Hacker News Reader

Comment by Lammy | Hacker News Reader

And yet people loudly denounced Bloomberg for "The Big Hack" story every time it came up on HN: https://www.bloomberg.com/news/features/2018-10-04/the-big-h...

I believed it then, and I still believe it now. An "evil" BMC (like the ASPEED AST2600 mentioned in this article) is game over security-wise. BMCs are capable of flashing the BIOS/UEFI, capable of inserting arbitrary disk images as virtual CD/etc drives, capable of arbitrary keyboard/mouse input equivalent to having a hardware keyboard/mouse attached, like a remote evil-maid. If you had to pick one single thing to "pwn" in a server it would be the BMC. There's no way it's just a typo.

View on HN

Bloomberg didn't just claim "evil" BMC, but very specific things that nobody ever could confirm, and Bloomberg never supplied any evidence about. If the Bloomberg reporting, or any followup, had been anywhere close to e.g. the reporting in this blog post in detail, then they would have a believable case.

Nah, thing is everyone jumped on Bloomberg for a "shitty" story back then Now all we have is one blog post and some typos and the majority opinion is ether bad quality control / sloppy organization / indicator of systematic issues or b) potential supply chain attack. Which doesn't make a lot of sense.

Of course it makes sense to treat reporting that claims a thing and provides evidence of the thing differently from reporting that claims something less likely without providing any evidence.

It's very believable, but that's basically all that the bloomberg story had going for it. None of the actual concrete details (of which there were few) made any sense.

Worth noting that the original post mentioned the Bloomberg story and if you click through to the blog post related to that, the post’s author found Bloomberg’s focus on Supermicro irresponsible even though the general issue is a problem.

I myself don’t have much of an opinion on this

It's obvious that an evil BMC would be game over because the BMC is the most trusted component in the system (for normal servers that don't have Titan or whatever). But there's no evidence of compromised BMCs actually happening.

Is there evidence of it not happening? Can I do a reproducible build of a verified AMI BMC firmware and compare it against what comes flashed on my motherboard? They have a "MegaRAC Open Edition" but it says it's only for "OCP compliant platforms": https://github.com/opencomputeproject/HWMgmt-MegaRAC-OpenEdi...

Honestly the industry is a decade away from meeting that standard. And given that AMI is the lowest bidder we shouldn't even expect them to meet current best practices.

This exploit was found within a year of Bloomberg's article being published: https://www.wired.com/story/supermicro-bug-virtual-usb/

Whether or not that was the exploit being referred to by Bloomberg is unknown, but suspicious.

I'm curious how you fit a bug in firmware to the Bloomberg story of additional components being added to boards?

As the source of the report and the communication between them and Bloomberg remains undisclosed, we can only speculate.

Perhaps there was a Chinese whispers (no pun intended) style miscommunication and while the original source meant "software component", it became "hardware component" somewhere along. Or the attack was actually developed as proof-of-concept but never applied in the wild. The attack is feasible as other security researchers have shown:

https://media.ccc.de/v/35c3-9597-modchips_of_the_state

Yeah, but after Bloombergs repeated insistence that they got it right and stand behind their reporting I'm really only willing to give them credit it something that actually matches what they claimed gets revealed. Because "BMCs are vulnerable" is not a big story, they don't get to claim that as evidence for their wild claims.

whatever became of it? I thought at the time security experts would swarm and dissect it to death to give us articles after articles of concrete tampering examples... but it just vanished?

Security researchers did swarm on it and none of them could corroborate the story. It's been widely discredited in security researcher circles.

If it was an attack that one guy was specifically being attacked.

This exploit was found after the article was published: https://www.wired.com/story/supermicro-bug-virtual-usb/

That is an unintended vulnerability which can be exploited. While also bad it's not evidence of a malicious hardware installed before leaving the factory.

No one has ever found or been shown one of the affected boards.

When it's a plausible attack against an obviously-critical component it seems most prudent to assume the worst and hope to be wrong :)

Okay, assume that your motherboard/BMC is backdoored. What exactly is the sane way to proceed, given that you can't verify it and you have no reason to believe that any alternatives are better?

At home I have my BMCs on a network segment where they can't talk to each other, to the Internet (so no auto-updating), or even to any of my client machines. When I want to use one I connect a patch cable from my laptop to a designated breakglass port on one of my switches.

I do run DHCP/NTP/etc on that subnet, but those services are running in FreeBSD Jails connected to the host OS with vnet(9) "epair" interfaces given RFC3021-style /31 addresses (and/or the IPv6 equivalent) and firewalled with PF on the host-OS side such that none of them have the ability to explore any other parts of my network if they get popped :)

The idea was that it could just compromise your host OS. It doesn't matter that you jail services, since the attack is affecting the hardware underneath the kernel that underlies them; the theoretical attack was more along the lines of "the motherboard watches incoming packets and if it sees a trigger then that packet never makes it to the OS, and if the motherboard wants to send traffic it can either send packets itself (after reading the route table directly out of kernel memory) or modify already-outbound traffic to exfiltrate whatever it wants".

Buy open-source hardware that doesn't have so many compromise points? Assemble some kind of bootstrap verifier out of NAND gates and use that to run your own chip fab?

Reply on news.ycombinator.com