China Embedded Spy Chips On Supermicro Motherboards

AlphaAtlas

[H]ard|Gawd
Staff member
Joined
Mar 3, 2018
Messages
1,713
According to a report by Bloomberg, the Chinese government has been spying on US tech companies with chips the size of a pencil head. Citing anonymous sources, Bloomberg claims intelligence officials went to the White House with information suggesting "China's military was preparing to insert the chips into Supermicro motherboards bound for U.S. companies" in early 2014. But without any evident targets or confirmed attacks, the White House chose to simply keep an ear on the ground. In 2015, as Amazon was looking to use servers from Elemental, Inc. for GPU accelerated video transcoding, an Amazon investigator detected some security peculiarities. The company sent a server to a third party, which found suspicious chips smaller than a grain of rice embedded on the Supermicro motherboards. These tiny microchips were connected to the baseboard management controller, giving attackers virtually unlimited and stealthy access to the whole system. This sent shocks through the security community, as Elemental's servers were used in CIA drones, Navy warships, and DoD datacenters. But that was just the start. The report claims Apple completely cut ties with Supermicro in 2015 over the issue, and that it "eventually affected almost 30 companies, including a major bank, [and] government contractors." As of now, Supermicro and other tech giants are vehemently denying Bloomberg's allegations. Thanks to Joe Wood for the tip.

One country in particular has an advantage executing this kind of attack: China, which by some estimates makes 75 percent of the world's mobile phones and 90 percent of its PCs. Still, to actually accomplish a seeding attack would mean developing a deep understanding of a product's design, manipulating components at the factory, and ensuring that the doctored devices made it through the global logistics chain to the desired location-a feat akin to throwing a stick in the Yangtze River upstream from Shanghai and ensuring that it washes ashore in Seattle. "Having a well-done, nation-state-level hardware implant surface would be like witnessing a unicorn jumping over a rainbow," says Joe Grand, a hardware hacker and the founder of Grand Idea Studio Inc. "Hardware is just so far off the radar, it's almost treated like black magic."
 

Meeho

Supreme [H]ardness
Joined
Aug 16, 2010
Messages
5,690
Not sure I'm buying it. Phoning home would've been cought long ago. Or were only specific Supermicro boards targeted that went to a few chosen companies? Otherwise, I don't see how this could've been kept secret seeing how much market share Supermicro has.
 

CombatChrisNC

[H]ard|Gawd
Joined
Apr 3, 2013
Messages
1,140
JFC.

Surprising, but also not at the same time.

Well, no more Supermicro stuff for me at all.
 

BloodyIron

2[H]4U
Joined
Jul 11, 2005
Messages
3,439
Intel Management Engine. It's literally in every Intel CPU for the last decade or so, and the chipsets, and you can't fully remove it or turn it off, with very special exceptions. It gives those with the tools access to literally everything in RAM and the CPU, and you can't do a damn thing about it.

And people wonder why they want to ban Chinese companies from selling cellphones in the US.....This crap doesn't surprise me, and it wouldn't surprise me that the US probably does the same.
 

pizzathehutt

Weaksauce
Joined
Mar 23, 2007
Messages
71
Bad supermicro....no biscuit. This is why we cant trust Chinese goods. Folks who live in the USA just don't understand that the freedoms we enjoy in this country are not found in others. Chinese company's are subject to the government under which they operate. The chineese government is one of the worst, most oppressive and restrictive in the world. Americans really need to travel to see how the world really works. We stick our head in the sand and make bad decisions based on price/cost. Yes these countries (china, cuba,russia,iran, etc) are REALLY out to get you, this is not a tin foil has situation. By the time the USA wakes up and pays attention it will be too late.
 

DPI

[H]F Junkie
Joined
Apr 20, 2013
Messages
12,585
God damn you supermicro breaking my heart, I really loved their motherboards for servers.. so damn reliable.
 

Elf_Boy

2[H]4U
Joined
Nov 16, 2007
Messages
2,495
The tech is possible, to my understanding, it could also be an urban legend, or some form of market manipulation.
 

Schtask

Limp Gawd
Joined
Nov 29, 2011
Messages
436
Just going to throw this out there. I am VERY skeptical of this report by Bloomberg. C2 comms have to occur. The data has to cross IDS / IPS to get home. I really want to see a technical write up on this before I pass judgement on SM.
 

SomeoneElse

[H]ard|Gawd
Joined
Jan 16, 2007
Messages
1,941
Intel Management Engine. It's literally in every Intel CPU for the last decade or so, and the chipsets, and you can't fully remove it or turn it off, with very special exceptions. It gives those with the tools access to literally everything in RAM and the CPU, and you can't do a damn thing about it.
Truth......which is why im not surprised.
 

Trepidati0n

[H]F Junkie
Joined
Oct 26, 2004
Messages
9,270
Just going to throw this out there. I am VERY skeptical of this report by Bloomberg. C2 comms have to occur. The data has to cross IDS / IPS to get home. I really want to see a technical write up on this before I pass judgement on SM.

So the fact that a nation state deliberately attempted espionage doesn't bother you? If you thought those tariffs were gonna go bye bye...not a chance in hell now.
 

katanaD

[H]ard|Gawd
Joined
Nov 15, 2016
Messages
1,987
The company sent a server to a third party, which found suspicious chips smaller than a grain of rice embedded on the Supermicro motherboards. These tiny microchips were connected to the baseboard management controller, giving attackers virtually unlimited and stealthy access to the whole system


just what are the little extra chips doing?

EDIT: HOLY SHIT !!

FTFA

Since the implants were small, the amount of code they contained was small as well. But they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere on the internet that were loaded with more complex code; and preparing the device’s operating system to accept this new code. The illicit chips could do all this because they were connected to the baseboard management controller, a kind of superchip that administrators use to remotely log in to problematic servers, giving them access to the most sensitive code even on machines that have crashed or are turned off.


VERY long read, but WOW
 
Last edited:

Clickjocky

n00b
Joined
Jul 24, 2015
Messages
13
So the fact that a nation state deliberately attempted espionage doesn't bother you? If you thought those tariffs were gonna go bye bye...not a chance in hell now.

GIve him a break. He is just using current knowledge to make a logical assumption that although the chip might be phoning home, it's going to be detected unless there is some sort of alternative way other than the one he suggested. I'm sure that in fact if it is the case everyone is going to come down squarely in your camp. I think it is smart to take a look at what's being reported skeptically. Let's get to the facts of why the chip is there in the first place. That alone is a cause for concern. Maybe it can be used to make the case that we need to start making the parts used in critical infrastructure here.

I'll add that I was concerned about Trump's comments that he was going to help the Chinese sell their cell phones here. My guess that he was just using that as lip service to get China to help with NK or something like that. I'm sure there is no way in hell that he wants that to happen.
 

Schtask

Limp Gawd
Joined
Nov 29, 2011
Messages
436
So the fact that a nation state deliberately attempted espionage doesn't bother you? If you thought those tariffs were gonna go bye bye...not a chance in hell now.

I never said nation state espionage doesn't bother me. I am saying that the story itself is missing key technical details it needs to pass my sniff test.
 
Joined
Dec 13, 2003
Messages
2,238
Intel Management Engine. It's literally in every Intel CPU for the last decade or so, and the chipsets, and you can't fully remove it or turn it off, with very special exceptions. It gives those with the tools access to literally everything in RAM and the CPU, and you can't do a damn thing about it.

Even worse is the IME has access to the onboard NIC and can transmit data even when the system is powered off.
 

pcgeekesq

[H]ard|Gawd
Joined
Apr 23, 2012
Messages
1,399
Not sure I'm buying it. Phoning home would've been cought long ago.
Look up "steganography." There's plenty of places to hide a few bits of data in every outgoing packet, and you'd never notice it if you weren't looking for it. And maybe not even then.

And if the chip is just a backdoor to let more capable malware in, you might never know it. You'd just have malware without an identifiable infection vector.
 

pcgeekesq

[H]ard|Gawd
Joined
Apr 23, 2012
Messages
1,399
I see 33%. It drops like every time I hit refresh.
We should ask the FBI to find out who had big short positions on SM, and see if they were involved in this "news."
I'm surprised the market hasn't suspended trading, you'd think the circuit breakers would have tripped.
 

Meeho

Supreme [H]ardness
Joined
Aug 16, 2010
Messages
5,690
Look up "steganography." There's plenty of places to hide a few bits of data in every outgoing packet, and you'd never notice it if you weren't looking for it. And maybe not even then.

And if the chip is just a backdoor to let more capable malware in, you might never know it. You'd just have malware without an identifiable infection vector.
It doesn't matter what's in the packet if it's going to an unsolicited IP.
 

Laowai

Gawd
Joined
Aug 9, 2018
Messages
534
In the article, hacker guy said...
“Hardware is just so far off the radar, it’s almost treated like black magic.”
Nothing is off the radar for China. This story is entirely possible. I'd still like more info though.
 

AlphaAtlas

[H]ard|Gawd
Staff member
Joined
Mar 3, 2018
Messages
1,713
We should ask the FBI to find out who had big short positions on SM, and see if they were involved in this "news."
I'm surprised the market hasn't suspended trading, you'd think the circuit breakers would have tripped.

The article mentions that NASDAQ delisted Supermicro back in August, due to some suspicious accounting and delayed reports. The stock prices we see are on exchanges outside the US, I believe.
 

pcgeekesq

[H]ard|Gawd
Joined
Apr 23, 2012
Messages
1,399
If you are asking then others are too. The trigger is now, I'd say.
If you like to gamble. Trust is everything in the server business. If this story isn't refuted soon, SM may collapse (and/or be seized by the Chinese government).
 
Top