Bloomberg Reports China Infiltrated the Supermicro Supply Chain We Investigate

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by dboreham on Thursday October 04, 2018 @08:53PM (#18144866)

As a matter of routine, nobody with a clue would ever allow public Internet connectivity to the BMC NIC. They would also never allow the "bridge" mode where the BMC NIC gets logically connected to one of the primary NICs (useful if you want to spin up a box with only one drop cable in the lab). I wondered if perhaps the attack involved subverting the air gap between the BMC NIC and a primary NIC. Perhaps a reason to use https://en.wikipedia.org/wiki/IEEE_802.1X

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by heartbreak on Thursday October 04, 2018 @08:59PM (#18144903)

In the other threads it has been mentioned that this hypothetical attack could run similarly to the US/Xerox op in the Cold War. The Xerox machines recorded data which was collected by a Xerox technician during regular maintenance. A board with a trojan chip on it could potentially record data to be collected during an RMA. No need for network transmission.

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by cpr on Friday October 05, 2018 @10:37AM (#18148433)

Heck, you can find millions of pages of highly confidential documentation in any Xerox copier junkyard--it's all standardly copied to their internal disks, which are never cleaned on junking.

This caused a small stink a while back but I doubt if anything's changed.

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by teknologist on Thursday October 04, 2018 @09:00PM (#18144909)

If the rogue firmware was indeed loaded from this chip, the "bridge mode" could have been forcefully activated.

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by tessi3r on Thursday October 04, 2018 @09:01PM (#18144915)

But monitoring software really wouldn't detect this...?

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by teknologist on Friday October 05, 2018 @12:07PM (#18149224)

"Monitoring software" could really mean anything, or nothing.

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by dboreham on Friday October 05, 2018 @12:32PM (#18149488)

Parent probably means network exfiltration detection.

[ Parent | on HN ]

Re:Bloomberg Reports China Infiltrated the Supermicro Supply... by tessi3r on Thursday October 04, 2018 @09:01PM (#18144911)

The article did mention something around the lines of "the compromised machines could talk to other compromised machines on a network" so I guess the idea is to find a compromised machine close enough to an edge network to reach a C&C server?

[ Parent | on HN ]