Slashdot Mirror
New Evidence of Hacked Supermicro Hardware Found in US Telecom: Bloomberg (bloomberg.com)
A major U.S. telecommunications company discovered manipulated hardware from Super Micro Computer in its network and removed it in August, fresh evidence of tampering in China of critical technology components bound for the U.S., Bloomberg reported Tuesday. From the report: The security expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery following the publication of an investigative report in Bloomberg Businessweek that detailed how China's intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015. Appleboum previously worked in the technology unit of the Israeli Army Intelligence Corps and is now co-chief executive officer of Sepio Systems in Gaithersburg, Maryland. His firm specializes in hardware security and was hired to scan several large data centers belonging to the telecommunications company. Bloomberg is not identifying the company due to Appleboum's nondisclosure agreement with the client. Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server's Ethernet connector, a component that's used to attach network cables to the computer, Appleboum said.
Has any other news media outfit independently verified the Bloomberg claims?
Where is the evidence? They keep saying they have it. Why don't they show it?
Now Apple and others claim they have no idea what Bloomberg is talking about. Clearly something was installed on Supermicro servers to cause Apple and others to stop using them.
Report from early 2017
https://www.marketwatch.com/st...
Can they a least release the damn documents.
If they don't want to compromise the company just obfuscate the names with a fucking marker.
o better yet where this devices are for god sake.
Also from that era that they say. I haven't seen anything anomalous. The fact is that some of their IPMI stuff is vulnerable and they're not updating the firmware (eg. old versions of Dropbear SSH), so if you leave it on the Internet, it may get compromised.
On the other hand, I also don't leave that stuff on a routable VLAN. If it tries to connect to anything (and I haven't seen it reach out), I'd notice and it wouldn't work anyway. Sure the IPMI has some hooks into the rest of the hardware so it is potentially capable of doing 'weird stuff' to my Linux or Windows kernels (although it'd have to be pretty smart to intercept keyboard authentication, wait for someone to be away from the keyboard, automatically replay credentials, then load a workable kernel module to do that) and have the OS compromised do the dirty work, but then again, I haven't seen anything there either and we've used various integrity and antivirus systems from TripWire, Sophos and Cylance that probably would've noticed.
Custom electronics and digital signage for your business: www.evcircuits.com
The US government is going to bury this at all costs, either because it doesn't want egg on its face, or because it is complicit in this hacking. Perhaps these devices were installed at the behest of the NSA and the Chinese simply redesigned them to also send info to the Chinese government.
Not implausible, if you ask me.
According to the original article - the alleged Chinese culprit chip exploited via the BMC. Aspeed is the company that makes 99% of the BMC controllers in Supermicro boards. If China really did go through the trouble to develop a chip to exploit via Aspeed controllers.... why limit themselves to Supermicro? I know at least Tyan and Lenovo also use Aspeed. From China's intelligence perspective, they would want a solution that could work across multiple board vendors.
According to latest:
Really wish they would give us more to go on than just that. Not sure about other Slashdotters, but I have Tyan/Supermicro/Insert-Taiwanese-Motherboard-Manufacturer boards in production, and would really appreciate more information on what to look for.
Pics or it didn't happen.
This is an interesting story and all, but a targeted attack on a single machine using interception doesn't really make it likely there was compromise of Supermicro's supply chain at the factory level.
We know NSA intercepts Cisco routers, but that doesn't prove Cisco intentionally backdoors their machines for them in the factory.
...Why? Are Americans somehow incapable of being bribed to tweak a design? Does spending more on American parts mean your engineers are more likely to actually read the instruction manual and change defaults? Is an American developer going to oppose when their boss tells them to store passwords in plaintext, because the deadline's approaching and they refuse to delay for something the customer will probably never notice?
Checking the country of origin is a poor proxy for security. All it really means to have American sources is that when there's a breach, an American company has a slim hope to blame another American, and have a public trial to deflect the blame from their own mistakes.
Buy from whoever makes a quality product and shows the most interest in staying up-to-date with the latest security developments. Assume that all parts (including humans) will generally work as promised, but design your system with defense in depth, so any compromised subsystem will be blocked by other layers of protection.
You do not have a moral or legal right to do absolutely anything you want.
"Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones."
Take a look at a google image search for "motherboard" and see if you can find an RJ-45 socket that doesn't have a metal shield around it for RF blocking.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
Put in a tightly-configured firewall so your data doesn't get sent anywhere without your approval.
Keep management systems isolated so the data-holding servers can't modify that firewall.
Don't rely on tightly-integrated single-source solutions, so one vendor being compromised won't leave that firewall ineffectual.
Maintain independent layers of security that protect in case of another layer's failure.
That's defense in depth.
You do not have a moral or legal right to do absolutely anything you want.
Do you think that your corporate security team wants to admit that you were infiltrated?
The first dozen companies that admit this will likely see their stock price decline. Do you want your company to go first?
...in their first article on the subject:
There is a second article with the latest details.
Why put the chip on the Ethernet connector? You know this doesn't decrypt encrypted traffic.
To give it the ability to exchange command-and-control traffic with a remote controller while keeping it from the rest of the system (by "eating" the incoming packets for itself without handing them to the processor's stack, and sending outbound packets directly, again without processing them through the rest of the system.)
This is both convenient, and lets the C&C communicate with the victim box even when the bulk of the victim is shut down.
The Ethernet controller has lots of processing power to play with once it's subverted, control-channel access to the board management system, and already has power-when-the-system-is-down specifically so it can hear the wake-on-LAN packets and bring the machine up to full function - one less mechanism to build.
That's exactly what Intel did when they first started doing Management engines. It was only later versions where they moved it in deeper.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
TFA says: "Unusual communications from a Supermicro server ..." and on inspection the Ethernet hardware looked odd.
Maybe they just saw some Intel AMT traffic and components. B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Will anyone admit to being compromised by such a thing, if the story turns out to be true.
The impact on stock prices alone will probably keep companies from disclosing anything if they have any say so in the matter.
If you live in the US, you can't really be outraged about what China is doing when we have the NSA intercepting Cisco* hardware and tampering with it before shipping it on to the end customer. ( *Cisco is the only one we know about, who knows what else they have their hands in )
This is something everyone needs to think carefully about.
How much do you trust your supplier and what happens when relations with your supplier takes a bad turn ?
Still think relying on a single source for the majority of your goods is a great idea ?
NO! The first story was 'anonymous sources', who failed to provide any evidence or samples of the alleged hardware. Multiple credible sources have spoken up to refute the claims that they used tainted hardware or even found any such hack despite inspections.
THIS time, the only source on record is a 'security' company that seems to be staffed/directed entirely by ex CIA and Mossad operatives. They obfuscate their claim by refusing to name the actual company, and again fail to deliver any evidence.
You'd think that if Supermicro were shipping these hardware-hacked boards in bulk, as suggested by the original article, that some shred of evidence would be forthcoming.
j'ai découvert une démonstration vraiment admirable (de ce théorème général) que cette si
.... you don't say no. if you recall i think it was "Kingsmen", samuel jackson saying, "y'know, the chinese secret service is so secret it doesn't even have a name?" that's because it's operated along isolated cell network lines. *not even the chinese government* can contact those independent cell networks! the only way to "contact" them is for the chinese government - just like everyone else - to make a bit of a fuss, publish a press release and hope like hell that the relevant cell happens to be reading the local or national news.
"Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server's Ethernet connector"
translation: someone from an unidentifiable cell called someone in supermicro up, and sai something along the lines of, "we know where you live, we know where your children go to school. we know the manager at the bank and how much is in your bank account, and we know where the bank manager lives as well. now, _about_ those servers you ship to the USA..."
The whole point if this is that if they have a chip in your infrastructure, you have no defense.
That's the defeatist attitude that is so harmful to having meaningful security discussions.
Outward blocking firewall is great, unless they have their chip in it in which case they can be running an invisible proxy, or secret port knocking activated by other chips to trigger a "please forward this traffic".
But that means they need two chips, in two appliances, from probably two vendors, with two separate supply chains. For the price of bringing in a second-source vendor, you've doubled their attack cost.
Any defense you can implement, I can undermine for 1% of the effort
I think you mean "I can trivially move the goalposts a bit further".
if I already have access to the hardware via these exploits/backdoors and vulnerabilities.
Or in other words, "If everything is already completely breached, then everything is already completely breached, so everything will always be completely breached". Never mind that new designs are always being produced, new non-corrupted supply chains are being forged, and new mitigations keep being developed. In the real world, compatibility between published protocols is rare. What makes you think that different hardware tools, built by different intelligence teams at different times, will be compatible in any meaningful way?
The government-backed attacking engineers still have bureaucracy. They have a committee dictating how their chips will work. They have software bugs. They make mistakes. It's simply not realistic to assume that developing a widespread hardware-based attack is going to be something any organization can consistently execute while maintaining the extreme precision required for secrecy.
Hell, I breached hypervisors in the Virtual PC days before and after MS bought them. The Intel IME public disclosure invalidated a lot, but not all, of my private... extra curricular... access tools. Now you can breach it as a script kiddy.
Well, that's fantastic, but you still need to get your code to the system to run it... Then you need to have an analysis of what you're running on, and an exfiltration... A breach is just a tool. To make it an attack requires tactics, which I see as more opportunities for defense.
You do not have a moral or legal right to do absolutely anything you want.
implant in ethernet connector point to NSA's ANT catalog,
either "COTTONMOUTHIII" https://nsa.gov1.info/dni/nsa-...
or "FIREWALK" https://nsa.gov1.info/dni/nsa-...
It looks as if someone is attempting to raise anti-china sentiment, with the goal of getting USA manufacturing back in shape... surely it couldn't be the US governement (haha)...
Yossi Appleboum Disagrees with How Bloomberg is Positioning His Research ... ... â Other Components
ServeTheHome â
---