It's naive to think Apple and Amazon couldn't lie in response to the article, if the intelligence was highly-classified. They may be under extremely strict gag orders (e.g. "give no response whatsoever, including silence, other than denial") and protected by promises of indemnity, as telcos were in the wake of the NSA disclosures.
Bloomberg is exquisitely specific and detailed about the chip, including photos and placement (on the baseboard management bridge, disguised as a shielding element.) There's two possibilities, then: someone cajoled dozens of officials across several companies to lie to Bloomberg, or the tech companies have been cajoled into lying.
Either way, the proof is in the pudding: every hardware pentesting shop will be going after these boards like they're looking for golden tickets. Either we'll get our die shot, or Bloomberg's getting their pants sued off.
The way the original story was written, it suggested that four subcontractors were identified, and almost 30 targets selected, with the implied suggestion that either the boards were custom special order boards, or destined for a specific lot order made by a customer. If true, then it is unlikely these boards will be found in the wild except by slipping through those almost 30 targets into the used market.
Supermicro has about 600 board SKUs, so finding these needles in the haystack is likely more feasible by approaching data centers offering to help find the boards for free, in return for allowing the pentesting firms to take physical possession of such found boards.
The story did reveal that the original "tell" that gave away the chip was odd but not obviously malicious at first glance network traffic, and that the suspected intent was implementing an Advanced Persistent Threat model. The article also mentioned the chips were connected with the BMC, but it wasn't specified in the article whether or not the chips got out onto the Net.
So finding the boards in the wild probably will focus upon finding them in the same manner, over the network. Power down the server, let the BMC stay powered on, and watch for unwarranted network activity. Or boot a Linux on a stick that deliberately does as little as possible and premises networking allows it to do just enough routing out to the Net to capture traces of what unauthorized network traffic is trying to do, and watch for unwarranted network activity, in case the chip design is clever, and hides its activity until it detects the mainboard is already running before trying to inject its network payloads onto the mainboard's network interfaces.
What are others' thoughts on how to find these "golden ticket" boards?
This, or the story is false, purposely or not.
If we're talking about being able to make changes at the OS level, surely those should be relatively easy to spot?
If we're talking about copying packets, wouldn't that be useless under most circumstances?
If we're talking about doing whatever on a mass scale, surely most of the data would be junk and a huge and very clever backend would be needed to sift out the useful elements?
Presumably none of this is impossible, but I haven't yet seen a good description of how it's all supposed to fit together.
That requires more than just access to the network, but it is rather simple.
With just access to the network, perhaps one could do spoofed DNS responses that are never seen on the network? A very simple '1% of the time, set the gmail.com A record to the chinese gmail IP' might be enough.
One could create mayhem by sending false ARP or DHCP responses, but that is only mayhem. Perhaps if it is externally triggerable it is useful offensively as DoS.
If you are blocking outbound, I could still this going unnoticed if you're not actively reviewing denials.
But, if you are properly watching dns lookups from OOB and it's anything other than necessary services (ntp, ldap, syslog), then this would get picked up pretty quickly.
Quite, especially in small networks and inline ilos, entirely possible that people plug the ilo (ipmi etc) to a more open network. Sure, nothing in, but no block on stuff going out.
Most places might be blocking this type of activity by default. For most of our security audits, it's just assumed that the SM IPMI or Dell idrac is vulnerable to one exploit or another. We mitigate that by controlling the traffic. I feel this is common practice in most places that understand vlans and firewalls.
However, while blocking is easy, being aware of something like this is on another level altogether. Unicorn jumping over a rainbow level rare. You really have to be logging outbound attempts and dns lookups. Where I work, there is a full security team and they are at an insane level where they log the allowed traffic. One told me that the allowed traffic is more interesting than the denied traffic. Denied just tells them what we anticipated, while active helps them establish a pattern and look for deviations.
Or are these boards commercial-of-the-shelf things that are mass produced?
In the latter case these boards can just end up anywhere, in the first case not so much. As a result using commodity boards would provide some degree of protection against such an attack as slipping a manipulated one into a specific target's servers would be a game of chance. Also the risk that the attack is discovered would be much higher.
Why not go read the story? It addresses this question and many others HNers are asking now. It's actually a fairly detailed story, although annoyingly short on technical detail (which could have been because their sources refused to go into much detail).
So, if you know the answer, why not just providing the information? ;-)
If Apple is lying here, they're lying because they want to, not because something is forcing them to. I believe them.
You have been compel to lie, by the government, to answer "NO" if you've received one.
If you can be compelled to lie that you have received an NSL then I do not see why you can't be forced to lie more.
We already compelled speech, why not more?
Is there case-law to support this? I've heard the argument often, but I don't believe it has yet been tested.
I think there is no way they would claim they are not
under any gag order if they were forced to never confirm
such an order
You think everyone at Google knows every secret gag order they're under? Of course not, that would get leaked within minutes.
If I was the NSA I'd find a "patriotic" mid-level or junior employee with the power I wanted to subvert, and give them a gagging order that stopped them telling their boss.
That way the Google PR can honestly say that the CEO and legal team haven't seen or heard of a gagging order.
From the story, this seems to have happened several years ago.
I wouldn't be surprised if house cleaning had been done for some time.
If the story is true then I doubt that the Chinese would have flooded the market with these boards. It must have been relatively targeted.
They are very specific, yes. They show pictures of the alleged chips that are allegedly disguised, yes. They describe placement, yes.
However, photographic or video evidence of these chips on SuperMicro boards is conspicuously absent. The only visual of placement is an illustration, not a photo. I’m not suggesting Bloomberg is wrong. I find this story fascinating and incredible (if true). But I noticed there were no photos/video of the chips on boards.
"Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations."
So you're basically implying that Apple is colluding with the US government to actively lie to discredit this story.
What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers.
It's also about the worst possible way to drop and 0-day, but whatever.
They would have to hedge, "we are investigating Bloomberg's allegations and take security seriously."
You either anger govt that is authoritarian & capable of confiscating your entire production (basically ending your current business)
OR
You make some half-truth statement (not necessary to be lying, but that does not change the point), and - if everything will be revealed - one agency of democratic govt will be pissed and slap you with big fine.
Basically this is big enough to make SEC meaningless.
The SEC on the other hand literally just got done fining Elon Musk $20m for a tweet. Fines for something like this could be in the hundreds of millions, that's not something you risk when you could just say "we are investigating the claims and take them seriously."
It's such obvious damage control in shit-has-publicly-hit-the-fan situation ... Why do you think SEC's fines (lol $20M, even for Tesla/Musk it's not a big deal, Apple would have to be hit with 100times that to even notice it) are even relevant now?
And "It isn't going to happen." could have been said about hardware attacks on USA from China last week. Situation has changed quite a bit, China is either starting to abuse its hw monopoly or someone is doing A LOT to prevent such scenario, so the stakes are too high for simple SEC fines to be worth discussing.
Publicly traded companies do not have the same freedom to lie because the truth or falsity of this claim has a direct impact on their stock price. Something we just saw with Musk less than a week ago.
> "Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple."
They deny Bloomberg's specifics, but basically admit that the general attack vector very much works.
Does anyone have a better phrase for this?
A Chinese workmate called me out for using that phrase in his presence. Until then I had used the phrase since childhood without thinking that there were connotations and with nobody complaining. However, after that one fateful conversation I did see that my language could be improved. But how?
Does anyone have a concise alternative that conveys the same thing without implying anything about how Chinese people communicate in whispers, to get things wrong?
https://en.wikipedia.org/wiki/Chinese_whispers#Etymology
> As the game is popular among children worldwide, it is also known under various other names depending on locality, such as Russian scandal,[3] whisper down the lane, broken telephone, operator, grapevine, gossip, don't drink the milk, secret message, the messenger game, and pass the message among others.[1] In France, it is called téléphone arabe (Arabic telephone) or téléphone sans fil (wireless telephone).[4][better source needed] In Malaysia, this game is commonly referred to as telefon rosak, which translates to broken telephone. In the United States, the game is known under the name telephone – which in this use is never shortened to the colloquial and more common word phone.
> Chinese whispers is the British term for what is known as the telephone game in the United States
and then lists several other names for the same game. I've also met people who when discussing confusing messages say "send three and fourpence, we're going to a dance", which is a result of 'Chinese whispers' being applied to the input "send reinforcements, we're going to advance". The reference to the pre-decimal coinage ('three and fourpence', i.e. three shillings and four pence, approx £0.17) in this old phrase shows how long the concept has been around in British English (we decimalised in 1971).
If this story actually is false the US government has plenty of incentive to have planted it.
https://www.cnbc.com/2018/10/04/doj-charges-7-russian-intell...
The full statement can be found at the link below, but the take-away is pretty much this quote from the statement: "Supply chain safety in cyberspace is an issue of common concern, and China is also a victim."
https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
Take a look at those stories in the strong light of being able to see them in retrospect and decide for yourself if this reporter is prone to going to press without a full understanding of the situation.
I have my opinion, but it's best for people to form their own.
I wouldn't read it, because they seem to repeatedly overstate the possible impact of their stories. But if you work in the space, or are the victim of an attack, this thread-level-orange style of writing may feel entirely appropriate.
It's no different than, say, insinuating that something is wrong with <x>. But instead of clearly explaining the criticism, to "let smart people figure it out for themselves". That's the laziest conspiracy sales tactic, and it exploits peoples' insecurities by tying the carrot ("I'm one of the smart ones!") to the stick of accepting whatever theory is being peddled.
But they are confirmed hacks (Equifax, FB, Cambridge Analytica).
However, reading the statement from the Chinese government in response to this story, which never actually denies the incident and instead complains about being victim to such hardware hacking themselves, that's not the impression I get: https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
Another twist, maybe someone in the government does not want this to come out officially, because they would be forced to take action against China.
On the other hand, maybe this is exactly what the government wants, so they "leak" this information - be it true or false - on purpose.
In the end, the world is so messed up currently that every conspiracy theory seems to be equally plausible.
>https://www.businessinsider.com/trump-claims-again-apple-is-...
In that sense, Apple’s denial puts it squarely back to Bloomberg to prove it’s not bulshit. Until then it would be fair to discard their narrative.
A chip smaller than a grain of rice nested between motherboard layers.
What tools could detect such a chip?
While I don't doubt Apple inspects, the zero-day threat always exists.
Even at 1,000, I don't see how humans could reliably detect this.
There has been a noticable uptick in anti-chinese news lately, particularly on business oriented news ( cnbc, bloomberg, fox business, et al ). Obviously some elements of the government or power structure has instructed them to do so. But why?
Also, if the IC wanted to put pressure on tech companies, wouldn't they just contact apple and amazon directly. Maybe there is a rift within the IC with one group being pro-china and another being anti-china?
Or is the IC and news companies done targeting social media tech companies and switching their attention to regular tech companies? Just have to wait and see.
They kinda seem like a Tom Clancy fantasy. But I dunno.
That to me is the icing on the cake. Companies are usually not direct like that.
(Unless this is some kind of new NDA that allows/mandates itself to be denied)
So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community") as a way to scare technology companies from doing business in China?
Someone at the SEC should scrutinize SMCI shorts at the very least.