Hacker News Reader

Comment by Illniyar | Hacker News Reader

There's denial and there's vehement to the point complete denial from multiple different companies.

It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter that if happened would most likely come up in the future again. Furthermore if apple and amazon were both notified for comments, there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons, especially so if they made apple and amazon lie about it.

Or ... Bloomberg didn't do their due diligence and were too eager to be duped by agents who wanted to push an agenda to move manufacturing away from china or something similar.

View on HN

>there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons

The rest of your post aside, the FBI cannot do that. It wouldn't matter if it was secret. It's not even a close call, it's been explicitly and repeatedly slammed down by courts even in extreme cases like classified information being illegitimately leaked, for example with the Pentagon Papers (SCOTUS ruling [1] against prior restraint). It just came up again a few months ago when a federal judge tried to use prior restraint and depublishing against the LA Times over their publication of information about a confidential informant and bargain that was accidentally published in full on PACER. A rung bell cannot be unrung.

Now, if the FBI could find a leaker who had signed an agreement with the Federal government they could go after them in person. If a newspaper broke the law to obtain a story then that separate violation could independently be prosecutable (in public). But none of that means the publicly released information can then be taken back. And even if some random blogger might be intimidated illegally and not find the resources to fight back, that wouldn't be an issue for a major publication.

I don't take issue with your skepticism in general but it's not helpful to ascribe special powers to government that it doesn't actually have either.

-----

1: https://www.law.cornell.edu/supremecourt/text/403/713#writin...

I stand corrected. I misunderstood how strong freedom of the press is in the U.S.

It's the final battleground.

Control the media conglomerates, lobby as control over the internet, control the sentiment.

> It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter

Like, say, the matter of secret surveillance on the mass scale? I mean, the track record here is not exactly pristine.

> Bloomberg didn't do their due diligence and were too eager

That is a distinct possibility too. But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it.

I think the matter of distinction of your second point isn't that they would or could, it's that we have evidence that in the past, they have already done this.

> Bloomberg didn't do their due diligence and were too eager

Furthermore, the argument against this would be that (from the denials PRs) Bloomberg has been approaching the involved parties for "several years."

Why would they decide to pull the trigger now simply from haste?

Correct me if I'm wrong but if you are referring to in PRISM the denials were quite vague. Both facebook and google said they never heard of a program called Prism but never denied being part of one. And facebook denied "direct access". Even when those responses came out there was confusion about what they meant in the statements. There doesn't seem to be any confusion here.

It's easy to pretend to be confused about a denial. Most people here do it so they can have something to post about.

The PRISM denials were not vague and were perfectly true. PRISM was a system for handling subpoenas, and nobody denies getting subpoenas. If you ask e.g. Facebook they also won't deny proactively reporting child abuse to the FBI, which is another real US legal requirement.

> But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it.

This is just conspiracy theory thinking. You offer no evidence for this incredible assertion. Some companies have previously collaborated with the government, generally without explicitly lying, but we cannot jump to the conclusion that all companies would voluntarily lie in a coverup conspiracy -- which, by the way, opens them up to investor lawsuits and risks destroying their branding, for no good reason. We also do know that the government cannot legally compel companies to lie, only to remain silent.

It's not "theory", it's publicly known facts that companies participating in mass surveillance denied it, and US official lied under oath to Congress (and weren't punished for it) to conceal it. There's no "theory" here.

> You offer no evidence for this incredible assertion.

The evidence to the above is publicly available and has been discussed to death. If you somehow managed to miss all of it, start with https://en.wikipedia.org/wiki/Mass_surveillance_in_the_Unite... and go on the links from there, it will take you some time.

> Some companies have previously collaborated with the government, generally without explicitly lying,

Yes, saying "we do not conduct this particular kind of surveillance ordered by this particular person" while knowing they conduct a slightly different kind of surveillance, ordered by different set of persons - is not explicitly lying. Just like saying "we don't have surveillance technology installed by FBI" if it's installed by NSA instead. There are many ways of lying without "explicitly lying".

> but we cannot jump to the conclusion that all companies would voluntarily lie in a coverup conspiracy

We can not and we do not. We do not know whether any specific company would lie - we just know this option is now very much on the table.

> which, by the way, opens them up to investor lawsuits and risks destroying their branding, for no good reason.

Being on good terms with somebody as powerful as US federal government is a very, very good reason. And I don't see anybody's branding being destroyed so far by the revelation of mass surveillance. We know about https://en.wikipedia.org/wiki/Room_641A and https://en.wikipedia.org/wiki/Hemisphere_Project - has AT&T brand been destroyed? Not in the least. And the government granted them immunity from lawsuits related to this.

Your whole post is filled with unsubstantiated conspiracy theories. The only program that named these companies was PRISM, which ingests data from targeted electronic wiretaps conducted by the FBI. None of the companies lied about that.

> Like, say, the matter of secret surveillance on the mass scale? I mean, the track record here is not exactly pristine.

There remains no evidence that any companies lied about secret surveillance on a mass scale.

It is possible that because of the nature of counterintelligence investigations, the individual companies agreed to gag orders while law enforcement does its work.

Also, these companies want to continue to do business in China, and likely do not want to be on the record accusing the government of a massive criminal conspiracy.

How can gag orders force companies to write such press statements?

Outright lying is financial suicide. Shareholders can and will sue the company.

Agreed. Also lying to your shareholders is illegal, providing additional incentive not to write the press release.

On the other hand, with this splashed across the front page of most news sites, they couldn't really stay silent.

Statements are very specific so it's easy to craft them in such a way that it basically respects the gag order and does not actually contain any untrue statement. Even " Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server." Would this statement hold true if it was found not by Apple?

"Apple never had any contact with the FBI or any other agency about such an incident." If Incident was being handled by 3d party private entity which was in contact with some gov entity this would hold true.

"We are not aware of any investigation by the FBI, nor are our contacts in law enforcement." If it was contacted by entity other than FBI this would hold true.

Also national security related investigations are highly segmented in corporations -- in the company the size of apple for instance there may be a handful of people with knowledge that the investigation is ongoing or even exists. Its not like the PR department (or even the full board) may be aware of its existence.

https://www.apple.com/newsroom/2018/10/what-businessweek-got... Finally, in response to questions we have received from other news organizations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.

Interesting. Doesn't get much clearer than that.

They throw out some massive numbers though. You can kinda discount 6 "apparatus" sources (but usually for stuff like this it's just one or two, so it's already unusual), but they also mention several people at Apple, Amazon and the FBI, plus someone else in the "discouragement" meeting. That's a lot of agents.

If it's made up, it's more realistic to believe the publication is complicit in the fabrication.

That's a good point. It makes things murky, which I suspect the massive amount of collaboration is the only reason Bloomberg published the article.

Could it be a conspiracy to deceive Bloomberg? From all the conspiracies, that seems the most likely to me.

Could these companies to anything _but_ outright deny it?

Silence would be perceived as confirmation, and claiming to not know would be terrifying to their customers. Confirming it would risk their entire supply chain.

Sure, maybe it's not true... but the only move here is to deny it even if it were true. The corporations involved have a massive amount to lose here.

The FBI is not the only jurisdiction these companies have to follow, if they want to continue to operate internationally. Couldn't such silencing orders come from China or something?

I also feel that the hack described is only borderline technically feasible.

They describe a microcontroller the size of a decoupling capacitor that is installed between the main CPU and main memory (as far as I can tell from the vague description).

I assume this would have to be done without layout changes. On a part of the board that is quite sensitive to layout changes. It just doesn’t seem likely that you’d do a hack like this. You’d need a micro controller or ASIC that was running as fast as main memory. You’d need to make it cope with different kernels... and edit memory such that remote servers could reliablely be contacted.

Why not just swap out some other part? Like the IPMI controller? Or the Ethernet controller? Something that has access to main memory, that would hide the functionality even better, and that would give the attacker more space to work with?

I don’t get it.

Maybe it’s just a very simple mod that slightly delays the signal based on the content - just enough to be another rowhammer.

Except... a key word in the article makes the hack perfectly believable and feasible: "baseboard management controller".

If the chip is inserted on the serial data line between the SPI flash memory and the BMC CPU, then, as an ex-InfoSec engineer, the whole thing sounds very plausible and even easy IMHO...

You have to expect that any article about intricate tech details written for a general audience will get parts of their descriptions wrong. Like you I was raising my eyebrows when I started reading. But when they mentioned the BMC, I believed. The author did not make a vague mistake when mentioning this very specific technical term.

In fact, the BMC is the perfect target for such a hardware hack: low-speed SPI flash memory interface easy to man-in-the-middle, BMC more privileged than the OS (can virtualize storage, keyboard, etc), BMC code independent of the OS (infect both Linux and Windows at once), BMC code changes so rarely that a backdoor making assumptions about the code layout and content would still work after many years of updates, etc.

Edit: I checked Supermicro servers from the 2015 era. Most used the AST2400 BMC. It boots from SPI flash so this backdoor chip only has to intercept and modify bytes on the data out (DO) line to inject malicious code.

This was my thinking as well. I was curious how such a device would do what they are claiming. And BMC is the perfect candidate to make this whole bit work. Reading that phrase definitely made the gears turn and the whole thing started to piece together a clearer picture.

I checked the photo.

AST2400 has option for two spi memories, one overrides the other by default. They simply put a microscopic spi flash in place of the second "recovery" flash.

I heard before the rumors of Chinese server mobos "talking" some gibberish on ICMP, so that must be it.

You could be right. But stuffing megabytes of a full copy of the BMC flash image in such a chip may be overkill. You could just as easily man-in-the-middle bytes sent by the legit flash over the SPI DO line...

Is this[1] possibly what you were referring to?

It might be interesting to try and reach out to that person, they may still have the hardware.

[1] https://communities.intel.com/thread/123362

Edit: the mobo in that post is the X11SPH-nCTF, which has the AST2500 BMC

The original article contains exactly 0 real technical information and reads like a spy story beginning.

Yes, they need to provide more details on how its supposed to even work. We can come up with all kinds of theories but proof is needed that this device is even a chip. I want layer photographs of that thing.

It does, and all the technical details mostly match up. From the plausible attack vector (targetting the BMC with an implant) to CG animations of a compromised motherboard showing the implant at the exact spot between the BMC and its firmware chip (which makes perfect sense if it's some kind of SPI interposer).

It lines up with a description of an attack from a security conference a few years back.

Them being public companies and all, can they lie to stockholders and prospective shareholders?

If China did this, kudos to them, in the sense that that's their job. Just like it is NSA's to do the same to them.

Apple, Google, Microsoft, Intel, FB and a few other companies can probably match China's expertise and expenditure. What about the rest?

Look at the stock of supermicro, since 2015 (the year of revelation) it's been going down for them - reason might be because none of the companies bought new hardware from them.

> Look at the stock of supermicro, since 2015 (the year of revelation) it's been going down for them - reason might be because none of the companies bought new hardware from them.

They've also had accounting irregularities that caused their stock to be delisted from NASDAQ: https://www.theregister.co.uk/2018/08/22/supermicro_facing_n...

> "The delay primarily relates to the magnitude of work that the company must still perform in order to review the company's accounting judgements, estimates and records for transactions that occurred during fiscal year 2015 through 2017, as well as the assessments and conclusions on the effectiveness of its internal control over financial reporting."

It's interesting that the irregularities started in 2015.

I heard on NPR this morning there were 17 sources for the article. That seems like a lot, if this is wrong.

Tinfoil hat time. Based on my assertions elsewhere I suspect this is posturing plausible deniability for a more local actor being responsible for implants that may or may not be discovered already.

The vigorous denials from Apple and Amazon are suspiciously against the grain in these situations.

Why would Apple care and lie to protect them?

This is my point. They wouldn't.

If you compare to MSFT etc whenever there is a "global cyber incident" the story is the same and correlates with the governments etc which is business as usual.

This is not business as usual.

Reply on news.ycombinator.com