Hackers spent 2 years looting secrets of chipmaker NXP before being detected | Hacker News Reader

Hackers spent 2 years looting secrets of chipmaker NXP before being detected

arstechnica.com

210 pointscuriousObject39 comments

Open articleView on HN

If they had the decency to release some good documentation for NXP's devices, I'm sure nobody would mind the hack.

I guess we figured out how one nation-state got transparency from NXP.

I am sure there was nothing of that sort to be found. :-)

That explains why they couldn’t figure out what’s going on internally, even after being inside for 2 years.

Probably got lost and couldn’t figure out how to even get out.

Explains why they stuck around for 2 years lmao

Related: Another Vulnerability in the LPC55S69 ROM

https://news.ycombinator.com/item?id=30778778

This was disclosed about a year and half ago.

First, that documentation would have to exist. ;)

Two major pillars of NXP's sales strategy are their security architecture and integration with other NXP devices (primarily connectivity ICs since the Marvell Wi-fi acquisition).

They are typically more expensive than competitors (Infineon, TI, ST, etc). This is due to their strategy to only compete in markets where they believe they can command a healthy profit margin.

Going to be a difficult strategy to maintain in a few years when there are identical products from China for 1/2 the cost...

I wonder if it would be possible and likely for products based in I.P. theft to be banned for import into Western markets.

People would get pretty upset when the shelves are empty. Almost no technology is invented in a vacuum.

Also, FTDI once tried to detect and disable Chinese fakes of their chips and it did not work well for them.

> People would get pretty upset when the shelves are empty

Haha, funny that you remind about empty shelves when talking about NXP.

Ransomware attack could have been better option for NXP. It would likely be over quickly and force them to take security seriously. Now, they were bleeding industrial and trade secrets for more than a year.

It's hard to argue against the proposition that ransomware is a canary for security vulnerabilities. Depending on how much commercial espionage it reduces, it may be a net cost saving in the long-run.

Playing the devil's advocate: if their network was like their datasheets, i'm feeling sorry for the "hackers". /s

Recent discussion: https://news.ycombinator.com/item?id=38406429

> It's likely the TA knows of specific flaws reported to NXP that can be leveraged to exploit devices the chips are embedded in, and that's assuming they didn't implement backdoors themselves. Over 2.5 years (at least), that's not unrealistic.”

I assume these chips had backdoors long before Chinese hackers started collecting files and saving them to dropbox. Pretty convenient to be able to blame Chinese hackers for any backdoors that come to light now.

Convenient how, for who?

"Our products only have backdoors because China added those to our woulda-been-secure-if-they-hadn't designs..."

That does not sound like a winning sales pitch to me.

Presumably convenient for the group who really added the backdoors.

Unless that group is both (1) caught, and (2) threatened with serious punishment for adding backdoors, I see no convenience.

Any uncaught or beyond-reach-of-the-law group would want to take credit for their own work.

The implication is that it's a nation state, and not one of the "bad guys".

Domestic Chinese MCU company popping up with suspiciously similar part functionality to NXP's in 3, 2, 1...

Your NXP HSM or SHE may not be as secure as you had hoped. Sigh.

Seems like what I've had to deal with in real life with mean people bullying me and never letting me have an actual secret.

What does "several sources" actually mean? Who should that exclude?

With "cloud" services being mentioned, they say hackers used cloud storage to evade detection, but what if the initial intrusion vector itself was planted by an AWS employee?

Saudis used their nationals inside Twitter quite brazenly. Imagine how many other rouge nation nationals are there being used by their governments.

AWS infrastructure is complaint, Twitter isn't.

Apples to orangutans.

Compliant with what?

With CIA requirements. /s

that seems like a wildly overcomplicated method of hacking a commercial organisation...

these 3rd world authoritarian regimes try to do this all the time, for example Russia routinely tries to recruit russian-speaking engineers at US/EU companies for industrial espionage. for example [1]

there are more cases that nobody publishes about - a lot of "ransomware" incidents - are actually employee who suddenly received email with malicious URL and clicked on it infecting his work computer - gaining plausable deniability by being "dumb IT user" while collecting $$$$ from criminal org for granting them initial access.

a lot of smaller/obscure outsource IT companies can cause you ransomware incident if you decide to terminate software development contract with them, because these could be literally North Korean hackers working as your sysadmins [2].

1. https://cpomagazine.com/cyber-security/hacker-offered-russia...

2. https://apnews.com/article/north-korea-weapons-program-it-wo...

> A prolific espionage hacking group with ties to China

Lovely

Reply on news.ycombinator.com