Bloomberg Reports China Infiltrated the Supermicro Supply Chain We Investigate

> If the FBI, or other intelligence officials, had reason to believe Supermicro hardware was compromised, then we would expect it would have taken less than a few years for this procurement to stop.

From the perspective of someone who merely reads what experts write, that isn't true at all. If you have information on your enemy's operations and they are unaware, you have the information advantage and you don't give it up. You use it to monitor them, trace their activities: For example, where does the connection go? And where does the information go from there? Plant malware in whatever is sent back in order to trace who accesses it and maybe give you a backdoor, or if you can't do that plant false information and see where it turns up. Also, who is physically planting the PCB? Mine them, their activities, and social network for more intel.

Also undermine your enemy with false information and by shutting them down not now, reactively, but at the worst possible time for them - when the crisis hits in the South China Sea or Taiwan, pull the plug on their intel or start feeding it false info. And in the meantime, avoid giving them anything too valuable.

On one hand, undoubtedly I have massive blinds spots in my knowledge and the details are probably somehow wrong. On the other, I'm somewhat confident that many times, an intelligence agency would not reveal what they know and would do the kinds of things I'm discussing.

Why spend 2 paragraphs talking about how DRAM chips cannot be intercepted because of large number of lines only to get to the point later and say "BMC chips are more probable"?

This is obvious. This article is annoying to read.

>Saying there is a vulnerability in a BMC is like saying the sun is hot.

This was my thought upon hearing the story when it broke this morning. There has to either be more to it, or I suppose..less. I did wonder if it was some sort of false flag op designed to make people in the US fearful about Chinese Hacking. Based on the people I've spoken to, inside the industry today, it has succeeded.

> Bloomberg says it is in line with memory to CPUs to intercept some password validation code

I think that's a misreading of their article. They were not claiming that's what was actually done, they just provided that as an example of what a HW attacker could do. Later on I remember them saying that the malicious part was connected to the BMC, not the main CPU. If there's a serious USB vuln in the BMC, then four wires could be enough to compromise it and gain God Mode over the early x86 SW environment.

I still don't get why they need to make a custom chip and embed it in the PCB just to subvert a chip (BMC) that they also supply (or can at least change the firmware for)??

Thanks for this investigation. I was trying to think of what an actor in a position to insert such chips at a manufacturing level would actually want. You've got some tough limitations - you want a security hole that you can exploit on highly firewalled, monitored, and locked-down servers running a variety of software types. But it also needs to be hard to detect and exploit without knowing some sort of secret. If anyone notices you using the exploit, you're screwed. If any security researcher or black-hat hacker finds it too, you're also screwed. It'd have to be pretty good to avoid that, since those guys are probably fuzzing servers all the time. You'd have to be very careful how you used it - if anybody traces a known data breach to this, then you're screwed too.

Presuming you can get control of the BMC and transmit arbitrary network traffic, you'd have to limit it somehow. At least some of the compromised servers would be installed in places where any unexpected outgoing network traffic would be noticed and investigated. Large amounts of detectable traffic could be generated too if these things are all pinging away at something. You'd have to trigger it somehow I suppose. But what kind of trigger can you set up on a server running an unknown OS in unknown configuration that may be behind lots of firewalls? Are we sending some kind of weird magic packet to the server? If I was Google or something, I'd have dumb filtering firewalls set up in front of my servers that drop anything that doesn't look like normal network traffic, just to keep any random person from fuzzing the server and triggering some weird unknown bug.

Disappointed that there was not any actual technical substance to this article aside from the pictures of the boards. I was excited for a moment, hoping they'd get further until the details, but it ended up in some opinionated rant about how the SEC should get involved.

Just give me the option to totally disable this functionality. I understand why farms need it, but I should be able to turn it off. That and Intel AMT.

Couldn't this all be easily thwarted with a relatively basic firewall and network analysis of traffic emanating from a data-center?

Also - I found it funny that the "horrific exploit" was just piggybacking on a mgmt engine vuln...

I like servethehome.com as a good place to learn about people running servers in their home (thus the name), but that wasn't the greatest article. Look into their forums for more interesting technical discussion.