You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actually could take over the BMC firmware, that could give you access to not only the OS running on that server but everything else on the network so the actual number of implants needed for an attack on a network/datacenter are low compared to how many machines are on there.

Any evidence of this theory?

No evidence that this alleged attack was highly-targeted, but it is pretty much SOP now, since the history of Stuxnet [1] publicly revealed the strategy. I was initially impressed the Bloomberg's story, but the longer this drags on with no independent proof, and given the one of the author's previous infosec reporting gaffe with no follow through, I've dismissed the story's veracity to a low probability.

[1] https://en.wikipedia.org/wiki/Stuxnet#History

No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.

Things are hacked often with a specific facility or installation in mind. It could be as little has a handful and that'd be enough to compromise a lot.

I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in.

Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines.

I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things.

I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)

> I actually don't care what the truth is

Why are you in this thread at all then?

Because 'the truth of the Bloomberg story' is not important - what matters is 'what's actually happening' in the world. And this kind of hacking is definitely happening irrespective of how right/wrong the Bloomberg report is.

So why are you rambling on about unrelated pet topics in HN threads?

Do you truly believe his point to be unrelated, this isn't a debate about GP's tone?

I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.

I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.

The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.

It IS a conspiracy.

What you said is not a conspiracy theory.

Ha ha yes, you're right!

I think you mean conspiracy theory.

Of course this event is a conspiracy.