News for hackers. Stuff that matters.

A comment on The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple. Parent comment

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by alfalfasprout on Thursday October 04, 2018 @11:09AM (#18140564)
Wouldn't help. The BMC hardware has direct serial access to CPUs and other hardware in the machine. Communication is unencrypted. A hardware modification attack wouldn't touch the firmware at all and could still compromise IPMI functionality.
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by greglindahl on Thursday October 04, 2018 @03:28PM (#18142892)
Reducing the attack surface does help -- you're making perfection the enemy of the "somewhat better".
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by tomaskafka on Friday October 05, 2018 @02:39AM (#18146157)
No, against determined adversary it doesn't.
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by transpute on Thursday October 04, 2018 @07:28PM (#18144542)
Even now, supply chain hardware modification attacks remind people of fiction. However, the number of people known to be affected by buggy BMC firmware is orders of magnitude larger, as described two comments upthread:

> The system is basically designed to be as insecure as possible by default, and allow for the maximum possible persistent threats with BIOS flashing, IPMI flashing, and other completely un-authenticated avenues exposed.

[ Parent | on HN ]