New Evidence of Hacked Supermicro Hardware Found in US Telecom: Bloomberg (bloomberg.com)

A major U.S. telecommunications company discovered manipulated hardware from Super Micro Computer in its network and removed it in August, fresh evidence of tampering in China of critical technology components bound for the U.S., Bloomberg reported Tuesday. From the report: The security expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery following the publication of an investigative report in Bloomberg Businessweek that detailed how China's intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015. Appleboum previously worked in the technology unit of the Israeli Army Intelligence Corps and is now co-chief executive officer of Sepio Systems in Gaithersburg, Maryland. His firm specializes in hardware security and was hired to scan several large data centers belonging to the telecommunications company. Bloomberg is not identifying the company due to Appleboum's nondisclosure agreement with the client. Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server's Ethernet connector, a component that's used to attach network cables to the computer, Appleboum said.

Comments

Bloomberg! Bloomberg! Bloomberg!

[The Original CDR]

Has any other news media outfit independently verified the Bloomberg claims?

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

No, and so far nobody has been able to dig up anything. At this point it seems most likely that what they found were unsubstantiated rumors within a couple companies.
This new report might have more solid information but since they withheld all the details which could be used to back it up, we don't know.

I wouldn't put it past China to do it, but I also wouldn't put it past Bloomberg to publish rumors for page hits.

Re:Bloomberg! Bloomberg! Bloomberg!

[Sarten-X]

Nope, nor have enough details been released that somebody could even start. There's speculation, but Bloomberg hasn't published anything that would let someone verify it on their own.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Ching shows up to defend Chong.

Does anybody think the Chinese government deserves the benefit of the doubt?

Re:Bloomberg! Bloomberg! Bloomberg!

[Calydor]

Does Bloomberg?

Re:Bloomberg! Bloomberg! Bloomberg!

[mujadaddy]

I'd love to see your moral calculus on this. Maybe Bloomberg is wrong, but it's not because they're trying to murder their political opposition.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

but I also wouldn't put it past Bloomberg to publish rumors for page hits.

The Supermicro story is turning out to be a hoax.

The only person actually named in the original Bloomberg story about the Supermicro servers was a "hardware expert" named Joe Fitzpatrick. As it turns out, he' s not all that much of an expert, and he has now done an interview where he says that he doubts the accuracy of the story:

https://risky.biz/RB517_featur...

He was communicating with one of the authors of the Bloomberg story for a couple of months before the story was published. Then, the story came out and things that he had described as being hypothetically possible were in the story, but presented as facts that they had gotten from various anonymous sources

For example, the Bloomberg guy said to him "One of my sources said the chip might be a signal coupler. What does that look like?" So Joe Fitzpatrick sent him a link to a picture from a catalog. And, lo and behold, when the story was published it contained that exact picture, presented as "proof" of the chip that was implanted on the Supermicro motherboards.

Re:Bloomberg! Bloomberg! Bloomberg!

[rudy_wayne]

The authors of this most recent story were also the author of the original Supermicro story. They also wrote other pieces over the last couple of years were they have made lots of spectacular claims, with little or no evidence, and, there has never been any follow-up on the stories.

Re:Bloomberg! Bloomberg! Bloomberg!

[gnick]

He didn't equate Bloomberg with the Chinese government except in the sense that neither can be trusted with outrageous claims without verification.

Re:Bloomberg! Bloomberg! Bloomberg!

[Sarten-X]

The public deserves the truth.

Security is complicated. On the one hand, perfect security is impossible. Your servers can be hacked, your data can be stolen, and your users can be phished.

However, there is another perspective that I think is equally important, if not moreso: It's not hopeless. The attackers are not omnipotent. They have 9-5 schedules, bureaucracies, budgets, and deadlines. If your system is protected well enough that your attackers' budget runs out, it will stay safe. From that perspective, security is just a matter of economics. Your security is bought by spending a little money and effort to drastically increase the effort the attackers need to spend.

An attacker embedding a custom chip in server hardware, then processing thousands of phone-home results is expensive for them, and unlikely to get a result. However, replacing your whole data center to use non-Supermicro servers is also expensive. Frankly, the whole thing probably isn't worth anybody's time.

Breaking into an internet-facing server with a default password is easy. There are lots of routers and firewalls out there with default credentials or hidden backdoor accounts. Exploiting one of those is ridiculously cheap for an attacker, and gets them far better results.

The notion of "the attacker is almighty" doesn't help improve overall security, because it silences discussion about how to actually improve security posture. Instead, we should set aside hardware concerns for now, and ask "What's the easiest way we can be attacked, and how can we fix it?", then make the fix, and repeat until your own budget runs out.

My skepticism is not about doubting China's ability. I'm sure China (or any nation or well-funded individual) could get hardware inserted into servers. What I'm skeptical of is whether China (or any nation or well-funded individual) would even bother with the expense and risk when they could send a phishing campaign instead.

Re:Bloomberg! Bloomberg! Bloomberg!

[mujadaddy]

The problem with that idea is that China fucking with the supply chain is not an outrageous claim.

Re: Bloomberg! Bloomberg! Bloomberg!

[MachineShedFred]

If there were supposedly thousands of these things sold to various customers all over the place, how is it that nobody kept one for forensic analysis?

How is there not one live example if all these networks and servers were compromised?

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

the idea of bloomberg publishing sensational garbage is even easierto believe

Re: Bloomberg! Bloomberg! Bloomberg!

[mujadaddy]

So then we're left with an important question: Why did Amazon & Apple dump Supermicro at around the same time?

Re:Bloomberg! Bloomberg! Bloomberg!

[infolation]

First the authors shorted supermicro stock ahead of the original claims, then they used the profits from that short to pull an even bigger leveraged short of supermicro stock ahead of the second batch of claims.

I have no evidence of this but... if you were writing those stories, why wouldn't you?

2018/10/04 US:SMCI $21.47 --> $8.55
2018/10/09 US:SMCI $15.55 --> $10.80

Re:Bloomberg! Bloomberg! Bloomberg!

[Aighearach]

Does anybody think the Chinese government deserves the benefit of the doubt?

Does Bloomberg?

Yes. Bloomberg is a center-right media outlet, and almost all of their profitable business is related to selling financial information to professionals. They make an industry-leading software product called Bloomberg Terminal that they use to disseminate this information.

I wouldn't trust them on political reporting, because they tend to give the perspective of a center-right business executive. But on general news that doesn't relate to their industry, they are nothing if not mainstream. They don't go for bombastic tabloid nonsense, it would tarnish their brand. Getting page views isn't the purpose of their public news service; enhancing their brand is the purpose.

Therefore, I would give Bloomberg the benefit of the doubt that they believe this information to be true, and to be of great import to purchasing and IT managers, in addition to investors and financial services providers. This is big enough that the insurance community is probably taking a lot of interest, too. They would never intentionally publish a false report that purported to be of great interest to the industries where they make their bread-and-butter; it would be all downside for them.

https://www.bloomberg.com/comp...
Don't worry about the PR there, just look at the bottom of the page under "Products" and "Industry Products" and you can understand why they are a trusted source on this; they'd lose a lot by being wrong. And they have a lot to lose.

Re: Bloomberg! Bloomberg! Bloomberg!

[TechyImmigrant]

So then we're left with an important question: Why did Amazon & Apple dump Supermicro at around the same time?

Government contracts requiring certification that in turn require a secure supply chain which in turn requires systems to be manufactured in the US.

Big, boring makers of overpriced data center equipment play this game well. Supermicro sell less costly stuff, but it's made in China.

Re: Bloomberg! Bloomberg! Bloomberg!

[mujadaddy]

Unfortunately, your post raises more questions than it answers. Go read the first article again.

Re:Bloomberg! Bloomberg! Bloomberg!

[ole_timer]

you've clearly never been a government contractor. the money is usually not an issue.

Re: Bloomberg! Bloomberg! Bloomberg!

[TechyImmigrant]

I read it.
It is still a real thing. To get certified to be eligible to bid for and get certain government contracts, a certified secure supply chain is needed. This is not new.

This being true doesn't tell you whether or not that's the cause of recent actions - but it tells you that it's going to happen anyway and you can't tell the difference from the outside.

It's worth looking to see it Apple and Amazon were bidding for some large government business around the same time.

Re: Bloomberg! Bloomberg! Bloomberg!

[mujadaddy]

The problem with your line of thinking here is that these companies already had government contracts, and

Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. And Elemental was just one of hundreds of Supermicro customers.

So, as far as being the "reason" for dumping Supermicro at that time, "government contracts" do not compute.

Re:Bloomberg! Bloomberg! Bloomberg!

[Sarten-X]

On the contrary... I've been a government contractor, and money was often an issue, though mostly it was in terms of ROI more than actual dollars. Governments don't mind spending a lot of money as long as they know they're getting what they asked for.

Re:Bloomberg! Bloomberg! Bloomberg!

[link-error]

We know NSA has been installed USB port wireless control chips in motherboards for some time.

    Corporate espionage. Some of these are target rich environments, but spend a lot of money on traditional security. This gives them a back door to many premium targets without having to infiltrate each one with a spy with enough an access level to get the same type of information.

  I'm just surprised it isn't more widespread. Or is it?

Re:Bloomberg! Bloomberg! Bloomberg!

[ole_timer]

exactly! phishing is nearly free, but we have to spend all this money - viola, hardware exploits, buying software zero days, etc. the ends (i. e., the data) justifies all means to get it. money is not the issue.

Re:Bloomberg! Bloomberg! Bloomberg!

[SB5407]

No, but there is prior evidence of tampering of Supermicro property: https://www.macrumors.com/2017...

Re: Bloomberg! Bloomberg! Bloomberg!

[Junta]

It does certainly sound that the reporters behind the story are not particularly good at understanding the information they get, or else vetting their sources...

The first story appears to be cobbled together out of misunderstandnigs spread across many sources (the number of sources then used to declare how valid it must be. Of course one of those 'sources' has come forth and said one source used a hypothetical and his role in corrobariting it was to include a picture of what a signal coupler is, showing how dodgy the story was assembled.

This time, it's at least more straightforward, one named source with a more straightforward and more credible strategy. However it is entirely possible that the guy doesn't know what a BMC is and mistakes the errant traffic from a BMC trying to DHCP or somethnig as an overtly malicious thing. He may not recognize some component of the jack or phy or noted the NCSI lines from NIC to another chip and presumed that was snooping.

Now it's one thing to put this out there for further investigation to get clarity, but the stories are emphatic and unambiguously making accusations which is causing the general tech market stock to move by billions of dollars and for customers to take the headlines at face value and decide things (moving from one company that was 'more chinese' than they realized to an american company with the same supply chain issues in all likelihood, even vendors making systems elsewhere generally ship circuitboards out of China). This could end up in a big defamation suit by many parties in the tech industry.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Why would a Bloomberg lie? What is in it for them?

In addition, do you honestly believe that companies or organizations that rely on customers confidence would willingly admit this? Amazon especially? Or the US military? No way, especially if its a kill switch.

Remember those two destroyers that had the collisions with cargo ships last year? I always thought that was due to gps spoofing, someone testing a weapon, even though the Navy claimed it was their fault. That didnt pass the smell test to me. Who is to say that the Chinese aka the cylons werent testing their new server kill switches?

Re:Bloomberg! Bloomberg! Bloomberg!

[sjames]

China fucking with the supply chain in such a ham fisted way and at the same time confining it to only one brand of motherboard is a bit odd to say the least.

I would expect something harder to detect, harder to prove, nearly impossible to trace back, and affecting every single brand of motherboard.

I would also expect that once it came out, a zillion tweets and blogs of OMG, I found one and a zillion me-to articles from every news outlet saying OMG these people found one. Complete with pictures.

Re:Bloomberg! Bloomberg! Bloomberg!

[Freischutz]

Does anybody think the Chinese government deserves the benefit of the doubt?

Does Bloomberg?

Yes. Bloomberg is a center-right media outlet, and almost all of their profitable business is related to selling financial information to professionals. They make an industry-leading software product called Bloomberg Terminal that they use to disseminate this information.

I wouldn't trust them on political reporting, because they tend to give the perspective of a center-right business executive. But on general news that doesn't relate to their industry, they are nothing if not mainstream. They don't go for bombastic tabloid nonsense, it would tarnish their brand. Getting page views isn't the purpose of their public news service; enhancing their brand is the purpose.

Therefore, I would give Bloomberg the benefit of the doubt that they believe this information to be true, and to be of great import to purchasing and IT managers, in addition to investors and financial services providers. This is big enough that the insurance community is probably taking a lot of interest, too. They would never intentionally publish a false report that purported to be of great interest to the industries where they make their bread-and-butter; it would be all downside for them.

https://www.bloomberg.com/comp... Don't worry about the PR there, just look at the bottom of the page under "Products" and "Industry Products" and you can understand why they are a trusted source on this; they'd lose a lot by being wrong. And they have a lot to lose.

...that and Michael Bloomberg is no Trumpkin so Bloomberg media is extremely unlikely to be helping Trump and his gang of lunatics in their ongoing effort to start a war with China, be it of the shooting or the trade variety. Now Fox News & the Murdoch media behemoth, Sinclair Broadcast Group and the rest of that ilk on he other hand will lie for Trump no matter what he does. What interests me is how these chips are supposed to have worked and how they could siphon off gigabytes of data and ship it to China, presumably over network connections and through firewalls, without anybody noticing.

Re:Bloomberg! Bloomberg! Bloomberg!

[barc0001]

> how they could siphon off gigabytes of data and ship it to China, presumably over network connections and through firewalls,
That's the interesting thing to me as well. If your network and firewalls are properly designed, it shouldn't matter if your servers have a rogue little chip wanting to call home - your network should shitcan any attempt regardless.

Re:Bloomberg! Bloomberg! Bloomberg!

[SirSlud]

I have no evidence of this but... if you were writing those stories, why wouldn't you?

I suspect one wouldn't because it would be a massive financial risk by one who doesn't have massive amounts of money to lose (aka some journalists)

Re:Bloomberg! Bloomberg! Bloomberg!

[Gr8Apes]

I have no evidence of this but... if you were writing those stories, why wouldn't you?

Jail?

Re:Bloomberg! Bloomberg! Bloomberg!

[Dr. Evil]

Center-right media outlet before the world went insane.

Now you would call it "business journalism" or something.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

"Why would a Bloomberg lie? What is in it for them?"

Clickbait for ad revenue. That's all news is these days. Manufactured outrage, enjoy your 15 minutes of hate prole.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Since these companies depend on customers confidence it would benefit them greatly to show the compromised servers to display their ability to discover and halt such attempts.

Claiming that there exist no such compromised servers and then proven wrong is the path to losing customers confidence.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

I have no evidence of this but... if you were writing those stories, why wouldn't you?

Jail?

Funny thing, it's not illegal insider trading if the journalists lied.

Re: Bloomberg! Bloomberg! Bloomberg!

[Alain Williams]

The clickbait ad revenue would be peanuts compared to the lost subscriptions due to them losing reputation.

I'm not making my mind up -- I'll wait to see how this develops.

Re:Bloomberg! Bloomberg! Bloomberg!

[jythie]

Yeah, in general the people who have the resources to make a real profit from such a move probably do not work in journalism in the first place.

Re: Bloomberg! Bloomberg! Bloomberg!

[mentil]

This could end up in a big defamation suit by many parties in the tech industry.

If that's what it takes to improve tech journalism in the MSM, then I'm all for it.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

"that and Michael Bloomberg is no Trumpkin so Bloomberg media is extremely unlikely to be helping Trump and his gang of lunatics in their ongoing effort to start a war with China"

If you remove this nonsense, your post made some sense, but you couldn't help yourself. Unbelievable.

Re:Bloomberg! Bloomberg! Bloomberg!

[Swave An deBwoner]

https://en.wikipedia.org/wiki/Market_manipulation

Market manipulation is a deliberate attempt to interfere with the free and fair operation of the market and create artificial, false or misleading appearances with respect to the price of, or market for, a product, security, commodity or currency.[1] Many forms of market manipulation are prohibited in most countries, in particular, it is prohibited in the United States under Section 9(a)(2)[2] of the Securities Exchange Act of 1934 ...

Also see the bullet point a little further down in that article on "Stock bashing".

In short (no pun intended) I believe that it would be illegal had the reporters actually done this.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

>> I wouldn't trust them on political reporting,

since there is no evidence whatsoever, this is political reporting. most likely to divert from intel's IME crap

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

I know for fact the US government uses supermicro boards. Around Fall 2016 the DoD came down hard wanting to make sure all bmc on Super Micro boards were absolutely disabled, even on devices that weren't connected to any network.

Re:Bloomberg! Bloomberg! Bloomberg!

[rtb61]

Why would it be in any way shape or form outrageous, they would be logical and expected. The best supply line hack, high efficiency capacitors are smaller than low efficiency capacitors (much more expensive as well). So you can put a high efficiency capacitor in a low efficiency capacitor casing and have room left for a chip. What the chip does is check from a signal on the power flow, if it gets the right code, it shorts out the connection and the capacitor dies, taking out what ever product ie a computer it is in. So done on a broad scale you can collapse a country. The chaos, everything with that capacitor goes down, replacement computer motherboards are really difficult to order because the computers down. Get the motherboard, and if the signal is still going, once it is powered it fails.

Get enough tainted capacitors into the infrastructure and that country goes down for months, everything goes down, it basically just lost a war it never knew it was fighting, would I trust capacitors out of China or the US in essential infrastructure, absolutely not, I would strive for all infrastructure components to be locally made. If I was supplying them to another country, I would bobby trap it all, just in case, so much fucking cheaper than a war machine and far more effective. Not happy with the supply of my tainted components, make your fucking own, or buy some other countries tainted components. US tech industries are so screwed and the US government did it to them.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Is it illegal if reporters bash the companies, but tell other people who may be unrelated to short the company?

In addition, the reporters can always argue that they didn't deliberately attempt to interfere, and that they were just reporting what "anonymous" sources told them!

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Hold on now. I was in the Navy, and you would be shocked at how incredibly incompetent the Navy can be.
I have no idea about the supermicro story, but for God's sake, please don't assume anything based on the Navy being competent in any way.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

"viola" - what does classical music have to do with this??

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Bloomberg is what stock analysts and high speed trading algorithms read, so just mentioning bad news, even if fake or misinformation is enough to affect the stocks related to SuperMicro, and those who bought SuperMicro servers (basically everyone else who isn't a Dell or HP shop.)

To be blunt, I wouldn't doubt the authentics of the story, rather I'd doubt the widespreadness of it being true. It's far more likely that even if it were true (eg Amazon ripping out an entire data center's worth of them) you don't need that many "spy" chips to get into the network, you just need public-facing IP's that the BMC is also attached to. That's what this supposed chip does. No security-minded data center would EVER put the BMC IP's on the public-facing network. You put those on their own IPMI side channel so that you can use any working machine of yours to rescue any broken one, rather than putting it on the public net and having get hacked by autonomous botnet farms. In the event that one of your machines is jacked, you turn off that (hopefully managed switch) port, or unplug it, and send someone in the DC to unplug it and then reinstall the OS on a fresh disk.

I have to say that the relationship to the Intel ME and this is not a coincidence. Given the right combination of network insecurity, this is exactly how the ME can be exploited.

Re: Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

The presence or absence of a defamation lawsuit will clarify the truth. Plus a defamation lawsuit would require the companies filing the suit to prove the accusations are false and allow outsiders access to the technology under review for independent analysis. And China seems to be pretty quite about the whole affair since a story like this will further limit their ability to sell their technology in the US. Maybe China is afraid to say anything because they are afraid of giving Trump a bigger bat to whack them upside their head with. Not to mention the US government are reactionary morons who have already enacted regulations against both Chinese and Russian technology companies. And Congress doesn't require any proof when China or Russia is involved. The only thing the two political parties in the US agree on is giving China and Russia a hard time. However, in this instance there is really is no reason not to stick it to the Chinese. It's not like the US cannot manufacture or get similar technology from others. SE Asia is full of countries who can undercut China when it comes to taken advantage of low labor costs.

Re:Bloomberg! Bloomberg! Bloomberg!

[Graymalkin]

An attacker only needs to get through the defense once (for various values of once) to be successful while the defender needs to block every attack to be successful.

A little spy chip spitting out a DNS query for an innocuous looking domain to exfiltrate data and/or grab C&C instructions from a TXT record or something might never be noticed.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Which innocuous domains? Isn't this what most spyware are doing and there already ways to catch them?

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

Since their source is an Israeli company, I would definitely suspect this is a distinct possibility. Sounds like a lot of insider family activity. Probably all makes more sense in Hebrew or something.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

But perhaps they've got a pocket journalist, or just happen to be in a position of trust (anonymous, of course) with a gullible journalist...

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

No doubt they believe it to be true. Personally I think this is a rogue case of schizophrenia in an otherwise trustworthy individual. It happened to Nash, it could happen to anyone.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

You're thinking of NASA, not the NSA. Budget cuts have forced them to borrow compute resources in this manner.

Re:Bloomberg! Bloomberg! Bloomberg!

[Aighearach]

Money remains money, even in a weird year.

Re: Bloomberg! Bloomberg! Bloomberg!

[Type44Q]

It seems to me that it would mak sense to gather intel on your enemies before you whack them but what do know; you sound authoritative.

Re: Bloomberg! Bloomberg! Bloomberg!

[BanHammer]

You're expecting journalists to research stuff instead of telling people what to think?

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

You clearly need to work on your reading comprehension. Right there in the summary it says:
"The security expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery following the publication of an investigative report in Bloomberg Businessweek that detailed how China's intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015. Appleboum previously worked in the technology unit of the Israeli Army Intelligence Corps and is now co-chief executive officer of Sepio Systems in Gaithersburg, Maryland."

So a place any reporter could easily start is to contact Yossi Applebaum.

Re:Bloomberg! Bloomberg! Bloomberg!

[DeVilla]

That seems to be getting harder and harder to do. Sure, you block incoming traffic, but more and more software is getting dependent on the "cloud" (in the somebody else's computer sense) and it's getting harder to run current software without allowing it to talk to huge swaths of internet. It doesn't matter if it's the new hot devops tools or the latest Windows. You can't run Office with a firewall without getting constant requests to phone all over the place.

It's irresponsible that businesses have allowed this to become the norm, but it is.

Re:Bloomberg! Bloomberg! Bloomberg!

[Anonymous Coward]

This is aimed at Supermicro. They are the strongest supporters of AMD Epyc, which is currently eating Intels lunch.

Re:Bloomberg! Bloomberg! Bloomberg!

[Aighearach]

If the attacker has insider access to China's network, because of their national perimeter firewalls, they could put it all into queries for subdomains of any legit domain in China, and even intercept them so they don't get to the actual name server. They just disappear from the backbone, and the data goes into a database. Responses can happen the same way; the packets don't even exist inside the Chinese network, they just appear on the external interface and off they go to their destination.

If they control intermediate servers they can even do that exact same thing using domains whose name servers are hosted in any compromised datacenter. All they need to control is one managed switch for this to happen.

If there are already ways to catch them or not depends on details, and it is no trouble to imagine something new that wouldn't be detected by the old tests. Just like with the Olympics and drug testing.

Time will tell if this is real, but there are no obvious limits that prevent it from being even worse than claimed.

Re:Bloomberg! Bloomberg! Bloomberg!

[Sarten-X]

That wouldn't be independent verification. At most, you could verify that Yossi Appleboum claims to have seen compromised servers. That's lovely, but I can also claim to have seen Bigfoot living in my data center, and it's worth about as much (though I'm not pitching a business locating rack-dwelling cryptids).

For independent verification, we'd need a way to identify suspicious servers (like a batch of affected part or serial numbers), a real picture of the offending chip, and someone completely unaffiliated with Bloomberg to publish their analysis of the attack and how it works.

As an alternative, providing enough detail for self-identification would also be enough. Most valuable to ops teams would be a description of the traffic when the servers phone home, so it could be detected in live environments, but even having a list of the IP addresses it tries to contact would be enough to write some NIDS rules.

Where are the documents?

[Anonymous Coward]

Still, no concrete evidence is shown by Bloomberg.

Where?

[110010001000]

Where is the evidence? They keep saying they have it. Why don't they show it?

Re:Where?

[Aighearach]

Investigative reporting doesn't work that way in most cases. There are a lot of unknowns. Right now, they enhance their own research by not giving out too many details, and letting the companies involved say stupid things that might be refutable by that evidence.

Evidence is good. Don't decide if it is actually true or not until you get it. But that doesn't imply that when you first hear about the issue, the evidence will be published, or that it is tactically wise to lead with the evidence instead of the accusation.

If we get to the end of the story and Bloomberg says "that's all we have," that's when you can weigh the evidence they presented. If they haven't presented the evidence yet, then before you start to worry about that, you should simply check if the process has reached the end, of if the evidence is still waiting to be released. If it is still waiting to be released, there is nothing suspicious at all about the fact that you have not been given a personal viewing.

Re:Where?

[Anonymous Coward]

We believe every survivor

Re:Where?

[Anonymous Coward]

So its ok to slander/libel because "I have evidence I haven't presented yet."

I have evidence that you've been embezzling. Don't worry, after I smear your name for several weeks, I'll release the 'evidence'.

Re:Where?

[Freischutz]

Where is the evidence? They keep saying they have it. Why don't they show it?

Is somebody stopping you from buying one of their products: https://www.supermicro.com/pro... ...and looking for these backdoors yourself?

Re:Where?

[barc0001]

> Right now, they enhance their own research by not giving out too many details,

Sure, but how hard would it be for them to put out a piece of proof like saying "we found this chip (pictured at right) on several motherboards of the following model that appear in Supermicro chassis x, y, z and bb." And then anyone who owns one of those can just *go look for themselves* to see if the chip is there too.

Put up or shut up...

Re:Where?

[slack_justyb]

Don't decide if it is actually true or not until you get it.

The only thing is that what Bloomberg is stating in the first story and to a much lesser degree in this current one are things that are tantamount to massive tectonic accusations. In fact, I'm really under selling it here. These claims are bigger than the second coming. So yeah, you're damn tooting I'm hyper skeptical of this story.

If we get to the end of the story and Bloomberg says "that's all we have,"

No, I think you aren't understanding the gravity of these claims. If we get to the end and Bloomberg has nothing, they need to be sued into a molten crater of nothing. That they published something like this, isn't "Oh ho hum same-o, same-o story." No this is, if this sotry proves to be false, your company is gone and your career as a reporter is ended for all of eternity. Additionally, the editor and everyone else who touched this story before it was actually printed should have their careers ended in the most spectacular way. And trust me I'm still seriously underselling how massive these claims are. If Bloomberg's story is true, they've single handedly uncovered the biggest story in tech/spy since Edward Snowden. And I would dare say that this revelation is bigger than that by several orders, if true.

So yeah, they need to pony up some hard proof ASAP. because I'm pretty sure some atom bomb sized libel suits are going to be coming their way at twenty orders of magnitude faster than Bloomberg is putting out updates. Bloomberg's claims are Earth shattering for the tech industry, there will literally be repercussions that will change things for forever, if ture. Those claims have the potential to end companies (and we've seen supermicro's stocks in free fall) and end them no matter size. So yeah, I'm going to need a lot more than "claims" for this one. This is way, way, way, way, way, way past the threshold of standard level of skepticism. Like we're not even in the same ballpark here, we're not even in the same galactic supercluster here for standard level of skepticism. If the saying is shit just got real, like this is where the shit transcends corporeal existence. And after all of that, I'm still really understating how massive these claims are.

Re: Where?

[Anonymous Coward]

Uhh no. They made the claim, THEY present the proof.

Re:Where?

[Anonymous Coward]

If that's really what's going on, then they shouldn't expect that we people will just accept that as part of the process. I, for one, will never trust another word from Bloomberg if they aren't able to back up these extraordinary claims with extraordinary evidence. Further to that, I'll publicly mock any of their future articles to convince others that they're not worth reading.

You might be willing to tolerate that behaviour, but I'm not. The ends don't justify the means.

Lets see how many of their customers see things your way and how many see it my way. My guess is that they'll lose a lot of money on this unless they have extraordinary evidence.

Plenty of evendince of this is real

[supercell]

I had SMCI stock in 2017 and sold it after reports that Apple dropped them when they found serious security issues with their servers.
Now Apple and others claim they have no idea what Bloomberg is talking about. Clearly something was installed on Supermicro servers to cause Apple and others to stop using them.

Report from early 2017
https://www.marketwatch.com/st...

Re:Plenty of evendince of this is real

[mujadaddy]

Correct: Bloomberg's reporting is lagging real events, but Apple & Amazon haven't come up with a better explanation of why they switched hardware at that time.

Re: Plenty of evendince of this is real

[Anonymous Coward]

The problem is that Apple (Google, etc.) is stuck between contenders who are State actors, two of which (the US and China) can make life very difficult for any company who decides to call them out. So they play a game of mitigating risk whenever itâ(TM)s found without actually calling out the State actor for nefarious activity. Instead, they cut ties with the corporate entity that is left holding the bag. In this case, itâ(TM)s SuperMicro who let their Chinese operations become overrun by the Chinese government.

Re:Plenty of evendince of this is real

[Anonymous Coward]

I had SMCI stock in 2017 and sold it after reports that Apple dropped them when they found serious security issues with their servers.
Now Apple and others claim they have no idea what Bloomberg is talking about. Clearly something was installed on Supermicro servers to cause Apple and others to stop using them.

Report from early 2017

https://www.marketwatch.com/st...

IIRC, there was also a claim connected to that older case that supermicro site was also serving the same backdoored firmware (so bios? me?). Thus it seems unrelated to this.

Re:Plenty of evendince of this is real

[pgmrdlm]

Bloomberg HATES Trump. Seriously, you really think they will listen to ANYTHING Trump administration tells them?

Re:Plenty of evendince of this is real

[mujadaddy]

The story is a plant. The Trump admin is

The source of the story is an ex-Mossad spook with ex-Mossad spooks on the corporate board. "Trump" is too simple of an answer, but you may not be on the wrong track...

Re:Plenty of evendince of this is real

[Rick Schumann]

Here's how I see this so far: If it's all true, then Apple and anyone else would be nuts to just blab about it all to the media right away, because if it is true then it means not only a gigantic percentage of the Internet in general is compromised, it also means that critical infrastructure is compromised, as well as government and the military, and not just here in the U.S., but in every 1st-world country, and anywhere else in the world, too. There'd be a panic, and rightly so, because it would mean someone out there almost literally has a Big Red Button they could press and bring everything to it's knees. Think 'cyber-doomsday weapon'.

Re:Plenty of evendince of this is real

[Aighearach]

And yet, they do offer an explanation they claim is not only better, but true! That it was only a software issue. They said that in response to the first Bloomberg story. So now Bloomberg is doubling-down on that part.

Re:Plenty of evendince of this is real

[mujadaddy]

...it was only a software issue...

Sorry, jack: there's not any claim by Amazon or Apple that there even WAS an issue. Try again.

Re:Plenty of evendince of this is real

[Anonymous Coward]

It's disinformation being covertly fed to them, similar to how Dan Rather was undone. And Bloomberg is buying it lock, stock, and barrel.

It's why they picked Bloomberg to be the victim in the first place

Re:Plenty of evendince of this is real

[afidel]

It was a hacked driver file on their public FTP server which was downloaded to a single Apple lab machine. All the details are out there. That wasn't the reason that Apple dropped them, it was purely price. When you order your servers by the container ship it's cheaper and more efficient to go to the ODM and have them build to your specifications thus cutting out the middle man and features that your use case doesn't require (like LOM cards, when you have a redundant array of inexpensive datacenters you don't care if an individual server has issues, you pave the OS and reboot, if that doesn't fix it you power it down and have it replaced when the rack gets too old or has too many failed units)

Re:Plenty of evendince of this is real

[Anonymous Coward]

Lmao, you can't even spell. I doubt your evendince.

Re:Plenty of evendince of this is real

[Anubis IV]

I had SMCI stock in 2017 and sold it after reports that Apple dropped them when they found serious security issues with their servers.

Going by that, the timeline would be that these companies discovered malicious hardware in 2015, kept thousands of those servers in service for two or more years, and only then decommissioned them. Does that make any sense at all?

Instead, if you read their initial responses to what Bloomberg published, they actually say more than that "they have no idea what Bloomberg is talking about". For instance, Apple provides an alternative explanation for Bloomberg's confusion:

[...] Bloomberg’s reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple.

Apple dropped SuperMicro shortly after that incident, making it a much more likely cause for the falling out. Likewise, Amazon cites firmware issues with SuperMicro boards in their response, though you'll note that they were still using SuperMicro boards in 2018:

Additionally, in June 2018, researchers made public reports of vulnerabilities in SuperMicro firmware. As part of our standard operating procedure, we notified affected customers promptly, and recommended they upgrade the firmware in their appliances.

All of which is to say, nothing about Bloomberg's story makes any sense. The timeline makes no sense, none of the alleged victims has anything to gain by lying, one of their only named sources has come out saying he doubts the story, literally every company or agency allegedly involved has said it's untrue, and Apple has even gone so far as to formally inform Congress that inasmuch as the story pertains to them it's untrue, while additionally affirming via press releases that they are not under a gag order or anything else of the sort.

Someone's credibility is going to take a nosedive after the dust settles from this, and I expect that it will be Bloomberg's.

Re:Plenty of evendince of this is real

[Anonymous Coward]

Have you considered it's a repeat of the Cisco scandal and it's not a Chinese hack but an American one so Apple and others don't want to jeopardize their USG contracts over this by making it public?

Like Chinese penises

[Anonymous Coward]

The proof is too small to see

Re:Like Chinese penises

[Anonymous Coward]

I do. Thanks for noticing, brah.

Re:Like Chinese penises

[Anonymous Coward]

Ha Ha Ha, Yes sure you do.

Evidence?

[Anonymous Coward]

Can they a least release the damn documents.
If they don't want to compromise the company just obfuscate the names with a fucking marker.
o better yet where this devices are for god sake.

Re:Evidence?

[Anonymous Coward]

Because it might not be what you or I would think. What if those chips weren't planted by the Chinese but some other IO? What if releasing that information would expose some intelligence agents that are on someone's side? What if they don't want to expose that they know who these agents are? What if the whole story is bull shit and they don't want to expose their propaganda? Many options for why they wouldn't want to release that info.

Re:Evidence?

[Anonymous Coward]

While the American government spent a decade bumbling around with regulatory requirements for protocol backdoors, compulsory cooperation including gag orders, etc....

China just baked into the hardware, and shipped it all over the world.

I think it is quite clear which country has the more technically literate government.

Silly Chinese

[Anonymous Coward]

Why put the chip on the Ethernet connector? You know this doesn't decrypt encrypted traffic. They should have taken note of US intelligence agencies and built it into the CPU so they could get the info before encryption. Oh well, eventually they will learn about Intel ME and take a hint.

Re:Silly Chinese

[Ungrounded Lightning]

Why put the chip on the Ethernet connector? You know this doesn't decrypt encrypted traffic.

To give it the ability to exchange command-and-control traffic with a remote controller while keeping it from the rest of the system (by "eating" the incoming packets for itself without handing them to the processor's stack, and sending outbound packets directly, again without processing them through the rest of the system.)

This is both convenient, and lets the C&C communicate with the victim box even when the bulk of the victim is shut down.

The Ethernet controller has lots of processing power to play with once it's subverted, control-channel access to the board management system, and already has power-when-the-system-is-down specifically so it can hear the wake-on-LAN packets and bring the machine up to full function - one less mechanism to build.

That's exactly what Intel did when they first started doing Management engines. It was only later versions where they moved it in deeper.

Hacked! It's HACKED!!!11!

[Anonymous Coward]

How about a credible write-up by someone knowledgeable in the field? Something with actual substance?

Oh wait, there's no such thing because there's no such person anywhere to be found. Not even in the field itself.

Welp, HACKED!!!1! it is then.

I have a load of SuperMicro gear

[guruevi]

Also from that era that they say. I haven't seen anything anomalous. The fact is that some of their IPMI stuff is vulnerable and they're not updating the firmware (eg. old versions of Dropbear SSH), so if you leave it on the Internet, it may get compromised.

On the other hand, I also don't leave that stuff on a routable VLAN. If it tries to connect to anything (and I haven't seen it reach out), I'd notice and it wouldn't work anyway. Sure the IPMI has some hooks into the rest of the hardware so it is potentially capable of doing 'weird stuff' to my Linux or Windows kernels (although it'd have to be pretty smart to intercept keyboard authentication, wait for someone to be away from the keyboard, automatically replay credentials, then load a workable kernel module to do that) and have the OS compromised do the dirty work, but then again, I haven't seen anything there either and we've used various integrity and antivirus systems from TripWire, Sophos and Cylance that probably would've noticed.

Re:I have a load of SuperMicro gear

[ole_timer]

you have no ip worth stealing...why would they go after you?

Re:I have a load of SuperMicro gear

[Anonymous Coward]

Compromised IPMI doesn't need OS access. It's lower than UEFI. It can do whatever it wants. No software on the same system could detect mature malicious changes. An easy method is reading data flow between storage, CPU, and NIC. FDE and TLS are irrelevant. A trivial exercise for IPMI level access.

There's this pervasive attitude by people that think knowing a great deal about technology equates to knowing how attackers think, and that just isn't so.

Re:I have a load of SuperMicro gear

[Aighearach]

Uhm, if somebody put a hardware backdoor in one of the chips on the board, and as far as you know hasn't activated it, why would you expect to see anything "anomalous?"

That you consider that to be information with value really discredits your analysis as a whole.

And you're simply wrong that it needs to "reach out" in a detectable way to be a problem. In fact that's the difference between a hardware backdoor and a software one! The software one has to go through whatever networking you have set up. The hardware one could be doing almost anything, and you have no idea. It could be activated wirelessly through a passive wifi-band antenna that you didn't even know was hiding inside what otherwise looks like a port buffer IC, and that signal could be coming from nearby mobile devices that were also backdoored. There is no reason at all to presume that a major nation-state attacker would not be able to achieve that given the nature of the accusation. It could have already been activated and exfiltrated all your data without you even knowing.

Re:I have a load of SuperMicro gear

[ArchieBunker]

Who in the hell exposes their management consoles to the outside world?

Re:I have a load of SuperMicro gear

[Anonymous Coward]

That only works on hardware with dedicated IPMI /iLOM / aLOM / whatever buzzword your vendor wants to use. A lot of hardware shares a NIC.

This thread is amusing, people wanting proof need only GOOGLE It (tm). china firmware backdoor

This is from 2015 -- Obama, not Trump:

China and US clash over software backdoor proposals
https://www.bbc.com/news/technology-31729305

Re:I have a load of SuperMicro gear

[Anonymous Coward]

If it's not permanently air-gapped out-of-band management, and nothing is anymore, then it's on the internet. Even if you did buildout that way, one update, one moment with that new guy, or someone about to be laid off, or cleaning staff near the network and all is suspect.

Ask a DLP specialist why they make so much money.

Ask anyone working full time on a red team what they would do to access IPMI.

There's so many routes. It's not hard if security is your job.

Re:I have a load of SuperMicro gear

[Anonymous Coward]

Obviously you haven't seen his porn collection!

now I know

[Anonymous Coward]

So that's why monoprice is so cheap

US Government does not want egg on face

[Anonymous Coward]

The US government is going to bury this at all costs, either because it doesn't want egg on its face, or because it is complicit in this hacking. Perhaps these devices were installed at the behest of the NSA and the Chinese simply redesigned them to also send info to the Chinese government.

Not implausible, if you ask me.

Re:US Government does not want egg on face

[TechyImmigrant]

>The US government is going to bury this at all costs

The US government would love a culture of suspicion of foreign built hardware to develop.

That's one plausible source of the story.

Re:US Government does not want egg on face

[jeff4747]

Perhaps these devices were installed at the behest of the NSA and the Chinese simply redesigned them to also send info to the Chinese government.

Because when I want to implement my super-secret and highly illegal surveillance program, I turn to a hostile government to implement it. :eyeroll:

Re:US Government does not want egg on face

[Freischutz]

>The US government is going to bury this at all costs

The US government would love a culture of suspicion of foreign built hardware to develop.

That's one plausible source of the story.

Too bad for the Trump admin then that there is already a culture of severe suspicion of domestically made US hardware after the NSA bugging revelations. Now that it seems everybody is spiking computer hardware with spy chips I suppose we can always follow the example of the Russians and their intelligence services, they keep all their most sensitive data on paper and replicate it only with typewriters.

Re:US Government does not want egg on face

[AHuxley]

The US government would not get caught on the "internet" and allow its collect it all to be discovered.
Sending the information back over the internet is not without risks. Use a person to collect data.
Transmit the data out over a short distance not using the "internet"

Smart and skilled people notice extra data moving to strange places along their networks out to the internet.

Apple operates on behalf of CHICOMS

[Anonymous Coward]

n/t

Might not be just Supermicro

[caffeinejolt]

The article states:

The executive said he has seen similar manipulations of different vendors' computer hardware made by contractors in China, not just products from Supermicro. “Supermicro is a victim -- so is everyone else,” he said. Appleboum said his concern is that there are countless points in the supply chain in China where manipulations can be introduced, and deducing them can in many cases be impossible. “That's the problem with the Chinese supply chain,” he said.

According to the original article - the alleged Chinese culprit chip exploited via the BMC. Aspeed is the company that makes 99% of the BMC controllers in Supermicro boards. If China really did go through the trouble to develop a chip to exploit via Aspeed controllers.... why limit themselves to Supermicro? I know at least Tyan and Lenovo also use Aspeed. From China's intelligence perspective, they would want a solution that could work across multiple board vendors.

According to latest:

Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones. The metal is necessary to diffuse heat from the chip hidden inside, which acts like a mini computer. "The module looks really innocent, high quality and 'original' but it was added as part of a supply chain attack," he said.

Really wish they would give us more to go on than just that. Not sure about other Slashdotters, but I have Tyan/Supermicro/Insert-Taiwanese-Motherboard-Manufacturer boards in production, and would really appreciate more information on what to look for.

Re:Might not be just Supermicro

[ole_timer]

phone homes with encrypted data - but covert channels are notoriously hard to find.

Re:Might not be just Supermicro

[ole_timer]

the phone homes could be extra data in an email to a hop point...

Re:Might not be just Supermicro

[Anonymous Coward]

Another detail to keep in mind, this is essentially a completely different attack vector than what he previously reported on, other than the "from china" aspect.

The Apple/Amazon systems initially reported on are blades for a blade server system.
They have no on-board ethernet for network connectivity, all of that is in the blade chassis.

Their only "network" port is for system management, and for many of us with similar hardware, those are only use during setup if ever.
The management ports in the chassis are what tend to get used, although yea huge datacenter setups likely connect all of them for "just in case", but also almost guaranteed to not be on a vlan with any routes outside.

The story today is a different system and directly attacking the on-board networking, which would likely have some form of connectivity.

Of course the older 1u servers from super micro used to have the management and networking run over the same port. It basically hijacked a single TCP port for management purposes but the OS got anything else.
It sucks because there are standard grade exploits in their management engine and they don't provide updates to fix them on hardware out of support. If you left management enabled, or have no choice, you're just flat out vulnerable at least to the LAN segment, but likely to the Internet too.

This is pretty easy to happen even without special hardware implanted :P

Re:Might not be just Supermicro

[TechyImmigrant]

>Really wish they would give us more to go on than just that. Not sure about other Slashdotters, but I have Tyan/Supermicro/Insert-Taiwanese-Motherboard-Manufacturer boards in production, and would really appreciate more information on what to look for.

It doesn't add up.

Why would you put your trojan chip in the ethernet connector? It's away from the signals you want to get to - serial and/or usb wires to get at UEFI. Trying to cram and ethernet stack, phy and the drivers into a tiny package to get at a much harder but to crack is not how you would do it. It's also inconsistent with the first story.

Re:Might not be just Supermicro

[mujadaddy]

It's also inconsistent with the first story.

Because it's a different set of hardware supply hacks.

Re:Might not be just Supermicro

[TechyImmigrant]

It's also inconsistent with the first story.

Because it's a different set of hardware supply hacks.

Yes. And a less technically logical one. Could you fit a 10G transceiver, phy, mac and stack inside the connector? Why would you? Consider equivalence to plugging your trojan into the back panel - you could pick the ethernet, or the USB. The USB gives you keyboard access and a low effort way to subvert the machine before it's provisioned.
 

Re:Might not be just Supermicro

[mujadaddy]

Granting all the following: the public doesn't have any information on this; this second story is much less 'frightening' than the first.

Re:Might not be just Supermicro

[jeff4747]

Why would you put your trojan chip in the ethernet connector? It's away from the signals you want to get to - serial and/or usb wires to get at UEFI

Option 1: There's no requirement that there be no connection from this chip to another part of the computer. If you're planting rogue hardware in one thing there's little reason to believe you can't plant rogue hardware elsewhere.

Option 2: PXE boot attack.

Option 3: Their desired attack vector only uses this additional chip, the chip itself isn't the attack vector. After all, where do you get that BIOS image? Or the firmware on the rest of the motherboard's chips? Or perhaps you need the server to receive a malformed packet to implement an exploit of some other process, but that malformed packet can't survive routing.

Option 4: This isn't for spying. Cut off all packets or scramble some packets and you've effectively disabled the server.

Re:Might not be just Supermicro

[Anonymous Coward]

The article states:

The executive said he has seen similar manipulations of different vendors' computer hardware made by contractors in China, not just products from Supermicro. “Supermicro is a victim -- so is everyone else,” he said. Appleboum said his concern is that there are countless points in the supply chain in China where manipulations can be introduced, and deducing them can in many cases be impossible. “That's the problem with the Chinese supply chain,” he said.

According to the original article - the alleged Chinese culprit chip exploited via the BMC. Aspeed is the company that makes 99% of the BMC controllers in Supermicro boards. If China really did go through the trouble to develop a chip to exploit via Aspeed controllers.... why limit themselves to Supermicro? I know at least Tyan and Lenovo also use Aspeed. From China's intelligence perspective, they would want a solution that could work across multiple board vendors. According to latest:

Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones. The metal is necessary to diffuse heat from the chip hidden inside, which acts like a mini computer. "The module looks really innocent, high quality and 'original' but it was added as part of a supply chain attack," he said.

Really wish they would give us more to go on than just that. Not sure about other Slashdotters, but I have Tyan/Supermicro/Insert-Taiwanese-Motherboard-Manufacturer boards in production, and would really appreciate more information on what to look for.

Responding as AC for reasons... but I know that Supermicro often gets USG contracts because they are one of the few companies that designs their boards in the US. True that they do not manufacture in the US, but I do not think you’ll find anyone who does. If you’re targeting military and defense contractors then they are an excellent choice.

Re:Might not be just Supermicro

[iCEBaLM]

Why would you put your trojan chip in the ethernet connector?

Because that's generally where the aspeed BMC is, which has access to everything. The BMC has a dedicated/shared ethernet port for remote management.

Re:Might not be just Supermicro

[Anonymous Coward]

"Really wish they would give us more to go on than just that."

What more do you want? Open the freaking case, look at the ethernet jacks. If they have a metal shield around them, pop the fucking things off and see if you see more than just your basic jack wiring underneath. It's not that fucking difficult with about 5 seconds of critical thinking, god damn.

Re:Might not be just Supermicro

[TechyImmigrant]

I'm talking about the electronics.

An ethernet port has a MAC, PHY, transceiver and connector. The connector, transceiver and MAC+PHY are usually separate chips because of the different silicon needs for analog signalling and digital processing. The claim is that they stuffed all this into the connector. Maybe, but this is all to get at a config interface that you typically can get to through serial or usb wires that are comparatively trivial to latch onto.

All they had to do was show us the electronics so we could see for ourselves. But they didn't. Why not?

#gifs

[Anonymous Coward]

Pics or it didn't happen.

Re:#gifs

[TechyImmigrant]

Pics or it didn't happen.

This

Pics and network traces diffed with/without the trojan.

Re:#gifs

[Anonymous Coward]

Look dude, you are the last person that will be shown the proof. Sorry, that's just the way these things work.

Re:#gifs

[TechyImmigrant]

Not quite the last. I've worked HW trojan analysis before. That's why I have opinions.

Re:#gifs

[Anonymous Coward]

Sorry, that's just the way these things work.

"work".
Which begs the question. Chinese manufacturing is so advanced they can literally fit a SoC on the tip of a pencil, with some breakthrough cooling to avert self immolation and never ever have even a single failure (which typically would divulge its presence).
The real winner hers are the Americans because they can now reverse engineer this Chinese technology.

Re:#gifs

[Anonymous Coward]

That's the kind of thinking used by con artists and cult leaders. They'll only show the proof to the select, special few. What they don't tell you is that the special few are carefully selected for the gullibility.

You, sir, are gullible.

Re:#gifs

[Anonymous Coward]

That's not Chinese technology. This whole thing is proof that China has been infiltrated by the lizard people!

Only right about one thing

[Anonymous Coward]

The story is a plant, but by 4Chan.

It has nothing to do with Trump you retard.

In case you hadn't been paying attention China and Trump are actually close friends (unlike Russia where Trump has done nothing favorable for them).

More baseless bullshit from Bloomberg

[Anonymous Coward]

More bullshit from Bloomberg. Photos or GTFO

Garbage

[Anonymous Coward]

Need an independent source; not Bloomberg. The first article was absolute trash and hysteria. No evidence. The images of the "chip" were illustrations by an artist. There is literally no evidence. The DHS, Apple, and Amazon deny the allegations. Onus on the claimant to prove compromise, otherwise they can just sit back and shut the fuck up.

FWIW, one of the main reasons why MSM is garbage.

slant diversity

[Anonymous Coward]

You wanted chi.com diversity Bosco ... you got chi.com diversity. Feckin-A chinks and the SV Trotsky pander-pals who blojob them. I'd march your left-coast gaffot azwholes to the Utah gulag

We know they are spying!

[Anonymous Coward]

So why aren't China computers and routers banned from sale in the USA?

Re: We know they are spying!

[Anonymous Coward]

Don't know, but I think it's an excellent time for the US government to request that Intel start making their 'reference' design motherboards again, even if the federal government had to subsidize it a bit by guaranteeing govt purchases.

Bloomberg getting desperate ...

[Pinky's Brain]

This is an interesting story and all, but a targeted attack on a single machine using interception doesn't really make it likely there was compromise of Supermicro's supply chain at the factory level.

We know NSA intercepts Cisco routers, but that doesn't prove Cisco intentionally backdoors their machines for them in the factory.

Re:Bloomberg getting desperate ...

[mujadaddy]

a targeted attack on a single machine using interception doesn't really make it likely there was compromise of Supermicro's supply chain at the factory level.

The "single machine", according to the story, had a false ethernet port manufactured into it. What is your more likely explanation?

Interestingly, though, the named source for this article is an ex-spook for Israel. We are definitely in Hardball territory with this one, kids.

Re:Bloomberg getting desperate ...

[Pinky's Brain]

Interception and a soldering iron.

Re:Bloomberg getting desperate ...

[mujadaddy]

"The module looks really innocent, high quality and 'original' but it was added as part of a supply chain attack," he said.

Now, he may be wrong, but your partial version of events is not what the article's partial version of events is.

Re:Bloomberg getting desperate ...

[ffkom]

We know NSA intercepts Cisco routers, but that doesn't prove Cisco intentionally backdoors their machines for them in the factory.

Given that recently every month or so a new back door was found in Cisco's products, one could say we know for sure they are at least unintentionally backdoor their machines.

Re:Bloomberg getting desperate ...

[bongey]

Problem in China there is no such thing as privately owned and the government can do what ever it wants at anytime. Crap China kidnapped , I mean 'arrested' the head of Interpol without telling anyone. Interpol had to beg China to finally say he was arrested two weeks ago when he came home. https://www.cnn.com/2018/10/09...

Re:Bloomberg getting desperate ...

[Swave An deBwoner]

From TFA:

The goal of hardware implants is to establish a covert staging area within sensitive networks, and that's what Appleboum and his team concluded in this case. They decided it represented a serious security breach, along with multiple rogue electronics also detected on the network, and alerted the client's security team in August, which then removed them for analysis. Once the implant was identified and the server removed, Sepio's team was not able to perform further analysis on the chip.

"... multiple rogue electronics also detected on the network" ... ?

"... alerted the client's security team in August, which then removed them for analysis"?

This is beginning to sound a little different from "Supermicro sent us a bugged motherboard".

time to make stuff in the USA!

[Joe_Dragon]

time to make stuff in the USA!

Re:time to make stuff in the USA!

[Sarten-X]

...Why? Are Americans somehow incapable of being bribed to tweak a design? Does spending more on American parts mean your engineers are more likely to actually read the instruction manual and change defaults? Is an American developer going to oppose when their boss tells them to store passwords in plaintext, because the deadline's approaching and they refuse to delay for something the customer will probably never notice?

Checking the country of origin is a poor proxy for security. All it really means to have American sources is that when there's a breach, an American company has a slim hope to blame another American, and have a public trial to deflect the blame from their own mistakes.

Buy from whoever makes a quality product and shows the most interest in staying up-to-date with the latest security developments. Assume that all parts (including humans) will generally work as promised, but design your system with defense in depth, so any compromised subsystem will be blocked by other layers of protection.

Re:time to make stuff in the USA!

[Joe_Dragon]

what is better sending your data to red china or to the FBI?

Re:time to make stuff in the USA!

[Sarten-X]

Put in a tightly-configured firewall so your data doesn't get sent anywhere without your approval.

Keep management systems isolated so the data-holding servers can't modify that firewall.

Don't rely on tightly-integrated single-source solutions, so one vendor being compromised won't leave that firewall ineffectual.

Maintain independent layers of security that protect in case of another layer's failure.

That's defense in depth.

Re:time to make stuff in the USA!

[Anonymous Coward]

time to make stuff in the USA!

I think you have cracked the motivation behind this hoax. Trump has initiated it to justify his next move, which will be a mandate that US companies and government organisations must buy US-made servers. He might be bright enough not to start "Trump Servers Inc", but he'll have a significant shareholding.

Re: time to make stuff in the USA!

[Anonymous Coward]

The whole point if this is that if they have a chip in your infrastructure, you have no defense. Outward blocking firewall is great, unless they have their chip in it in which case they can be running an invisible proxy, or secret port knocking activated by other chips to trigger a "please forward this traffic".

Any defense you can implement, I can undermine for 1% of the effort, if I already have access to the hardware via these exploits/backdoors and vulnerabilities.

Hell, I breached hypervisors in the Virtual PC days before and after MS bought them. The Intel IME public disclosure invalidated a lot, but not all, of my private... extra curricular... access tools. Now you can breach it as a script kiddy.

Re: time to make stuff in the USA!

[Sarten-X]

The whole point if this is that if they have a chip in your infrastructure, you have no defense.

That's the defeatist attitude that is so harmful to having meaningful security discussions.

Outward blocking firewall is great, unless they have their chip in it in which case they can be running an invisible proxy, or secret port knocking activated by other chips to trigger a "please forward this traffic".

But that means they need two chips, in two appliances, from probably two vendors, with two separate supply chains. For the price of bringing in a second-source vendor, you've doubled their attack cost.

Any defense you can implement, I can undermine for 1% of the effort

I think you mean "I can trivially move the goalposts a bit further".

if I already have access to the hardware via these exploits/backdoors and vulnerabilities.

Or in other words, "If everything is already completely breached, then everything is already completely breached, so everything will always be completely breached". Never mind that new designs are always being produced, new non-corrupted supply chains are being forged, and new mitigations keep being developed. In the real world, compatibility between published protocols is rare. What makes you think that different hardware tools, built by different intelligence teams at different times, will be compatible in any meaningful way?

The government-backed attacking engineers still have bureaucracy. They have a committee dictating how their chips will work. They have software bugs. They make mistakes. It's simply not realistic to assume that developing a widespread hardware-based attack is going to be something any organization can consistently execute while maintaining the extreme precision required for secrecy.

Hell, I breached hypervisors in the Virtual PC days before and after MS bought them. The Intel IME public disclosure invalidated a lot, but not all, of my private... extra curricular... access tools. Now you can breach it as a script kiddy.

Well, that's fantastic, but you still need to get your code to the system to run it... Then you need to have an analysis of what you're running on, and an exfiltration... A breach is just a tool. To make it an attack requires tactics, which I see as more opportunities for defense.

We refuse to give any info or details -- trust us

[Anonymous Coward]

right... we'll just take your word for it. I mean it's not like the U.S. has a habit of bursting out with flippant accusations of spying and sabotage, or like they have two agencies who specialize in doing precisely this kind of spying and sabotage themselves.

Source is Mossad

[Anonymous Coward]

Believe Israelis or Chinese? (sweating intensifies)

Still not a shred of proof offered

[Anonymous Coward]

'Trust me, I'm being honest with you' is not proof.

SHOW ME SOME PICTURES, and detailed analysis, data, and other things that amount to PROOF.

Aspeed is the company that makes 99 percent...

[Anonymous Coward]

of *ALL* BMC Modules.

Seriously, when was the last time someone saw a system WITHOUT an Aspeed based BMC?

Unless you are using Intel AMT as your BMC, it's Aspeed units all the way down, even on many systems that could otherwise support Intel's AMT.

Pics or it didnt happen

[Anonymous Coward]

If it's true they'll eventually photograph the actual hardware and provide in depth analysis of how it worked

Russian Troll

[Anonymous Coward]

Isn't being a russian troll pretty much the apex of bootlicking?

Bloomberg is FAKE NEWS

[Anonymous Coward]

They are just another garbage MSM outlet.

Bloomberg is a fascist propaganda outlet.

[Anonymous Coward]

They are one of the main outlets of the neocon-fascist / Wall Street / Mont Pelerin Society old boys. I don't know who is more evil, Chinese government of them.

This is exactly the sort of thing they are interested in furthering. That's not even the main problem here.

The main problem is, that people actually listen to them, and spread their shit.
Which is in the same league as spreading Chinese/Russian/US propaganda and acting like it is news.

At least that is my assessment. And it's very likely far more true than any Bloomberg report. :)

Appleboum?

[Anonymous Coward]

What's that?

Boom

[Anonymous Coward]

These motheruckers outsourced EVERYTHING to China and this is the result. A kill switch. I donâ(TM)t give a shit if the electrical engineers here say itâ(TM)s impossible.

Iâ(TM)ll tell you what. I donâ(TM)t want to be on an airplane when itâ(TM)s server is killed.

Completely incredible...

[rthille]

"Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones."

Take a look at a google image search for "motherboard" and see if you can find an RJ-45 socket that doesn't have a metal shield around it for RF blocking.

Re:Completely incredible...

[tsqr]

"Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones."

Take a look at a google image search for "motherboard" and see if you can find an RJ-45 socket that doesn't have a metal shield around it for RF blocking.

OMG! They've all been hacked!! Run for your lives!!!

Re:Completely incredible...

[Anonymous Coward]

All of my motherboards have plastic connectors with no metal shielding for ethernet.

See, I don't look at corrupt Google as their searches have become less than useless. I look at what I have (in this case, over 20 motherboards) and use my fucking brain.

Re:Completely incredible...

[Trogre]

Plastic connectors.

Do your motherboards by any chance have the words, "Fisher Price" stamped on them somewhere?

My bet on the telecom

[Anonymous Coward]

The CenturyLink COs in Yakima & Spokane, WA, & elsewhere.

Trump

[Anonymous Coward]

Don't worry, they will Trump another 500 million and he will make it all go away just like he did for ZTE......

Sucks having a traitor as president and a bunch of party before nation traitors supporting him in office. Trump is stupid while the Republicans act like Little Finger from Game of Thrones and would gladly burn this nation down so long as they get to rule over the ashes just a little longer and want to make as big of a mess as possible for the next guy so they can blame them for it.

Irrelevant: IS IT TRUE?

[Anonymous Coward]

Irrelevant: IS IT TRUE?

Duh?

[Anonymous Coward]

When we started having them build our stuff... what did you think would happen?

The CEO says keep it secret.

[emil]

Do you think that your corporate security team wants to admit that you were infiltrated?

The first dozen companies that admit this will likely see their stock price decline. Do you want your company to go first?

Re:The CEO says keep it secret.

[Anonymous Coward]

The first dozen companies that admit this will likely see their stock price decline. Do you want your company to go first?

We're talking supermicro here; most of their customers don't have a stock to decline in price.

I'm not holding my breath on this panning out to be factual, because some uppity sysadmin somewhere would've plastered it all over reputable tech sites by now.

Re:The CEO says keep it secret.

[MachineShedFred]

Yeah good plan, because it always goes better when they try to cover it up and instead get hauled in front of Congress, testifying under oath.

What does that do to the stock price?

The Register also discussed this...

[emil]

...in their first article on the subject:

A third thing to consider is this: if true, a lot of effort went into this surveillance operation. It's not the sort of thing that would be added to any Super Micro server shipping to any old company – it would be highly targeted to minimize its discovery. If you've bought Super Micro kit, it's very unlikely it has a spy chip in it, we reckon, if the report is correct. Other than Apple and Amazon, the other 30 or so organizations that used allegedly compromised Super Micro boxes included a major bank and government contractors.

There is a second article with the latest details.

Re:The Register also discussed this...

[ole_timer]

just like we did to them with cisco routers etc. not everyone.

Maybe they just saw Intel AMT traffic. B-)

[Ungrounded Lightning]

TFA says: "Unusual communications from a Supermicro server ..." and on inspection the Ethernet hardware looked odd.

Maybe they just saw some Intel AMT traffic and components. B-)

Re: Maybe they just saw Intel AMT traffic. B-)

[Anonymous Coward]

It probably looked odd because the bloomberg journo tried sticking the ethernet cable in upside down and damaged it.

Microsoft wants that 100 billion govt contract!

[Anonymous Coward]

Gee, who could be behind these ridiculous rumors?

Question is

[nehumanuscrede]

Will anyone admit to being compromised by such a thing, if the story turns out to be true.
The impact on stock prices alone will probably keep companies from disclosing anything if they have any say so in the matter.

If you live in the US, you can't really be outraged about what China is doing when we have the NSA intercepting Cisco* hardware and tampering with it before shipping it on to the end customer. ( *Cisco is the only one we know about, who knows what else they have their hands in )

This is something everyone needs to think carefully about.

How much do you trust your supplier and what happens when relations with your supplier takes a bad turn ?
Still think relying on a single source for the majority of your goods is a great idea ?

Bullshit meter DINGDINGDING

[lindseyp]

NO! The first story was 'anonymous sources', who failed to provide any evidence or samples of the alleged hardware. Multiple credible sources have spoken up to refute the claims that they used tainted hardware or even found any such hack despite inspections.

THIS time, the only source on record is a 'security' company that seems to be staffed/directed entirely by ex CIA and Mossad operatives. They obfuscate their claim by refusing to name the actual company, and again fail to deliver any evidence.

You'd think that if Supermicro were shipping these hardware-hacked boards in bulk, as suggested by the original article, that some shred of evidence would be forthcoming.

when the chinese secret service calls....

[lkcl]

.... you don't say no. if you recall i think it was "Kingsmen", samuel jackson saying, "y'know, the chinese secret service is so secret it doesn't even have a name?" that's because it's operated along isolated cell network lines. *not even the chinese government* can contact those independent cell networks! the only way to "contact" them is for the chinese government - just like everyone else - to make a bit of a fuss, publish a press release and hope like hell that the relevant cell happens to be reading the local or national news.

"Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server's Ethernet connector"

translation: someone from an unidentifiable cell called someone in supermicro up, and sai something along the lines of, "we know where you live, we know where your children go to school. we know the manager at the bank and how much is in your bank account, and we know where the bank manager lives as well. now, _about_ those servers you ship to the USA..."

Please forgive them

[Anonymous Coward]

"Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones."

Take a look at a google image search for "motherboard" and see if you can find an RJ-45 socket that doesn't have a metal shield around it for RF blocking.

Please forgive them, for they do not know.

They have tried their very best, in portraying themselves as 'experts', but old timers like you and me know otherwise.

They are doing the thing they do to serve their master - By making China looks ridiculously bad they might be able to reap some rewards from their master.

that's directly from NSA's playbook

[sxpert]

implant in ethernet connector point to NSA's ANT catalog,
either "COTTONMOUTHIII" https://nsa.gov1.info/dni/nsa-...
or "FIREWALK" https://nsa.gov1.info/dni/nsa-...

this whole thing sounds more and more suspicious

[sxpert]

It looks as if someone is attempting to raise anti-china sentiment, with the goal of getting USA manufacturing back in shape... surely it couldn't be the US governement (haha)...

Walter White?

[Anonymous Coward]

"Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the serverâ(TM)s Ethernet connector, a component that's used to attach network cables to the computer, Appleboum said."

Minor details - didn't Bloomberg say it was a chip embedded on the mother board circuitry? So now it's on the ethernet connector... To some its like saying China is Japan ...

industry standard?

[Anonymous Coward]

> Could you fit a 10G transceiver, phy, mac and stack inside the connector? Why would you?

Yes. Lots of blades have plug and play phys interfaces smaller than your pinky, which handle the eth or fibre and present a unified interface to the backplane. This has been common practice for >10y, since I remember loving the idea (what, you dn't have to open cases to change cable types?!) the very first time I was allowed in a real server room, around 2007.

Yossi Appleboum, BB's source for second story, hat

[deaddeng]

Yossi Appleboum Disagrees with How Bloomberg is Positioning His Research ...
ServeTheHome â ... â Other Components