The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

Minimalist · Oct 12, 2018

Supermicro boards were so bug ridden, why would hackers ever need implants?

Whether spy chips reported by Bloomberg existed, attackers had much easier options.
Click to expand...

https://arstechnica.com/information...-ridden-why-would-hackers-ever-need-implants/

Minimalist · Oct 19, 2018

Coats: ODNI has seen 'no evidence' of supply chain hack detailed in Bloomberg story

Director of National Intelligence Dan Coats told CyberScoop on Thursday that he’s seen no evidence of Chinese actors tampering with motherboards made by Super Micro Computer, becoming the latest national security official to question a Bloomberg report that stated the company was the victim of a supply chain hack.
Click to expand...

https://www.cyberscoop.com/dan-coats-bloomberg-supply-chain-the-big-hack/

hawki · Oct 19, 2018

"Apple CEO Tim Cook Calls on Bloomberg to Retract Report on Chinese Spy Chip: ‘No Truth in Their Story’..."

But, Bloomberg reaffirms its story:

"Bloomberg Businessweek’s investigation is the result of more than a year of reporting, during which we conducted more than 100 interviews. Seventeen individual sources, including government officials and insiders at the companies, confirmed the manipulation of hardware and other elements of the attacks. ...We stand by our story and are confident in our reporting and sources.”

https://www.mediaite.com/online/app...-on-chinese-spy-chip-no-truth-in-their-story/

Daveski17 · Oct 19, 2018

Hmmm ... I still say it's all a bit jackanory.

Minimalist · Oct 20, 2018

I guess they will sort it out on court.

__Nikopol · Oct 20, 2018

Is it that absolutely tiny little blip? That can't really do anything. It's smaller than an SMD diode.

ronjor · Oct 22, 2018

Super Micro to review hardware for malicious chips

by Sonam Rai October 22, 2018
(Reuters) - Super Micro Computer Inc said on Monday it will review its hardware for any proof of malicious chips as alleged in a recent media report.
Click to expand...

guest · Oct 26, 2018

Copy of Chinese Spy Chip Used in Security Training
October 26, 2018
https://www.infosecurity-magazine.com/news/copy-of-chinese-spy-chip-used-in/

Following reports that Chinese spies infiltrated the supply chain of servers assembled by Supermicro Computers Inc., the New York–based CYBERGYM has launched a new infrastructure-security combat training program.

In an effort to make the training as realistic as possible, the engineers and white-hat hackers at CYBERGYM developed a virtual model of the surveillance chip identified in the Bloomberg report. The virtual model emulates the actual attack scenario, which will allow participants to respond to a real-life chain of events, GYMBERGYM said.

Available in cyber-warfare arenas in the US, Europe, Asia and Australia, the training provides organizations with the strategies needed to defend against complex, hardware-based attacks, which requires advanced forensic analysis.

"Our program is based on multilayered forensics and is designed to fundamentally enhance both human training and policy implementation," said Ofir Hason, CEO of CYBERGYM, in a press release.
Click to expand...

Press Release - "CYBERGYM Launches New Infrastructure Security Combat Training in Response to the Chinese Spy Chip Hack"

__Nikopol · Oct 26, 2018

So they basically want to teach them about quality control. I mean, all they have to do is actually look at the product they produce. It's not like we heared about firmware modifications that you can't see.

Minimalist · Oct 30, 2018

I've blogged twice about the Bloomberg story that China bugged Supermicro networking equipment destined to the US. We still don't know if the story is true, although I am increasingly skeptical because of the lack of corroborating evidence to emerge.

We don't know anything more, but this is the most comprehensive rebuttal of the story I have read.
Click to expand...

https://www.schneier.com/blog/archives/2018/10/more_on_the_sup.html

guest · Nov 13, 2018

Chinese server hack story doesn't convince chip CEOs
The heads of NXP and Ampere say it'd be impractical for China to insert spy chips into servers
November 13, 2018
https://www.cnet.com/news/chinese-server-hack-story-from-bloomberg-doesnt-convince-chip-ceos/

Two chip CEOs said Tuesday that they didn't believe it was practical for China to insert spying chips into servers bound for US companies.

NXP CEO Richard Clemmer and Renee James, the former president of Intel and current CEO of data center chip startup Ampere, noted that semiconductor manufacturing is too complex, automated and secure for spy chips to be easily embedded onto technology without being noticed.

"It's not just someone walks out to an assembly line," James said. "That's not how they're made."
Click to expand...

ronjor · Dec 11, 2018

Super Micro says review found no malicious chips in motherboards

Joseph Menn December 11, 2018
SAN FRANCISCO (Reuters) - Computer hardware maker Super Micro Computer Inc told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards.
Click to expand...

ronjor · Jan 8, 2019

Chinese Super Micro Hardware Hack

January 7, 2019 12:47 by Elizabeth Montalbano
Though the companies named in a blockbuster Bloomberg story have denied that China hacked into Super Micro Computer hardware that shipped to Amazon, Apple and nearly 30 other firms, a recent demonstration at hacking conference in Germany proves the plausibility of the alleged hack.
Click to expand...

guest · May 2, 2019

Motherboard maker Super Micro is moving production away from China to avoid spying rumors
Whether spying claims true or not, fear is causing change
May 2, 2019
https://www.techspot.com/news/79909-motherboard-maker-super-micro-moving-production-china-avoid.html

Through the looking glass: Questionable facts may have caused severe damage to Super Micro's brand reputation and are now causing a relocation of motherboard manufacturing. China once produced the vast majority of all server motherboards, but will soon be responsible for less than half.

Even though there has been no evidence found in independent investigations to date, Super Micro is now moving their production out of China to make its customers happy. As a result of the alleged spy chips, Super Micro has faced difficulty making sales to select US customers and those with ties to government.
Aside from asking partners to relocate, Super Micro is also building out its own production capabilities. The goal of internal expansion is to eliminate the perception of susceptibility to any future attacks.

After all of the negative press Super Micro has received as a result of the Bloomberg report, the company's sales have fallen nearly 10 percent during the first quarter. There is also a strong possibility that Super Micro will slide from the third largest server maker to the fourth slot.
Click to expand...

guest · Oct 5, 2019

Editorial: A year later, Bloomberg silently stands by its 'Big Hack' iCloud spy chip story
October 4, 2019
https://appleinsider.com/articles/1...-stands-by-its-big-hack-icloud-spy-chip-story

The story from 2018 claimed that many firms were compromised by how they had bought servers from a company called Super Micro. Secretly embedded in the motherboards of these servers were Chinese spy chips.
If it were true, then "The Big Hack" by reporters Jordan Robertson and Michael Riley, would've been the Watergate of technology stories.

Mind you, if it were true, there would also be proof.
This was the one thing lacking from the Bloomberg piece
[...] a couple of weeks after the story broke, every organization or type of investigator you can think of, was saying the same thing. Industry experts established that the allegations were technically impossible.
Click to expand...

Activity and no activity
Unless Bloomberg does publish either some proof or a retraction, we're unlikely to know what has really gone on in the year since its story was published.
Apple has nothing more to say, and presumably neither it nor any of the other companies mentioned in the article, have anything more they can do, until Bloomberg proves or retracts the claims.

That could be why Bloomberg remains silent. It could be because reopening the story publicly could further damage the company either in terms of reputation or, conceivably, legal issues.
Bloomberg may have believed its story, and so initially was just woefully incompetent, but its actions since are letting us all down.
Click to expand...

mirimir · Oct 5, 2019

Sure, but still ... https://asia.nikkei.com/Economy/Tra...cro-to-ditch-made-in-China-parts-on-spy-fears

guest · Oct 10, 2019

Planting Tiny Spy Chips in Hardware Can Cost as Little as $200
October 10, 2019
https://www.wired.com/story/plant-spy-chips-hardware-supermicro-cheap-proof-of-concept/

At the CS3sthlm security conference later this month, security researcher Monta Elkins will show how he created a proof-of-concept version of that hardware hack in his basement. He intends to demonstrate just how easily spies, criminals, or saboteurs with even minimal skills, working on a shoestring budget, can plant a chip in enterprise IT equipment to offer themselves stealthy backdoor access.

"By showing people the hardware, I wanted to make it much more real. It’s not magical. It’s not impossible. I could do this in my basement. And there are lots of people smarter than me, and they can do it for almost nothing."
"For an adversary who wants to spend any money on it, this would not have been a difficult task," Hudson says.
"There’s no need for further comment about false reports from more than a year ago," Supermicro said in a statement.

But Elkins points out that his firewall-based attack, while far less sophisticated, doesn't require that custom chip at all—only his $2 one. "Don’t discount this attack because you think someone needs a chip fab to do it," Elkins says. "Basically anyone who’s an electronic hobbyist can do a version of this at home."
Click to expand...

Log in or Sign up

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

Minimalist Registered Member

Minimalist Registered Member

hawki Registered Member

Daveski17 Registered Member

Minimalist Registered Member

__Nikopol Registered Member

ronjor Global Moderator

guest Guest

__Nikopol Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

mirimir Registered Member

guest Guest

Log in or Sign up

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

Minimalist Registered Member

Minimalist Registered Member

hawki Registered Member

Daveski17 Registered Member

Minimalist Registered Member

__Nikopol Registered Member

ronjor Global Moderator

guest Guest

__Nikopol Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

mirimir Registered Member

guest Guest

Useful Searches