far they traveled, and how much effort it takes to make a ballpoint pen than you can make 95 cents profit off of. A lot of these 5 cent pens were toys on the side as well (light up, or have an etch-a-sketch attachment on the end - stuff like that) that sold for 2-3 dollars.

Re:What did you expect?

[Mister Whirly]

Actually, I would consider being able to read as the criteria for "literacy". What does McDonalds have to do with literacy rates? Nice strawman though - we aren't talking about obesity, nutrition, or anything food-related in this conversation.

Re:What did you expect?

[innocent_white_lamb]

Good example of this - ... I'm typing this on a 745 that has a "Assembled in the USA" sticker on it)
 
I don't know if your example is all that good.
 
You do realize that there is a huge difference between "Assembled in the USA" and "Made in the USA", right?

Re:What did you expect?

[blackraven14250]

Just because they don't know how to put the words together coherently into sentences following proper grammatical structures doesn't mean they can't write. It means they're not going to be writing research papers.

Also, if you think the criteria for India and China's literacy rates is different or inherently superior to the US, you'd be sorely mistaken.

To paraphrase Ghostbusters

[MonsterTrimble]

I have not studied computer science, firmware trojans nor antivirus. Could someone explain to me:
1) How do firmware trojans work?
2) Are they OS independent?
3) What information can they send and/or damage can they do to a system?

Re:To paraphrase Ghostbusters

[bannable]

Why is this modded flamebait? It seems like a legitimate question for someone unfamiliar with why this is interesting.

Re:To paraphrase Ghostbusters

[Anonymous Coward]

1) More or less the same as any other trojan, but they're much nastier.
2) Yes, very much so.
3) Depends on what piece of firmware it is specifically, if say, the BIOS was what was infected then pretty much whatever the hell they want/want to do. Raw dumps of the HDD in the PC(or even just particular files depending on how advanced the trojan is) and an inside track for exploiting the entire network that the machine happens to be connected to, while remaining mostly invisible to anyone but a good/dedicated sysadmin.

Re:To paraphrase Ghostbusters

[snadrus]

Think embedded keylogger that sends results somewhere online for starters.
Although it could be as advanced as a router that's been taken over and allow full remote access to the intranet the PC has. That way all the complex theft software is external.
And ofcourse it could monitor activity & brick the motherboard if someone was trying to detect it.

I like where this is going.

[boneclinkz]

**This call may be monitored for quality assurance purposes.**

Customer: Hi, my computer won't POST.

Steve (Samir): Okay, sir, first we must try a few things. Is the machine currently plugged in?

**3 hours later**

Steve: Sir, the problem appears to be a faulty motherboard. Unfortunately your system is out of warranty. Luckily, while the system was operational, our integrated key-logger was able to pull your shipping address and credit card numbers. We have billed you for a replacement system and it should be there in 3-5 business days. Someone will need to sign for it, perhaps your oldest daughter. Justine is turning into a fine looking young-lady, by the way.

Blown WAY out of proportion

[kaizendojo]

A few of their SERVICE stock for a single motherboard showed signs of malware code on the embedded server management firmware. Dell reacted quickly and appropriately. You can read the forum posting that started this all here: http://en.community.dell.com/support-forums/servers/f/956/t/19339458.aspx

Of course this is disturbing, but it's quite a leap to say a 'hardware trojan' is 'shipping with Dell Servers'. Once again, a good example why you should never blindly trust "anonymous posters' on Slashdot... RTFA yourself.

SW/HW Malware

[Killer Instinct]

Its not bad enough they ship with windows ?