Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #28136 > unrolled thread

Supermicro server motherboards with hardware backdoor?

Back to article view | Back to comp.arch.embedded

Contents

  Supermicro server motherboards with hardware backdoor? Clifford Heath <no.spam@please.net> - 2018-10-05 09:29 +1000
    Re: Supermicro server motherboards with hardware backdoor? Chris <xxx.syseng.yyy@gfsys.co.uk> - 2018-10-05 01:14 +0100
    Re: Supermicro server motherboards with hardware backdoor? Jan Panteltje <pNaOnStPeAlMtje@yahoo.com> - 2018-10-05 07:27 +0000
      Re: Supermicro server motherboards with hardware backdoor? Gene Filatov <evgeny.filatov@ieee.org> - 2018-10-05 11:12 +0300
        Re: Supermicro server motherboards with hardware backdoor? Jan Panteltje <pNaOnStPeAlMtje@yahoo.com> - 2018-10-05 08:41 +0000
    Re: Supermicro server motherboards with hardware backdoor? Theo Markettos <theom+news@chiark.greenend.org.uk> - 2018-10-05 16:28 +0100
      Re: Supermicro server motherboards with hardware backdoor? Rob Gaddi <rgaddi@highlandtechnology.invalid> - 2018-10-05 09:34 -0700
        Re: Supermicro server motherboards with hardware backdoor? Theo <theom+news@chiark.greenend.org.uk> - 2018-10-05 20:59 +0100
      Re: Supermicro server motherboards with hardware backdoor? Ed Prochak <edprochak@gmail.com> - 2018-10-05 10:37 -0700
      Re: Supermicro server motherboards with hardware backdoor? Jeff Liebermann <jeffl@cruzio.com> - 2018-10-05 20:12 -0700
        Re: Supermicro server motherboards with hardware backdoor? Clifford Heath <no.spam@please.net> - 2018-10-06 13:42 +1000
          Re: Supermicro server motherboards with hardware backdoor? Jeff Liebermann <jeffl@cruzio.com> - 2018-10-05 21:02 -0700
            Re: Supermicro server motherboards with hardware backdoor? gnuarm.deletethisbit@gmail.com - 2018-10-06 04:09 -0700
          Re: Supermicro server motherboards with hardware backdoor? <698839253X6D445TD@nospam.org> - 2018-10-06 06:03 +0000
            Re: Supermicro server motherboards with hardware backdoor? gnuarm.deletethisbit@gmail.com - 2018-10-06 04:22 -0700
        Re: Supermicro server motherboards with hardware backdoor? DecadentLinuxUserNumeroUno@decadence.org - 2018-10-06 08:45 +0000
          Re: Supermicro server motherboards with hardware backdoor? Jeff Liebermann <jeffl@cruzio.com> - 2018-10-06 08:51 -0700
            Re: Supermicro server motherboards with hardware backdoor? DecadentLinuxUserNumeroUno@decadence.org - 2018-10-06 16:42 +0000
              Re: Supermicro server motherboards with hardware backdoor? Dimiter_Popoff <dp@tgi-sci.com> - 2018-10-06 19:55 +0300
                Re: Supermicro server motherboards with hardware backdoor? Chris <xxx.syseng.yyy@gfsys.co.uk> - 2018-10-06 19:29 +0100
                  Re: Supermicro server motherboards with hardware backdoor? DLUNU <DecadentLinuxUserNumeroUno@DLU.org> - 2018-10-06 22:41 +0000
                    Re: Supermicro server motherboards with hardware backdoor? Dimiter_Popoff <dp@tgi-sci.com> - 2018-10-07 02:07 +0300
                    Re: Supermicro server motherboards with hardware backdoor? Clifford Heath <no.spam@please.net> - 2018-10-07 11:56 +1100
                      Re: Supermicro server motherboards with hardware backdoor? Johnny B Good <johnny-b-good@invalid.ntlworld.com> - 2018-10-07 03:46 +0000
                Re: Supermicro server motherboards with hardware backdoor? DLUNU <DecadentLinuxUserNumeroUno@DLU.org> - 2018-10-06 22:40 +0000
                  Re: Supermicro server motherboards with hardware backdoor? Dimiter_Popoff <dp@tgi-sci.com> - 2018-10-07 02:05 +0300
                  Re: Supermicro server motherboards with hardware backdoor? Chris <xxx.syseng.yyy@gfsys.co.uk> - 2018-10-07 01:36 +0100
              Re: Supermicro server motherboards with hardware backdoor? Jeff Liebermann <jeffl@cruzio.com> - 2018-10-06 20:14 -0700
                Re: Supermicro server motherboards with hardware backdoor? Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-07 08:07 +0100
                Re: Supermicro server motherboards with hardware backdoor? DLUNU <DecadentLinuxUserNumeroUno@DLU.org> - 2018-10-07 14:09 +0000
                  Re: Supermicro server motherboards with hardware backdoor? Jeff Liebermann <jeffl@cruzio.com> - 2018-10-07 08:55 -0700
                    Re: Supermicro server motherboards with hardware backdoor? DecadentLinuxUserNumeroUno@decadence.org - 2018-10-08 00:50 +0000
                    Re: Supermicro server motherboards with hardware backdoor? DecadentLinuxUserNumeroUno@decadence.org - 2018-10-08 00:51 +0000
        Re: Supermicro server motherboards with hardware backdoor? DecadentLinuxUserNumeroUno@decadence.org - 2018-10-06 08:50 +0000
        Re: Supermicro server motherboards with hardware backdoor? gnuarm.deletethisbit@gmail.com - 2018-10-06 04:02 -0700
    Re: Supermicro server motherboards with hardware backdoor? julio@diegidio.name - 2018-10-06 22:22 -0700
    Re: Supermicro server motherboards with hardware backdoor? Philipp Klaus Krause <pkk@spth.de> - 2018-10-12 08:21 +0200

Page 1 of 2  [1] 2  Next page →

#28136 — Supermicro server motherboards with hardware backdoor?

Whether it turns out to be true or not, this will be the biggest 
security blockbuster of the decade.

<https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>

Clifford Heath

[toc] | [next] | [standalone]

#28137

On 10/05/18 00:29, Clifford Heath wrote:
> Whether it turns out to be true or not, this will be the biggest
> security blockbuster of the decade.
>
> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-

used-a-tiny-chip-to-infiltrate-america-s-top-companies>
>
>
> Clifford Heath

Couple of articles in The Register as well. Have said for years that
we should keep the Chinese at arms length for hi tech, as even if they
are not stealing the ip, they have more than enough reason to subvert
the designs for their own good and the intellect to implement it. All
good and furry on the outside, cheap manufacturing etc, but an
undemocratic police state at core, with an expansionist agenda.

More than ever, nations progress through advances in the sciences and
technology and it should be considered a national security asset.
Don't need a tinfoil hat to see that...

Chris

[toc] | [prev] | [next] | [standalone]

#28138

On a sunny day (Fri, 5 Oct 2018 09:29:55 +1000) it happened Clifford Heath
<no.spam@please.net> wrote in <WnxtD.55769$6y.40842@fx09.iad>:

>Whether it turns out to be true or not, this will be the biggest 
>security blockbuster of the decade.
>
><https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies
>>
>
>Clifford Heath

Talk about politics, the news is full of 'China has done it'
'Russia has done it', all fake news originating from trumpesite infiltrated organizations.
Same here, Netherlands, gov echoing 'Russia bad ',
in the mean time the international court of justice in The Hague here is threatened by the war mongering US
as it it ordered that same US to end sanctions against Iran,
US industry and consumers are paying more an more for their home appliances and fuel,
large parts of US industry suffer under the tariffs imposed by that clueless reality show host posing as 'president',
and microsoft spy software is forced upon hardware sellers with modified BIOSes so it won't run anything else,
every Intel processor if full of security holes, same for the what's it on board chips.
Spy satellites look at what is on your plate, everything is listened to and recorded by same US and there slave states,
I wanted to write to nl.politics where are we now, let's make our own nukes and take over that silly club there in N America,
let's be great again.
Days of Piet Hein
 https://en.wikipedia.org/wiki/Piet_Pieterszoon_Hein

Don't be a US slave.

Respect Russia and China.
STAND UP!

pussies
hehe

[toc] | [prev] | [next] | [standalone]

#28139

On 05.10.2018 10:27, Jan Panteltje wrote:
> On a sunny day (Fri, 5 Oct 2018 09:29:55 +1000) it happened Clifford Heath
> <no.spam@please.net> wrote in <WnxtD.55769$6y.40842@fx09.iad>:
>
>> Whether it turns out to be true or not, this will be the biggest
>> security blockbuster of the decade.
>>
>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies
>>>
>>
>> Clifford Heath
>
> Talk about politics, the news is full of 'China has done it'
> 'Russia has done it', all fake news originating from trumpesite infiltrated organizations.
> Same here, Netherlands, gov echoing 'Russia bad ',
> in the mean time the international court of justice in The Hague here is threatened by the war mongering US
> as it it ordered that same US to end sanctions against Iran,
> US industry and consumers are paying more an more for their home appliances and fuel,
> large parts of US industry suffer under the tariffs imposed by that clueless reality show host posing as 'president',
> and microsoft spy software is forced upon hardware sellers with modified BIOSes so it won't run anything else,
> every Intel processor if full of security holes, same for the what's it on board chips.
> Spy satellites look at what is on your plate, everything is listened to and recorded by same US and there slave states,
> I wanted to write to nl.politics where are we now, let's make our own nukes and take over that silly club there in N America,
> let's be great again.
> Days of Piet Hein
>  https://en.wikipedia.org/wiki/Piet_Pieterszoon_Hein
>
> Don't be a US slave.
>
> Respect Russia and China.
> STAND UP!
>
> pussies
> hehe
>


It's interesting how a lot of political discussions are poorly 
understood psychology in a nutshell.

Presumably, you feel insecure because of the world politics, and you 
want nukes. But suppose you had nukes. Would that make you feel more secure?

I believe, that if the problem lies in some kind of a shared feeling of 
insecurity, then we don't need more nukes. We need more art, more 
culture, more things which make us happier.

Gene.

[toc] | [prev] | [next] | [standalone]

#28140

On a sunny day (Fri, 5 Oct 2018 11:12:22 +0300) it happened Gene Filatov
<evgeny.filatov@ieee.org> wrote in <I1FtD.273300$Vl2.204335@fx46.iad>:

>On 05.10.2018 10:27, Jan Panteltje wrote:
>> On a sunny day (Fri, 5 Oct 2018 09:29:55 +1000) it happened Clifford Heath
>> <no.spam@please.net> wrote in <WnxtD.55769$6y.40842@fx09.iad>:
>>
>>> Whether it turns out to be true or not, this will be the biggest
>>> security blockbuster of the decade.
>>>
>>>
>>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies
>>>>
>>>
>>> Clifford Heath
>>
>> Talk about politics, the news is full of 'China has done it'
>> 'Russia has done it', all fake news originating from trumpesite infiltrated organizations.
>> Same here, Netherlands, gov echoing 'Russia bad ',
>> in the mean time the international court of justice in The Hague here is threatened by the war mongering US
>> as it it ordered that same US to end sanctions against Iran,
>> US industry and consumers are paying more an more for their home appliances and fuel,
>> large parts of US industry suffer under the tariffs imposed by that clueless reality show host posing as 'president',
>> and microsoft spy software is forced upon hardware sellers with modified BIOSes so it won't run anything else,
>> every Intel processor if full of security holes, same for the what's it on board chips.
>> Spy satellites look at what is on your plate, everything is listened to and recorded by same US and there slave states,
>> I wanted to write to nl.politics where are we now, let's make our own nukes and take over that silly club there in N America,
>> let's be great again.
>> Days of Piet Hein
>>  https://en.wikipedia.org/wiki/Piet_Pieterszoon_Hein
>>
>> Don't be a US slave.
>>
>> Respect Russia and China.
>> STAND UP!
>>
>> pussies
>> hehe
>>
>
>
>It's interesting how a lot of political discussions are poorly 
>understood psychology in a nutshell.
>
>Presumably, you feel insecure because of the world politics, and you 
>want nukes. But suppose you had nukes. Would that make you feel more secure?
>
>I believe, that if the problem lies in some kind of a shared feeling of 
>insecurity, then we don't need more nukes. We need more art, more 
>culture, more things which make us happier.
>
>Gene.

Personally I believe in the right of the strongest [1].
US falling victim to decadence and stupidity snake oil, racism, climate change, 
the list is endless.
 

[1] That includes intellect to defeat the competition in evolution.
    Empires are being digged up and people wonder why those ended.

Same will happen in N 'merrica.
Already it is falling apart internally, all it takes is to march in there and free the people.

[toc] | [prev] | [next] | [standalone]

#28141

In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
> Whether it turns out to be true or not, this will be the biggest 
> security blockbuster of the decade.
> 
> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>

This is my analysis:
https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/

Theo

[toc] | [prev] | [next] | [standalone]

#28142

On 10/05/2018 08:28 AM, Theo Markettos wrote:
> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
>> Whether it turns out to be true or not, this will be the biggest
>> security blockbuster of the decade.
>>
>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
> 
> This is my analysis:
> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
> 
> Theo
> 

Thanks for that write-up, but why do you find it more feasible that the 
firmware's being fetched across the network than that the interceptor 
chip simply has 32Mb of flash on it?  It seems like that additional 
network traffic at boot time would be a pretty recognizable signature.

-- 
Rob Gaddi, Highland Technology -- www.highlandtechnology.com
Email address domain is currently out of order.  See above to fix.

[toc] | [prev] | [next] | [standalone]

#28148

In comp.arch.embedded Rob Gaddi <rgaddi@highlandtechnology.invalid> wrote:
> Thanks for that write-up, but why do you find it more feasible that the 
> firmware's being fetched across the network than that the interceptor 
> chip simply has 32Mb of flash on it?  It seems like that additional 
> network traffic at boot time would be a pretty recognizable signature.

It is possible that the implant is simply replacing the existing QSPI flash,
but then a firmware update would either replace it, or the update checksum
would fail.  So it has to be something that keeps the original flash
functioning and tampers with it conditionally.

A regular SPI flash chip couldn't that.  A very basic flash edit (overdrive
the real data lines and force some bytes of config settings) could be done
in a CPLD - I didn't check what die sizes vendors have, but they can be
small.  An FPGA would likely be too big.

A full custom chip is also feasible, but in another league in terms of
costs.

Theo

[toc] | [prev] | [next] | [standalone]

#28145

On Friday, October 5, 2018 at 11:28:27 AM UTC-4, Theo Markettos wrote:
> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
> > Whether it turns out to be true or not, this will be the biggest 
> > security blockbuster of the decade.
> > 
> > <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
> 
> This is my analysis:
> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
> 
> Theo

Very interesting. Thanks.

[toc] | [prev] | [next] | [standalone]

#28149

On 05 Oct 2018 16:28:21 +0100 (BST), Theo Markettos
<theom+news@chiark.greenend.org.uk> wrote:

>In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
>> Whether it turns out to be true or not, this will be the biggest 
>> security blockbuster of the decade.
>> 
>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>

>This is my analysis:
>https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
>Theo

Thanks.  Nicely thought out blog article.  I agree that putting the
chip on the SPI bus would be the ideal location.  I might add that is
would be possible to add microcode instructions to the CPU via the SPI
bus (depending on how the added chip is wired into the system). 

Some deficiencies and unanswered questions in the original Bloomberg
article:

1.  Since Bloomberg apparently has possession of several of these
mystery chips, why haven't anyone done an autopsy or xray analysis on
what's inside?  From the few photos, it looks like a resistor network.
<https://www.siricomindia.com/wp-content/uploads/2016/08/Chip-Resistor-array-300x300.jpg>

2.  If I wanted to compromise a server, it would much easier to add a
few more undocumented instructions to an existing chip, such as a bus
controller (which sees the entire data bus), than to add a new device
that might be detected by the production equipment that uses optical
comparators to detect missing, backwards, and misaligned components. A
white alumina or porcelain chip, among the usual brown ceramic chips,
would be easily visible.

3.  The photos of the mystery chip seems a little odd:
<https://assets.bwbx.io/images/users/iqjWHBFdfxIU/i9VdsjZLS_Pk/v1/-1x-1.jpg>
The solder pads on the sides of the chip look slightly oxidized and do
not look like anything that has been unsoldered by a hot air SMT
desoldering station, where the solder would be shiny and tends to
collect near the PCB side of the chip.

4.  What is a "signal conditioning coupler"? 
<http://www.samsungsem.com/global/product/passive-component/chip-resistor/array/index.jsp>
<https://hexus.net/media/uploaded/2018/10/eb42add4-0827-4831-b6c7-8409fb539eb1.jpg>

5.  With a PCB and chip in Bloomberg's possession, it would be fairly
easy to determine how it was connected into the server.  This should
have been done before announcing to the world that they had discovered
a spy chip, rather than discovering a capacitor or termination
resistor.

6.  There seems to be nearly zero demonstratable information on how
the chip could actually do something useful.  Plenty of theoretical
possibilities, but nothing that an SPI or serial bus analyzer couldn't
handle.

etc...

Not currently having the answers to these questions doesn't bother me.
The lack of anyone close to the source actually bothering to answer
them does bother me.

Sorry to be so vague but I've had a rotten day dealing with
Microsoft's October 2018 Windoze 10 update destroying customer data.
This has not been a good day.
<https://www.google.com/search?q=windows+10+update+erase+user+files&tbs=qdr:w>

-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558

[toc] | [prev] | [next] | [standalone]

#28150

On 06/10/18 13:12, Jeff Liebermann wrote:
> On 05 Oct 2018 16:28:21 +0100 (BST), Theo Markettos
> <theom+news@chiark.greenend.org.uk> wrote:
>> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
>>> Whether it turns out to be true or not, this will be the biggest
>>> security blockbuster of the decade.
>>>
>>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
> 
>> This is my analysis:
>> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
>> Theo
> 
> Thanks.  Nicely thought out blog article.  I agree that putting the
> chip on the SPI bus would be the ideal location.  I might add that is
> would be possible to add microcode instructions to the CPU via the SPI
> bus (depending on how the added chip is wired into the system).
> 
> Some deficiencies and unanswered questions in the original Bloomberg
> article:
> 
> 1.  Since Bloomberg apparently has possession of several of these
> mystery chips

They don't claim that, and we don't know it. The motherboard
photos could have been sent by their inside source. It would
have been much more risky to provide a whole MB to Bloomberg.
The chip photos are probably something off Digikey.

If they don't have the board or chips, the rest of your questions
don't matter.

Clifford Heath.

[toc] | [prev] | [next] | [standalone]

#28151

On Sat, 6 Oct 2018 13:42:59 +1000, Clifford Heath <no.spam@please.net>
wrote:

>On 06/10/18 13:12, Jeff Liebermann wrote:
>> On 05 Oct 2018 16:28:21 +0100 (BST), Theo Markettos
>> <theom+news@chiark.greenend.org.uk> wrote:
>>> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
>>>> Whether it turns out to be true or not, this will be the biggest
>>>> security blockbuster of the decade.
>>>>
>>>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
>> 
>>> This is my analysis:
>>> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
>>> Theo
>> 
>> Thanks.  Nicely thought out blog article.  I agree that putting the
>> chip on the SPI bus would be the ideal location.  I might add that is
>> would be possible to add microcode instructions to the CPU via the SPI
>> bus (depending on how the added chip is wired into the system).
>> 
>> Some deficiencies and unanswered questions in the original Bloomberg
>> article:
>> 
>> 1.  Since Bloomberg apparently has possession of several of these
>> mystery chips

>They don't claim that, and we don't know it. The motherboard
>photos could have been sent by their inside source. It would
>have been much more risky to provide a whole MB to Bloomberg.
>The chip photos are probably something off Digikey.
>
>If they don't have the board or chips, the rest of your questions
>don't matter.
>
>Clifford Heath.

Good point.  If they don't have physical possession of a working chip
and/or motherboard, then that's the end of the physical evidence
making literally everything written so far no better than speculation.

Incidentally, the photo of the chip and the finger look edited:
<https://assets.bwbx.io/images/users/iqjWHBFdfxIU/i9VdsjZLS_Pk/v1/600x-1.jpg>
At that level of magnifications, the ridges of the finger and the nail
show substantial levels of dirt, cuts, and irregularities.  Most
peoples palm and back of the hand are different colors.  To produce a
perfectly rounded edge view, clean nails, clean ridges, an uniform
color requires considerable photo editing.  Since the chip seems to be
back lighted, while the finger is lighted most from the right side, I
would guess that the chip was added to the finger photo.  Looking
again at the solder plate on the chip, I'm sure it's never been
attached to a PCB.

Fake news?  I think so.


-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558

[toc] | [prev] | [next] | [standalone]

#28156

On Saturday, October 6, 2018 at 12:02:36 AM UTC-4, Jeff Liebermann wrote:
> On Sat, 6 Oct 2018 13:42:59 +1000, Clifford Heath <no.spam@please.net>
> wrote:
> 
> >On 06/10/18 13:12, Jeff Liebermann wrote:
> >> On 05 Oct 2018 16:28:21 +0100 (BST), Theo Markettos
> >> <theom+news@chiark.greenend.org.uk> wrote:
> >>> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
> >>>> Whether it turns out to be true or not, this will be the biggest
> >>>> security blockbuster of the decade.
> >>>>
> >>>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
> >> 
> >>> This is my analysis:
> >>> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
> >>> Theo
> >> 
> >> Thanks.  Nicely thought out blog article.  I agree that putting the
> >> chip on the SPI bus would be the ideal location.  I might add that is
> >> would be possible to add microcode instructions to the CPU via the SPI
> >> bus (depending on how the added chip is wired into the system).
> >> 
> >> Some deficiencies and unanswered questions in the original Bloomberg
> >> article:
> >> 
> >> 1.  Since Bloomberg apparently has possession of several of these
> >> mystery chips
> 
> >They don't claim that, and we don't know it. The motherboard
> >photos could have been sent by their inside source. It would
> >have been much more risky to provide a whole MB to Bloomberg.
> >The chip photos are probably something off Digikey.
> >
> >If they don't have the board or chips, the rest of your questions
> >don't matter.
> >
> >Clifford Heath.
> 
> Good point.  If they don't have physical possession of a working chip
> and/or motherboard, then that's the end of the physical evidence
> making literally everything written so far no better than speculation.

What?  Bloomburg is not an analysis lab.  They are reporting news.  The fact that Bloomburg doesn't have the engineering data or devices doesn't mean they don't have the info. 


> Incidentally, the photo of the chip and the finger look edited:
> <https://assets.bwbx.io/images/users/iqjWHBFdfxIU/i9VdsjZLS_Pk/v1/600x-1.jpg>

Duh! 

> At that level of magnifications, the ridges of the finger and the nail
> show substantial levels of dirt, cuts, and irregularities.  Most
> peoples palm and back of the hand are different colors.  To produce a
> perfectly rounded edge view, clean nails, clean ridges, an uniform
> color requires considerable photo editing.  Since the chip seems to be
> back lighted, while the finger is lighted most from the right side, I
> would guess that the chip was added to the finger photo.  Looking
> again at the solder plate on the chip, I'm sure it's never been
> attached to a PCB.

This is called, presentation.  Most likely the finger is from a more than perfectly manicured hand model.  In fact, I was pretty amazed by how perfect it is.  This guy must wear gloves all day and a manicurist is at the photo shoot!  


> Fake news?  I think so.

Huh?  You need to get out more.  Not fake news, just a very well written and well illustrated article in a web publication.  If JL hand draws a graph or schematic in one of his doodles, does that make it a fake design? 

Rick C. 

[toc] | [prev] | [next] | [standalone]

#28152

Clifford Heath wrote:
>On 06/10/18 13:12, Jeff Liebermann wrote:
>> On 05 Oct 2018 16:28:21 +0100 (BST), Theo Markettos
>> <theom+news@chiark.greenend.org.uk> wrote:
>>> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
>>>> Whether it turns out to be true or not, this will be the biggest
>>>> security blockbuster of the decade.
>>>>
>>>>
>>>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
>> 
>>> This is my analysis:
>>> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
>>> Theo
>> 
>> Thanks.  Nicely thought out blog article.  I agree that putting the
>> chip on the SPI bus would be the ideal location.  I might add that is
>> would be possible to add microcode instructions to the CPU via the SPI
>> bus (depending on how the added chip is wired into the system).
>> 
>> Some deficiencies and unanswered questions in the original Bloomberg
>> article:
>> 
>> 1.  Since Bloomberg apparently has possession of several of these
>> mystery chips
>
>They don't claim that, and we don't know it. The motherboard
>photos could have been sent by their inside source. It would
>have been much more risky to provide a whole MB to Bloomberg.
>The chip photos are probably something off Digikey.
>
>If they don't have the board or chips, the rest of your questions
>don't matter.

He has a good analysis IMNSHO.
Sure hand anything to the press, especially the biased press, and it will publish that.
The whole issue here is to get the reality show manager re-elected, mid-terms are knocking on the door,
keep republicans in power, create a common enemy, standard stuff.
Truth and 'tronics has little to do with it.

Any kid can make up this story.

Maybe that 'chip dot' is just flee poop, like the rest of what the reality lost show manager does.
And as significant as that.

At the same time companies like Apple may hand all user data to China, they only have to ask for it..
Money, sales, profit is the law. Snake oil is the trade.
:-)
Oh well...
remember in the last cold war how Russia was accused of spying on every one...
Now US does it as one bigger number.

And there is nothing to know really, of value, that China does not already have, or can do better.
That includes running a country.

[toc] | [prev] | [next] | [standalone]

#28157

On Saturday, October 6, 2018 at 2:03:28 AM UTC-4, 69883925...@nospam.org wrote:
> Clifford Heath wrote:
> >On 06/10/18 13:12, Jeff Liebermann wrote:
> >> On 05 Oct 2018 16:28:21 +0100 (BST), Theo Markettos
> >> <theom+news@chiark.greenend.org.uk> wrote:
> >>> In comp.arch.embedded Clifford Heath <no.spam@please.net> wrote:
> >>>> Whether it turns out to be true or not, this will be the biggest
> >>>> security blockbuster of the decade.
> >>>>
> >>>>
> >>>> <https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies>
> >> 
> >>> This is my analysis:
> >>> https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/
> >>> Theo
> >> 
> >> Thanks.  Nicely thought out blog article.  I agree that putting the
> >> chip on the SPI bus would be the ideal location.  I might add that is
> >> would be possible to add microcode instructions to the CPU via the SPI
> >> bus (depending on how the added chip is wired into the system).
> >> 
> >> Some deficiencies and unanswered questions in the original Bloomberg
> >> article:
> >> 
> >> 1.  Since Bloomberg apparently has possession of several of these
> >> mystery chips
> >
> >They don't claim that, and we don't know it. The motherboard
> >photos could have been sent by their inside source. It would
> >have been much more risky to provide a whole MB to Bloomberg.
> >The chip photos are probably something off Digikey.
> >
> >If they don't have the board or chips, the rest of your questions
> >don't matter.
> 
> He has a good analysis IMNSHO.

YAIV


> Sure hand anything to the press, especially the biased press, and it will publish that.

Much better if they don't publish anything that isn't so verified that it is common knowledge. 


> The whole issue here is to get the reality show manager re-elected, mid-terms are knocking on the door,

How is this helping anyone currently in power.  I thought the article made it clear that this exploit took a long time to enact across multiple administrations. 


> keep republicans in power, create a common enemy, standard stuff.
> Truth and 'tronics has little to do with it.
> 
> Any kid can make up this story.
> 
> Maybe that 'chip dot' is just flee poop, like the rest of what the reality lost show manager does.
> And as significant as that.

So you are suggesting the entire story is fake? 


> At the same time companies like Apple may hand all user data to China, they only have to ask for it..

Now that is fake news! 


> Money, sales, profit is the law. Snake oil is the trade.
> :-)
> Oh well...
> remember in the last cold war how Russia was accused of spying on every one...
> Now US does it as one bigger number.
> 
> And there is nothing to know really, of value, that China does not already have, or can do better.
> That includes running a country.

lol

Rick C. 

[toc] | [prev] | [next] | [standalone]

#28153

Jeff Liebermann <jeffl@cruzio.com> wrote in 
news:n07grdlc3jdr2ssnej54fakvilrdka07u1@4ax.com:

> 1.  Since Bloomberg apparently has possession of several of these
> mystery chips, why haven't anyone done an autopsy or xray analysis on
> what's inside?

  Did you even read the article?  Did you not see the picture of what the 
chip contained?

  And I am quite sure that the DoD's investigation into it was much more 
comprehensive than a news agency's most elite hardware nerd.

[toc] | [prev] | [next] | [standalone]

#28158

On Sat, 6 Oct 2018 08:45:28 +0000 (UTC),
DecadentLinuxUserNumeroUno@decadence.org wrote:

>Jeff Liebermann <jeffl@cruzio.com> wrote in 
>news:n07grdlc3jdr2ssnej54fakvilrdka07u1@4ax.com:
>
>> 1.  Since Bloomberg apparently has possession of several of these
>> mystery chips, why haven't anyone done an autopsy or xray analysis on
>> what's inside?

>  Did you even read the article?

Yes.

>Did you not see the picture of what the 
>chip contained?

Do you mean this rubbish?
<https://www.bloomberg.com/toaster/v2/charts/85c4e100b7ab4a8bbffe7ce2a3e137c1.html>

You have a good imagination.  Perhaps you might know what a "signal
conditioner coupler" mentioned in the first paragraph might be?  While
you're working on that, perhaps you can also explain what an operating
system core might be as in "...the microchip altered the operating
system’s core so it could accept modifications".  Duz Supermicro use
core memory?

>  And I am quite sure that the DoD's investigation into it was much more 
>comprehensive than a news agency's most elite hardware nerd.

Certainly they'll investigate.  So will every other government agency
and publicity hungry entity will conduct their own independent
investigation.  This was discovered by Amazon's outside security
contractor something like 2 years ago.  One might suspect that there
are now a fair number of these chips floating around and that they
have been rather thoroughly analyzed over the last 2 years.  Oddly, I
don't see any reports, photos, or info leaks.  However, I'm sure
they'll take their time releasing any real results, when they discover
it's an SMD resistor network.


On Sat, 6 Oct 2018 08:50:02 +0000 (UTC),
DecadentLinuxUserNumeroUno@decadence.org wrote:

>Jeff Liebermann <jeffl@cruzio.com> wrote in 
>news:n07grdlc3jdr2ssnej54fakvilrdka07u1@4ax.com:
>
>> Microsoft's October 2018 Windoze 10 update destroying customer data.
>
>Bullshit.  Operator error.

Is that like blame the victim?  I would think that the average user
might assume that an operating system update wouldn't erase all their
data.  Actually, that begs the question of what was Microsoft doing
digging around in the users files anyway?  Were they building a
catalog of "interesting" files for the NSA?  Why was this update so
big when it only added a few new features:
<https://www.cnet.com/how-to/windows-10-october-2018-update-the-7-best-new-features/>
New spyware, err... telemetry perhaps?

Incidentally, MS has suspended the update and is investigating the
problem.
<https://www.cnet.com/how-to/windows-10-october-2018-update-the-7-best-new-features/>
Pulling the plug 5 days after a huge number of rather serious
complaints is what is now called "decisive action".

>Always backup first for one thing, and I still 
>think you did something to cause the loss.

The first step to solving a problem really is to blame someone, but
never blame the person in charge of fixing the problem.  They might
get angry and do nothing.

I have a simple method of dealing with such complainers.  I construct
a clone of their computer.  I then push pins and needles into the
motherboard until it exhibits erratic behavior.  By sympathetic voodoo
and quantum entanglement, your identical PC will exhibit identical
problems.

>And you do not have an 
>instantaneous mirror on another machine for their data?

For my former medical office customers, that was standard procedure. I
also didn't install updates of any kind until after a suitable waiting
period.  However, for the typical small business and home user, I
prefer image backups, which allows me to quickly restore literally
everything.  For backups between image backups, I just copy or rsync a
few directories that I consider important to a local NAS (network
attached storage) drive.

>  Sounds like something Trump would say.

Trump doesn't say anything.  He tweets.


-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558

[toc] | [prev] | [next] | [standalone]

#28159

Jeff Liebermann <jeffl@cruzio.com> wrote in 
news:gskhrdtud3u1jf0fi8un1si04cja0t9382@4ax.com:

>>Always backup first for one thing, and I still 
>>think you did something to cause the loss.
> 
> The first step to solving a problem really is to blame someone, but
> never blame the person in charge of fixing the problem.  They might
> get angry and do nothing.
> 

Especially when the FIRST thing they are ALWAYS supposed to do is perform a 
backup.  Yeah...  you might get angry and...  start blaming Microsoft for 
your missteps.

[toc] | [prev] | [next] | [standalone]

#28160

On 06.10.2018 г. 19:42, DecadentLinuxUserNumeroUno@decadence.org wrote:
> Jeff Liebermann <jeffl@cruzio.com> wrote in
> news:gskhrdtud3u1jf0fi8un1si04cja0t9382@4ax.com:
>
>>> Always backup first for one thing, and I still
>>> think you did something to cause the loss.
>>
>> The first step to solving a problem really is to blame someone, but
>> never blame the person in charge of fixing the problem.  They might
>> get angry and do nothing.
>>
>
> Especially when the FIRST thing they are ALWAYS supposed to do is perform a
> backup.  Yeah...  you might get angry and...  start blaming Microsoft for
> your missteps.
>

At that frequency of "updates" I hear windows 10 is doing backing up a
a few terabytes all the time sounds the practical thing to do, yeah.

Dimiter

======================================================
Dimiter Popoff, TGI             http://www.tgi-sci.com
======================================================
http://www.flickr.com/photos/didi_tgi/

[toc] | [prev] | [next] | [standalone]

#28161

On 10/06/18 17:55, Dimiter_Popoff wrote:
> On 06.10.2018 г. 19:42, DecadentLinuxUserNumeroUno@decadence.org wrote:
>> Jeff Liebermann <jeffl@cruzio.com> wrote in
>> news:gskhrdtud3u1jf0fi8un1si04cja0t9382@4ax.com:
>>
>>>> Always backup first for one thing, and I still
>>>> think you did something to cause the loss.
>>>
>>> The first step to solving a problem really is to blame someone, but
>>> never blame the person in charge of fixing the problem. They might
>>> get angry and do nothing.
>>>
>>
>> Especially when the FIRST thing they are ALWAYS supposed to do is
>> perform a
>> backup. Yeah... you might get angry and... start blaming Microsoft for
>> your missteps.
>>
>
> At that frequency of "updates" I hear windows 10 is doing backing up a
> a few terabytes all the time sounds the practical thing to do, yeah.
>
> Dimiter
>
> ======================================================
> Dimiter Popoff, TGI http://www.tgi-sci.com
> ======================================================
> http://www.flickr.com/photos/didi_tgi/
>
>
>
>

I wouldn't touch win 10 with yours, never mind my own. Completely
untrustworthy if you value personal or even corporate privacy.
Modern systems are getting so complex, who can verify what's been
hidden in either the hardware or software ?.

This report has really been a wakeup call for me, even though it
doesn't impact work here at all. Never even considered that
substitute or added h/w might have been fitted, but state level
actors have the resources to do just that. Where are most of the
management engine cpus made, for example ?...

Chris

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.arch.embedded

csiph-web