DHS Press Secretary on Recent Media Reports of Potential Supply Chain Compromise

There's an Oscar Wilde quote in there somewhere.

The DOD and the IC broadly have been very focused on Supply Chain Risk Management for a long time. Unfortunately the way the SCRM process works inside the govt is that it's legally focused and limited to primarily defense products, specifically things like hardware used in missiles, planes and equipment.

The major shift over the last decade or two to the commercial world being the source of a lot of risk vectors that impact the govt, means that govt capabilities to have oversight and control, or even warning, is severely limited. This case is a great example of that, as more and more threats to the govt are coming through commercial and personal devices.

Said another way, foreign adversaries don't need to target military equipment to have major capacity to spy on, or impact US government activities and policies. Private companies have to request support from DHS when there isn't a known risk to military supply chain. 99% of companies don't do this because 1. They don't want to, 2. The govt makes it hard to do and 3. It's not advertised well.

The US Govt is not structured to handle this at scale and there is no real solution without making a HUGE shift in private sector oversight that would be incredibly unconstitutional.

It at least looks capable of spiking back to the medium term average once the news clears: http://tools.morningstar.co.uk/uk/stockreport/default.aspx?S...

Folks reading this: Please tread with caution, don't take stock advice from HN. Especially for OTC stock. While the story may be false, it's very likely they may never recover.

- Their product is fungible, folks on the front line buying motherboards may just chose to avoid SuperMicro to avoid awkward conversations with their boss.

- They were having financial issues before, had some shady accounting and got delisted from Nasdaq. They're now traded over the counter.

- Last quarter their net earnings were $17M; that'll most likely be wiped and they'll go in the red.

- They've got $120M in the bank and $700M in quarterly operating expenses.

- The market can stay irrational longer than you can stay liquid.

Many companies are now likely auditing their systems for mystery chips. Many companies have learned of the hacked firmware distributed to Apple. Many in-progress orders may have been halted.

This may be fatal to them.

Undervalued in general, stupidly undervalued after the drop in their stock last week. I bought a considerable chunk on Thursday @ 11/share.

They were having "accounting issues" before this...

https://www.theregister.co.uk/2018/08/22/supermicro_facing_n...

A case of a malicious driver update served by Supermicro has already been publicly confirmed by at least two former customers. Even if the hardware hack allegation is conclusively proven false, they will have a tough time acquiring and keeping customers.

@awake: Let's assume that the story is false and then ask yourself some questions:

What is the story about?; Why was it released?; Is the timing significant?; Who are and will continue to be SM's customers? ...prospects for future customers? ...prospects for current and future earnings?

If you like the answers to those questions (and those are just the ones I could think of in 30 secs), you know what to do.

Cheers!

Hacking is one thing, your main outsourcing partner planting hardware backdoors by the millions is quite another.

These are companies that take your money and then hack you.

Why would they do that? Surely it's to their advantage to actually tell the targets of the supply chain attack about it?

What are you basing this on other than speculation?

PCAP everything, discretely, then think about next steps

I would say that if you don’t know the answer to that, you don’t have a potentially compromised board and are just chasing ghosts.

Put pics and facts here anonymously. Alternatively mail a computer security company or FBI - folks are hungry for examples. Or mail me and I will help. Or Bruce Schneier or Krebs or...

If any box on your network is establishing outbound connetions to machines in china, that would be suspect... Firewalls and IDS at least detect/block this activity.

It’s basically an “artist’s representation”. The chip in the image on the Bloomberg cover looks like typical 3-pin oscillator package, and absolutely not a thing that would be placed on a bus with data going through it.

It's not a micro, but there are microcontrollers that are comparable in size. An AVR ATtiny20 is available in a 1.5mm x 1.4mm package. That's just about a 2mm^2 footprint, it's totally insane.

Someone found it on sale for 10 cents on Taobao,

https://archive.fo/3k7e2

(scroll down to the bottom)

It's a Ceramic balun HHM1522E1 patch 0805 signal adjustment 880MHz ~ 960MHz

I don't see why it's so clear cut. The available evidence is congruent with Bloomberg's story being either true or false.

But it is still possible that DHS is just not aware of CIA/NSA discoveries and activities.

There were suspicious events that signal that something is up, like when Apple completely switched from Supermicro to other vendors or when they started to develop processes to prevent supply chain hardware attack around time when CIA supposedly found the bug (2015-2016).

iPhone is also switched from Qualcomm modem to US designed and fabricated by Intel.

There's still too many weasel words in the statement. They didn't confirm that the article is wrong, the said "we have no reason to doubt the statements from the companies named in the story". That could just be another way of saying "we have no reason to doubt that Apple and Amazon weren't aware of the issue." It could also just be DHS trying to cover their ass. They say that supply chain security is core to their mission, so having an article come out alleging that the most valuable company in the world and the primary supplier of government cloud infrastructure were affected by a compromised supply chain would be pretty embarrasing for DHS.

> Supermicro's stock took a beating and now they will have a legal case against Bloomberg.

Under the First Amendment Supermicro would have to prove actual malice—that is that Bloomberg knee its reporting was false or acted with reckless disregard for the truth. That’s a very difficult standard to meet.

Actually they said they have 'no reason to doubt' them, which would imply that if something damning was found they could then just say 'ah well now we have reason to doubt.'

In other words, they said nothing at all.