Hacker News Reader

Comment by refenestrator | Hacker News Reader

> I'm not sure why you're implying that you need a super-spy to pull this off.

The factory doesn't have assembly lines marked like 'for apple', 'for the nsa'. It's just an assembly line making a bunch of identical boards. You'd have to identify a specific board way after it's left the assembly line, and probably after being integrated into a chassis to put your spy chip on it if it's targeted at a specific customer.

View on HN

The way we in the West do it is intercept the shipment en route and make modifications in a special facility. TAO have significant hardware capabilities and do this stuff routinely.

It's not some giant leap of the imagination.

So what you are saying is that they (China?) can and do intercept shipments from Supermicro inside the US? Or how do you get the chip onto the correct piece of hardware when you don't know where each motherboard ends up when it leaves the factory?

addressed here: https://news.ycombinator.com/item?id=26154076

1. Make a batch of bugged boards

2. Wait for an order from apple

3. Add the bugged boards

If the warehouses and manufacturing lines are all in China (as is the case with just in time manufacturing) I don't see why this is difficult to pull off.

I'd expect shipments across the Pacific to be aggregated into the smallest possible number of containers and only subdivided into batches for individual customers at the last possible moment, in order to minimize both transportation cost and the risk that any single customer loses their entire order when a container falls off the ship.

Is that not how it works? If so, I'd like to know why.

That'd depend on how the shipping is done. What you described would apply for something like retail, where the factory only deals/sells to a distributor (stateside), which then sells/ship them to retailers. Under that setup it would be hard to accurately predict where a particular motherboard would end up at the factory. However, I suspect for large orders, they won't bother with that and would send an entire shipping container or pallet to the customer straight from the factory.

Reply on news.ycombinator.com