China Infiltrated Apple, Amazon and Other US Companies Using Spy Chips on Servers, According To Bloomberg; Apple, and Amazon, Among Others Refute the Report (bloomberg.com) 369
Data center equipment run by Amazon Web Services and Apple were subject to surveillance from the Chinese government via a tiny microchip inserted during the equipment manufacturing process, Bloomberg BusinessWeek reported Thursday, citing 17 people at Apple, Amazon, and U.S. government security officials, among others. The compromised chips in question came from a server company called Supermicro that assembled machines used in the centers, the report added. The scrutiny of these chips, which were used for gathering intellectual property and trade secrets from American companies, have also been the subject of an ongoing top secret U.S. government investigation, which started in 2015, the news outlet reported. Amazon, which runs AWS, Apple, and Supermicro have disputed summaries of Bloomberg BusinessWeek's reporting.
The report states that Amazon became aware of a Supermicro's tiny microchip nested on the server motherboards of Elemental Technologies, a Portland, Oregon based company, as part of a due diligence ahead of acquiring the company in 2015. Amazon acquired Elemental as it prepared to use its technologies for what is now known as Prime Video, its video streaming service. The report adds that Amazon informed the FBI of its findings. From the report: One official says investigators found that it eventually affected almost 30 companies, including a major bank, government contractors, and the world's most valuable company, Apple. Apple was an important Supermicro customer and had planned to order more than 30,000 of its servers in two years for a new global network of data centers. Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons. [...] [Update: Some counterpoint: According to an earlier report by The Information, security concerns were indeed a reason why Apple and Supermicro parted ways.] A U.S. official says the government's probe is still examining whether spies were planted inside Supermicro or other American companies to aid the attack. Some background on Supermicro, courtesy of Bloomberg: Today, Supermicro sells more server motherboards than almost anyone else. It also dominates the $1 billion market for boards used in special-purpose computers, from MRI machines to weapons systems. Its motherboards can be found in made-to-order server setups at banks, hedge funds, cloud computing providers, and web-hosting services, among other places. Supermicro has assembly facilities in California, the Netherlands, and Taiwan, but its motherboards -- its core product -- are nearly all manufactured by contractors in China. The company's pitch to customers hinges on unmatched customization, made possible by hundreds of full-time engineers and a catalog encompassing more than 600 designs. Further reading: Amazon Offloaded Its Chinese Server Business Because it Was Compromised, Report Says.
The report states that Amazon became aware of a Supermicro's tiny microchip nested on the server motherboards of Elemental Technologies, a Portland, Oregon based company, as part of a due diligence ahead of acquiring the company in 2015. Amazon acquired Elemental as it prepared to use its technologies for what is now known as Prime Video, its video streaming service. The report adds that Amazon informed the FBI of its findings. From the report: One official says investigators found that it eventually affected almost 30 companies, including a major bank, government contractors, and the world's most valuable company, Apple. Apple was an important Supermicro customer and had planned to order more than 30,000 of its servers in two years for a new global network of data centers. Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons. [...] [Update: Some counterpoint: According to an earlier report by The Information, security concerns were indeed a reason why Apple and Supermicro parted ways.] A U.S. official says the government's probe is still examining whether spies were planted inside Supermicro or other American companies to aid the attack. Some background on Supermicro, courtesy of Bloomberg: Today, Supermicro sells more server motherboards than almost anyone else. It also dominates the $1 billion market for boards used in special-purpose computers, from MRI machines to weapons systems. Its motherboards can be found in made-to-order server setups at banks, hedge funds, cloud computing providers, and web-hosting services, among other places. Supermicro has assembly facilities in California, the Netherlands, and Taiwan, but its motherboards -- its core product -- are nearly all manufactured by contractors in China. The company's pitch to customers hinges on unmatched customization, made possible by hundreds of full-time engineers and a catalog encompassing more than 600 designs. Further reading: Amazon Offloaded Its Chinese Server Business Because it Was Compromised, Report Says.
Ever get tired of being Wong? (Score:4, Insightful)
Chinese market poison as baby food. Nobody should be doing business with them.
Re: Ever get tired of being Wong? (Score:5, Informative)
Re: Ever get tired of being Wong? (Score:5, Interesting)
Heads rolled after the fact, yes. Mostly to save face, I think, and make a public message of "Look! See, we have laws too!" Every time it happens, it comes off looking more like PR and and an attempt to hobble further investigation. My question is always: what controls are you pitting in place to make sure this doesn't happen again?
Whether it's adulterated baby formula, or adulterated medicine, or adulterated pork buns, t comes down to someone taking risks to make a fast profit. Plenty of that happens everywhere in the world, but it seems to be in China that the controls are lax enough and the people are desperate enough to actually KILL THEIR CUSTOMERS in order to make money.
Re: Ever get tired of being Wong? (Score:3)
Re: Ever get tired of being Wong? (Score:3, Informative)
Great news, it was both. Many, many different incidents to choose from. Many different products.
Re: (Score:2, Interesting)
I was talking about http://toxikonconsortium.org/F... [toxikonconsortium.org]
which was medicine in Haiti.
The Chinese manufacturer had replace glycerine with propylene glycol to save money. Lots of children died.
Are you talking about a different incident?
Re: Ever get tired of being Wong? (Score:4, Informative)
The Chinese manufacturer had replace glycerine with propylene glycol to save money. Lots of children died.
I'm no toxicologist but I think you must mean "Diethylene glycol" not "Propylene Glycol"... if you look up the later on wikipedia in the human safety section [1] it states:
The acute oral toxicity of propylene glycol (E1520) is very low, and large quantities are required to cause perceptible health damage in humans
Where as Diethylene glycol (which is in the paper you reference at the very start of the toxological analysis section) and the wikipedia article [2] suggests it has high toxicity (albeit only empirically due to involvement in mass poisonings.):
Despite the discovery of DEG’s toxicity in 1937 and its involvement in mass poisonings around the world, the information available regarding human toxicity is limited. Some authors suggest the minimum toxic dose is estimated at 0.14 mg/kg of body weight and the lethal dose is between 1.0 and 1.63 g/kg of body weight...
[1] https://en.wikipedia.org/wiki/... [wikipedia.org] [2] https://en.wikipedia.org/wiki/... [wikipedia.org] Anyway it's nasty stuff... however it should be noted that most of these types of events on the Asian continent are more due to lack of strict regulation on food and medicine than malice. Fake medicine is a real problem over there due to the distribution channels, people but stuff in shops with no way to know how authentic it is... and we all know how good the Chinese are at making rip-offs, unfortunately when you swap out expensive components of a medicine without really knowing what you are doing the difference is death rather than a short lived knock-off.
Re: (Score:2)
I think he was talking about this one:
https://en.wikipedia.org/wiki/... [wikipedia.org]
In US more likely to have employee inform press (Score:2)
Yeah, well, nobody should be doing business with the US either, it's not like they don't do stuff like this.
In the US we are more likely to see an employee inform the press if an employer is doing stuff like this. In China, not so much.
Re: (Score:2, Insightful)
Yeah, well, nobody should be doing business with the US either, it's not like they don't do stuff like this.
Cite a case of a private business in the US injecting chips into a trillion dollar foreign company in order to steal their proprietary secrets.
Cite a case of the US government funding a branch of their military to steal proprietary secrets of foreign companies in order to pass that information on to US businesses for competitive purposes.
There's only one country that has done "stuff like this" and only one country that continues to do so. US == Evil is the zeitgeist but it simply isn't true.
Apple and Others Respond (Score:4, Informative)
Re: (Score:3, Informative)
Apple also says that they never intentionally slow down old phones and that police can't hack the iPhone.
Who cares what Apple says? They lie all the time.
Re: (Score:2)
Re: Apple and Others Respond (Score:2, Interesting)
"no reasonable person would believe [us]"
Didn't they recently suffer from a severe lapse in manufacturing, allowing the Intel Management Engine to be reprogrammed? The one that has full access to the Cpu?
Prior, they had root access without passwords.
How can they refute it so strongly? Both of those gave full access to the computer. Both had to have been introduced by someone
Re:Apple and Others Respond (Score:5, Insightful)
Sure, I bet it was strongly worded. With all of Apple's production in China, the Chinese could stop every iDevice from being made until Apple restaged manufacturing outside of China. While Apple has the cash reserves to weather the lack of product for over a year while that happens, the decline in market share during that interregnum would be near-fatal, if not fatal.
Re:Apple and Others Respond (Score:5, Interesting)
As a guy who DESIGNS hardware, I can confidently say this....
Yes, it is possible to make a tiny chip that can disguise itself as a capacitor or a resistor. However, this part must be designed into the board for that purpose. There is such a thing as a "one wire interface." The part that it is talking to must know it is there and be intentionally taking to it.
However, adding a chip like this (a two-terminal part as shown in the article) to an existing product not designed for it seems very problematic. I can immediately think of three options for such a ghost part:
1) Pretends to be a signal filter capacitor. Possible, but it likely would not have the power to actively disrupt the signal flowing past it. This thing would only have access to ONE power rail and can get parasitic power off of the signal. But this kind of part would not have the power to actively disrupt the signal.
2) Pretends to be a resistor. This is even worse, because usually low-value resistors are used, so the voltage drop would be minimal. I cannot imagine how this part would get its power.
3) Pretend to be a pull-up or pull-down resistor. This might be useful in mis-configuring a part. It could alter its configuration to get the board into some sort of test mode. The problem is that this configuration would not allow the chip to receive any information from the outside world. So how do you control it?
Of course, this assumes that the part really is just a two-terminal part (as shown in the article). If they replace an active device, something with three or more pins, then all of those limitations go away. Some sort of level converter in a signal path would be an ideal candidate. If you could drop a chip somewhere in the Ethernet interface path, then you can do anything you want... But those chips would look like chips and could not be mistaken for a passive component.
Re:Apple and Others Respond (Score:5, Interesting)
Now I'm not saying I'm buying this story. The very specific, very adamant denials from Amazon isn't the type of denial you would normally expect in a situation like this if they coudln't talk. But it is possible.
Re: (Score:3)
If they could modify the board, then yes, this sort of thing becomes MUCH more likely.
The down side to this is that modifications MIGHT be detectable by tests. Lots of things can go wrong while building and assembling a board so tests are standard. Mucking about with it might create changes that can be detected during a standard bed-of-nails test. If the same company controls the test, then they could get away with it easily.
The other side is that changing the board is easy to prove once you discover it.
Re: (Score:3)
If they could modify the board, then yes, this sort of thing becomes MUCH more likely.
The down side to this is that modifications MIGHT be detectable by tests. Lots of things can go wrong while building and assembling a board so tests are standard. Mucking about with it might create changes that can be detected during a standard bed-of-nails test. If the same company controls the test, then they could get away with it easily.
The other side is that changing the board is easy to prove once you discover it.
That actually depends. Supposedly this thing is sitting on some data lines between the host CPU and the BMC. Having hardware debug level access to the CPU, it may be able to detect the current state of the system. For instance, Intel has a check you can make to see if the system has been marked as “End of Manufacturing” which is likely when they would do any quality tests. The chip could intelligently change behavior based on all kinds of things, depending on how sophisticated they’re
Re: (Score:2)
How on earth could they modify supermicro's design without Supermicro knowing? If SM doesn't design their own boards that might be possible but I doubt that's the case.
About the only way I can see something like this type of compromise would be useful would be to either replace the aspeed BMC or hook something into the BMC.
Both would likely be noticed by a QC check of the boards. The sneaky one would be to replace the whole Aspeed BMC with a custom chip but you'd have the problem of having to run the BMC ex
Re: (Score:2)
Consider this info from public sources... Apple and AWS both operate custom hardware in their data centers and both companies design this hardware themselves. They have dedicated hardware, OS and network security teams... both have hardware design review and acceptance criteria for new designs, and both have security acceptance testing and inspection for incoming parts. Both perform integration testing and network commissioning procedures, and both have operational security and application security controls and alarms monitoring their production environments. The idea that a single downstream supplier could break all of these controls without leaving any evidence is extremely unlikely. I'd say it's more likely a disinformation campaign than an actual data security risk.
Is it unlikely? They will test and inspect server #1 off the line like crazy. They won't do the same level of testing for server #100. or #1000. The compromise we are talking about here was a small component to enable access, not something shipping out data by itself. And remember, these are servers being built by contractors in China, so they are out of the control of the designers here in the US during manufacturing. And we are talking about a state actor with, from a practical standpoint, unlimited res
Re: (Score:2)
Frankly, I smell a rat, not because its implausible to replace chips, but that it wouldn't have been spotted long ago and publicized. All these companies are denying that this is happening and I have yet to see compelling tech
Re: (Score:2)
Hmm I think Apple would love to find evidence that the PC ecosystem is compromised and fundamentally flawed.
Re: (Score:2)
Apples motherboards (which they call logic boards, but they're literally the same damn thing) simple contain a superfluous bit of hardware (funny, TFA is about just that sort of thing) that unmodified MacOS checks for the presence of before booting; but it's simple to work around, and that little chip, present or not, has no affect
Back up your claims (Score:5, Insightful)
Where'd the chips come from? They are physical things that exist. Do you think Bloomberg faked the paper trail all the way up the supply chain (..)
Bloomberg says A, Apple, Amazon etc say B. That's where you need to back up your claim.
If Bloomberg did its job, it should have some expert(s) on call that can tell you what motherboard, what chip / where on the board, what pinout, what it does, and how they arrived at those findings. That's the core of their story after all.
If Bloomberg does, just publish those technical details & call it a day. If Bloomberg doesn't, then yes they are talking out of their nose and Apple, Amazon & co have every right to criticize them.
Re: Back up your claims (Score:3)
Re: (Score:3)
Bloomberg is making an assertion, so the burden is on them to back it up with evidence. So far they have nothing.
These are all public companies, and there are significant penalties for intentionally lying about things that affect their stock price (ask Elon Musk about that). Since all of them are saying the same thing, and saying it clearly, unambiguously, and emphatically, it is very likely they are telling the truth.
And the media blames russia (Score:5, Insightful)
Re: (Score:3)
China been doing this for years and it's only just coming out.
Or is it that Bloomberg has been doing this for years and the parties they're talking about are all tired of evidence-free reporting? I don't care about the statement from China's government, because Chinese government. But the people at Apple and Amazon aren't exactly slouches when it comes to dealing thousands of servers and security issues. If thousands of servers were phoning home, they'd know.
Re:And the media blames russia (Score:5, Insightful)
Re: (Score:2)
On the other hand, knowingly having compromised servers like that would be a PR nightmare, so Apple and Amazon would also have an incentive to say 'everything is fine'. That is what makes stories like this so frustrating... unless the FBI chimes in, everyone is saying pretty much what you would expect to say regardless of if the story is accurate or not.
Not only that, but if it WAS discovered and our government knew, we certainly wouldn't come out and confront China about it. We would have the advantage because we could then provide misinformation to a country that was spying on us.
Re: (Score:2)
"What would this chip do, exactly?"
I guess you didn't RTFA?
Re:And the media blames russia (Score:5, Informative)
If you read the article it says the chip was tied to the BMC, aka the IPMI implementation.
So in short, if the machine is on the internet, it's susceptible to having a backdoor through it's own IPMI subsystem. Most legitimate data centers already knew about weaknesses in IPMI and put all the IPMI ports behind a VPN. I can't say the same for those who put bare servers on the internet.
I'd like to know when this started though, because if it's as true as it sounds (nothing in the article really suggests anything far fetched) then ALL data centers need to be scrubbed. That means large gains for Dell and HP, but at the same time, THEY also make their boards in China as well, so we may in fact find the same kind of tampering on their server boards.
So take the story with a bit of salt, because if this is really as bad as it sounds, then affected networks should see the spurious traffic on their firewalls (you are running a firewall to your corporate network right?)
Re: (Score:3)
And who makes the firewall?
Re:Would you trust the FBI? (Score:5, Insightful)
Those cards turn up on eBay for peanuts, and TFA identifies the location of the chip. It should be possible to get one.
Re: (Score:2)
WOW.
Mod parent +1 informative.
Re: (Score:3)
Still not quite as much respect as I'm
Re: (Score:2)
Complete lack of any hard evidence to support Bloomberg's claims aside, if you were to take it at face value then you've got to hand the Amazon team some *serious* respect for noticing that there was an additional chip the size of a pencil tip on some of a their server boards that was not present on others or in the design spec. And that's before you consider that they didn't just blow it off and supposedly figured out at least some of the things that it was up to.
According to the article, Amazon saw unexplained network traffic during their due diligence inspections of Elemental's operations, couldn't explain it themselves, but did isolate it to specific machines, and shipped them off to a security firm in Canada to figure them out.
That Canadian company is the one who deserves serious respect for determining that nothing in the CPU or the OS was anything other than as expected and so the problem must be somewhere on the board. They're the ones who went over those bo
Apple's Statement says Bloomberg is spreading FUD (Score:2)
See Apple's Statement here: https://www.bloomberg.com/news... [bloomberg.com]
Looks like Bloomberg only believes their reporter's secret sources and refuses to believe Apple when they investigate when consulted for comments and refute repeatedly the allegations.
China, China, China. (Score:2, Informative)
Re: (Score:2)
Storing it in the wangpan. [1]
[1] Any Chinese speakers care to confirm that means "cloud filestore" ?
Stolen data has to be transmitted (Score:2)
Let's assume the networking devices were compromised, and they were part of the private intranet on which trade secrets were transmitted. The data still has to be transmitted off of that network somehow. That would certainly raise major flags with these kinds of tech companies. Unless.... it required some physical connection to the device, such as inserting a USB drive to download data directly.
Re: (Score:2)
Re:Stolen data has to be transmitted (Score:4, Informative)
This is only a small part of the issues I have about the report. What is the chip monitoring or able to monitor? How is it programmed?
It's not impossible to envisage something that, say, could monitor Ethernet for a string and use that to program itself, but something that can both see an incoming Ethernet packet and see what the CPU is doing is harder to conceptualize.
I know this is Slashdot but... did you read the article? Supposedly this chip was put on the BMC lines that allow it to modify basically anything going to the CPU. They could have even tweaked the firmware on the board through the BMC. The chip does nothing but detect the loading of the OS and insert instructions that it downloads off of a known host. There was no data exfiltrated as far as anyone can tell. It was just lying dormant or used as a vector to penetrate other areas of the network. They were able to identify the 30 companies affected by monitoring traffic and/or hacking the C&C server used. But it was not detected because, as far as they can tell, the compromised systems themselves were never used to exfiltrate data.
Re: (Score:3)
Re: (Score:3)
Yes I did, and it doesn't really answer my question, like I said it would have to be sitting on an externally accessible bus, like the Ethernet bus, in order to receive the instructions on what to do. Being able to monitor the operating system loading is next to useless, unless the OS itself is compromised, in which case you have far bigger problems than a 6502 sitting somewhere it shouldn't.
Which is why I asked where exactly it was. Saying it's on the "BMC lines" is... not an answer.
Do you know what a BMC does? The lines it is sitting on allows it to modify instructions on the CPU. You can actually use those exact same lines to perform remote hardware debugging through the BMC. And by hardware debugging, I mean anything that happens in the board initialization process after SEC finishes. So PEI onward in a UEFI environment. The BMC also has its own connection to the LAN controller(s) on the PCH. It can be used to power on / off, flash firmware over the SPI bus, interact with the
Re: Stolen data has to be transmitted (Score:3)
The NSA doesn't have access to most manufacturing plants. Chinese government does. My visit to China to see my friend recently who owns large swatches of buildings with some big name manufacturers, allowed me to waltz in anyone's plant despite "Intellectual Property" (Landlord has some huge privileges in China). Because of his government connections, no one dared question him or me why I was in there taking pictures. No one is going to dare report it happening to the affected companies either that I was in
I smell a lawsuit (Score:2)
Since Amazon has said that reports of it finding a chip or working with the FBI are false it does not look good for Bloomberg.
Re: (Score:2, Insightful)
And if there is no lawsuit, what does that tell you?
(That was the rhetorical, but here's the answer: Somebody would prefer to keep the details out of a courtroom.)
I'd like to hear facts (Score:2)
Turn About (Score:5, Interesting)
Re:Turn About (Score:5, Informative)
Not to electronics sold inside the US. And, since that's where I buy my electronics, that's what I care about.
Also, you know, I'd rather the US have my data than the Chinese. I'd prefer neither, but between the two, definitely the US.
Re:Turn About (Score:5, Insightful)
20 year old news... (Score:3)
What? You're just now learning about it and act all surprised...please.
There was never any question what price U.S. manufacturer's were willing to pay outsourcing to Asia. It was just a question how long.
Apple et. al. are not stupid clucks, they went over motherboards with a microscope. They saw exactly how true to their design finished goods matched. Amazon paid a 3rd party due diligence and its public. SO, we have the answer now.
Re: (Score:2)
Apple et. al. are not stupid clucks, they went over motherboards with a microscope. They saw exactly how true to their design finished goods matched. Amazon paid a 3rd party due diligence and its public. SO, we have the answer now.
Please. Do you think that each and every motherboard was inspected this way? Just one company called out in the article, Elemental, ordered thousands of units. After they confirm that the units are up to spec they're not going to continue any deep inspection.
If you read the article, you'll notice that much of the deception happened when an overloaded factory sub-contracted the work; the sub-contractors were coerced into varying from the design and inserting the chips. A subset of motherboards containin
So... (Score:5, Insightful)
...let's hear more from people whinging about Trump's 'trade war' with China.
China's been a shitty actor on the world stage since they bred themselves out of irrelevancy.
Foreign companies have to establish a Chinese business, owned 51% by Chinese who almost always end up being a front for the PLA. ...and yet we should curry their favor so we can keep buying $9 folding chairs?
Draconian censorship laws. No free speech. No freedom of religion.
Currency manipulation and disregard for norms of international economic (and other) reporting.
Military occupation and absorption of neighbors it deems "were *actually* China anyway".
Sorry Hong Kongers, I guess you don't get to keep democracy and nobody cares...
An arbitrary, dangerously confrontational foreign policy including sweeping territorial claims.
Environmental destruction with impunity.
I don't like Donald Trump for a number of reasons, but the US confrontation with China is LONG past due; waiting any longer would likely make it military when China finally gets brazen enough to try to grab Taiwan.
Re: (Score:2)
There's stupid confrontation with China and then there is intelligent confrontation with China. Trump's is the stupid kind by giving the Chinese rump government the tools with which to fight back. And pissing off the U.S. allies, screwing up other trade agreements, etc. is not a recipe for successfully countering Chinese aggression.
Re: (Score:3)
Trump's public confrontation with China may be stupid, but my assumption is he lacks the mental horsepower to actually decide what specific sanctions/tariffs should be imposed in this little dustup.
My guess is the actual technical details are the brainchild of people who have a deeper understanding of the Chinese economy and its vulnerabilities and they are more measured and strategic than simply slapping tariffs on stuff because it says "made in China". The people coming with specific tariffs have likely
The real problem... (Score:5, Insightful)
I don't know to what degree "China" (it's government, it's people, or it's corporations, state owned or otherwise) are spying, but I do know it's not 0, not even close to 0. I have been close to accusations and convictions, they are absolutely spying using any available means. That's not surprising. If it made any sense to do it, adding stray hardware/software to a PC is definitely a viable approach to compromising it.
The real issue is technical. How do we create a secure compute environment? Apple has taken the route on its phones of building a very effective and secure trust chain. It is pretty hard for an unauthorized user to slip in stray firmware on their phones, I don't want to say impossible because there are some known and pretty exotic exploits. But very hard. Their design is such that even their MFGs cannot sneak in stray code to spy on you. The weakest point is still the single authorized user, and their ability to protect their passwords and biometrics. Apple's route also makes you, the owner, a perpetual customer rather than an owner. If they choose to lock you out, there's nothing you can do about it, your $1k phone is a paperweight.
PCs (I'm including desktops, servers and laptops) on the other hand are pretty much a free for all. The MFG can sneak on just about anything in their BIOS/EFI implementation, and anyone up and down the chain can do so without much oversight. It's a pretty open and competitive market, with many small players of little to no account, all trying to make the sale. Each of them provides their own hardware, and some EFI implementation they probably bought and then tailored to their implementation. Someone could also have added backdoors. That in turn hands off to my choice of OSes, which themselves could easily be compromised and I wouldn't know better until something happened. I am unquestionably the owner of this system, and can do anything I would like, but I also cannot rely on anything up and down the system. I'm the owner of a very leaky boat.
What we need is a system that can both be trustworthy and robust to middle-man attackers who may, at times, have direct hardware access, but still allows me to be the absolute owner of my hardware. I may make bad choices, those bad choices may compromise my system, but I need a foolproof way of knowing when I'm making a bad choice. It's not that easy of a problem in the current ecosystem, and we're waiting for someone to get caught doing something bad that forces our hand.
Re: (Score:2)
Umm... except sue.
Re: (Score:3, Informative)
Can't even do that - the first thing you do when the iPhone turns on is agree to a clickwrap license where you give up your right to sue and agree to binding arbitration with an arbiter of Apple's choosing. This same agreement also lets Apple remotely brick your phone with no recourse.
Re: (Score:2)
Trusted Platform Module (TPM) [wikipedia.org]
Although TPM only addresses some of the concerns. It's only useful for detecting hardware interference post-installation, and only as long as the manufacturer doesn't leak the burned-in keys - but that's not something that could ever be easily solved, short of fabricating everything in-house.
"Anyone with access to the private endorsement key would be able to forge the chip's identity and break some of the security that the chip provides. Thus, the security of the TPM relies enti
Re: (Score:2)
I'm not saying we shouldn't let them burn. I'm saying there's nothing stopping their next competitor from doing exactly the same thing, better.
Joker Products! (Score:2)
The Joke is You Probably Already Bought Them!
Https://www.youtube.com/embed/cROY4m4Ftiw
Explain to me... (Score:2)
Ok, explain this to me...
How is a single chip on a motherboard going to do the following and do it without someone noticing:
1: Intercept data on the server without knowledge of what OS is running and/or without a driver to facilitate OS access?
2: Send that data to some 3rd party, through a firewall, without the bandwidth usage being noticed?
I know someone is going to answer #1 by saying "it'll just send everything in memory / traveling over the bus", but then you wind up hitting #2 because that would use
Re: (Score:3)
Assuming the article is correct:
1. They were connected to the baseboard management controller (BMC) - so they were basically opening up the IPMI
2. My takeaway would be that you could use small command and control which would be very hard to spot, then make other changes which could exfiltrate only the data you were interested in.
Re: (Score:2)
While it sounds super scary to "plant a chip" and "have a backdoor", the actual physical implementation isn't so straightforward. The IC shown is very small. It seems very unlikely that there just happen to be all the necessary PCB traces all grouped together so that a tiny little IC ca
Re: (Score:2)
Re: (Score:2)
How is a single chip on a motherboard going to do the following and do it without someone noticing:
1: Intercept data on the server without knowledge of what OS is running and/or without a driver to facilitate OS access?
2: Send that data to some 3rd party, through a firewall, without the bandwidth usage being noticed?
The entire point of this article is that traffic was noticed. Amazon wanted to buy Elemental. Amazon was auditing Elemental. Amazon's auditors found unexplained network traffic. Not very much of it, but they found some. And in the process of trying to explain it, somebody got very intrigued, and shipped off the servers that were sending unexplained packets to a security firm in Canada, and that's how Bloomberg has a story to write about. The data was noticed.
There's a reason why US spy agencies prefer
Glad trump is in office (Score:2)
Re: (Score:3)
Seriously, I expect that trump will push major changes in the west over this.
He’s already tweeted that affected companies should pick up and move their manufacturing to Russia.
Mod Parent up, Please (Score:2)
Actually, that was pretty good.
. Have to admit that I will be happy when he is booked for treason, but for dealing with China, he has done more than any president since Kennedy.
Re: (Score:2)
ROFL!!!
I never have mod points when I would just LOVE to have mod points. You'd be getting one for really, truly making me laugh out loud over that!
Thanks for brightening my day.
Refute or deny? (Score:2)
It sounds to me like the corporations named denied the report. They're a long, long way from refuting it.
Make our own crap. (Score:2)
They told us we were too dumb to make our own stuff.
Then they told us that people are too expensive to make our own stuff.
Then they told us after automating the factory floor, making labor costs insignificant we have to have a monopoly or we can't compete.
I wonder what their excuse will be now why we can't make our own stuff?
Re: (Score:3)
They told us we were too dumb to make our own stuff.
Then they told us that people are too expensive to make our own stuff.
Then they told us after automating the factory floor, making labor costs insignificant we have to have a monopoly or we can't compete.
I wonder what their excuse will be now why we can't make our own stuff?
The excuse, which isn't an excuse, is that we don't know how. It's quite literally true. Building a high frequency mainboard correctly is nontrivial, and while we know how to design them, and know how to set up automated tests for them, we don't know all the little tricks that actual manufacturers have learned by doing the job for decades.
Sparkfun has been finding that out, and documenting some of it publicly. They bought a pick and place machine so they could fabricate their own boards for some of the s
Offshore chips are an *obvious* security risk. (Score:5, Insightful)
Buying chips offshore is a national security risk and always has been. If you're stupid enough to think that the Chinese military won't exploit chips/software/tech products bound for the USA for their own benefit, I have a bridge I can sell you.
Of course, as always, profits before country. Can't restrict Northrop Grumman, ya know. And you can bet the current crop of republican technopeasants don't have this on their radar.
Orwell (Score:2)
Orwell was an optimist. Nation states are all posturing to see who can create the culture most similar to 1984 without anyone raising the alarm. "Boil the frog" is the new mantra for this effort - take away freedoms and security in small bites and before you know it you've lost everything.
As a user of Super Micro motherboards... (Score:3)
I'd like to hear about mitigation. Would simply not configuring an IP address on the BMC be enough?
I generally configure whatever kind of BMC I have available on a server (such as HPE iLO or Dell iDRAC) because I like the idea of low-level remote access, but in truth I can't recall ever having used it to solve a problem.
History Repeats (Score:3)
How to check hardware? (Score:3)
Re:Reporting? (Score:5, Insightful)
Everyone involved on both sides has come out publicly to say Bloomberg is wrong. Why are we still talking about it?
All parties involved have it in their vested interest to deny this.
Re:Reporting? (Score:5, Insightful)
Everyone involved on both sides has come out publicly to say Bloomberg is wrong. Why are we still talking about it?
All parties involved have it in their vested interest to deny this.
All parties are required by law to deny this. It's a classified investigation which Bloomberg says is still open. According to Bloomberg's reporting, they don't just want to deny it—they have to deny it. With the Supermicro boards in question in use by the DOD and the CIA, it's quite literally a matter of national security.
Re: (Score:2)
Re: (Score:3)
Re: Reporting? (Score:3)
Re:Function? Position? 6 Pins? (Score:5, Informative)
But I'll be kind to the handicapped today.
The device interacted with the BMC, which has lowest-level access to everything. The device would use the BMC to inject code into memory, allowing remote exploits, and phone home.
Re: (Score:2)
Given the complexity and cost of such a hack, I would say a firmware hack would have been much simpler and harder to detect.
Simply code in a weakness in the firmware to allow for external code injection, then you're done.
It'd be much cheaper and harder to detect.
Re: (Score:2)
He was 41 and a marathon runner. He was probably killed off by his ChiCom overlords.
Most definitely suspicious -- middle-aged marathon runners [wikipedia.org] never [nih.gov] die [foxnews.com] of sudden heart attacks [active.com].
What's that line about truth lacing its shoes? (Score:5, Interesting)
Bloomberg published responses from the companies involved [bloomberg.com]. Here are some excerpts that give you a sense of how they responded...
Amazon:
It’s untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modifications when acquiring Elemental. It’s also untrue that AWS knew about servers containing malicious chips or modifications in data centers based in China, or that AWS worked with the FBI to investigate or provide data about malicious hardware. [...]
And they go on to say a lot more that categorically denies Bloomberg's claims while making a mention of an unrelated firmware incident from 2016.
Apple:
Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them. We have repeatedly and consistently offered factual responses, on the record, refuting virtually every aspect of Bloomberg’s story relating to Apple.
On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement. [...]
And they go on to say a lot more that categorically denies Bloomberg's claims while suggesting that Bloomberg may be confused about the 2016 firmware incident.
Super Micro:
While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard. We are not aware of any customer dropping Supermicro as a supplier for this type of issue.
And they go on to say a lot more that categorically denies Bloomberg's claims, including denying that they even make the chips that were allegedly compromised and that these companies supposedly purchased from them.
Meanwhile, here's a complete list of Bloomberg's sources who were willing to speak on the record:
*crickets*
Re: (Score:2, Insightful)
Meanwhile, here's a complete list of Bloomberg's sources who were willing to speak on the record:
*crickets*
Were Woodward and Bernstein's Watergate source(s), e.g., Deepthroat, willing to have their names published?
Re: (Score:3)
Re: (Score:3)
Sounds to me like theoretically there's a simple (well, for me, or someone with my skill-set at least) way to determine if any of this is true or not: A comprehensive physical examination of Supermicro server motherboards being used in critical applications. If something that's not on the BOM for the PCB has been glued to the board and blue-wired into it, then it obviously doesn't belong there and is suspect. Any and all silicon should also be able to be identified by it's manufacturers' part number and it's existence on the PCB justified. Furthermore the BIOS should not have any extraneous code in it that either runs on the main processor cores or that loads into the various microcontroller cores found in the chipset of any modern computer. Hiding malicious code that only lives in RAM is one thing, but anything physical or that lives permanently in something physical is literally a smoking gun and should be able to be sussed out, you really can't hide it. I have to say though it's pretty cheeky of a manufacturer, Chinese or not, to do something like this, if in fact they have. Malware is one thing, something physical is a completely different ballgame.
From my understanding of what was done, there is no way the firmware could know of, or detect this attack as the firmware itself cannot be trusted even if it is properly signed on the flash chip. The extra chip is sitting on lines between the BMC and the host CPU and can actually modify instructions on the CPU as it runs. Nothing after the initial platform security check (the first phase of the CPU initialization) can be trusted and that is only because the hardware debugging capabilities of these CPUs do
Re: What's that line about truth lacing its shoes? (Score:2)
"If something that's not on the BOM for the PCB has been glued to the board and blue-wired into it"
It was apparently not that obvious. They (allegedly) changed the board design at the factories making the Super Micro boards. Also,
Re: (Score:2)
Re: What's that line about truth lacing its shoes? (Score:4, Funny)
Just remember everyone: cloud computing and giving large corporations all of everyone's secret business data in one place is totally secure.
Keep repeating until you start to believe it.
Re: (Score:3)
While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard. We are not aware of any customer dropping Supermicro as a supplier for this type of issue.
And they go on to say a lot more that categorically denies Bloomberg's claims, including denying that they even make the chips that were allegedly compromised and that these companies supposedly purchased from them.
The article does not allege that Supermicro knows (as a corporation at least) or manufactures the chips in question. Supermicro designs boards and manufacturers in Taiwan and China make them. This chip is allegedly added onto some data lines between the BMC and host CPU during manufacture, and without actually being a part of the Supermicro design. Based on the images I have seen of this alleged chip, I don’t think anyone would even notice them if they were doing a standard quality review of a board
Re: (Score:2)
My datacenter provides me with decomm'd hardware purchased from Facebook. SuperMicro is one of the vendors. If I knew what to look for, I would. My SuperMicro server has BMC functionality tied to the main nic. It's conceptually possible to have the same vulnerability in my platform
Re:Bloomberg's Banned Since I Arrived (Score:4, Insightful)
How exactly does "slow, negotiated processes" fit with the military occupation of the South China Sea or Tibet?
Trump owns it now. (Score:2, Insightful)
If you want to take credit, you have to take blame. I give 2 shits about Hilllary. What does her being a completely worthless piece of shit have to do with the current President and others in charge of the country doing everything they can to undermine American democracy and the livelihood of the American citizenry?