|
|
This topic comprises 2 pages: 1 2
|
|
Author
|
Topic: Supermicro Motherboards hacked?
|
|
|
|
|
|
|
Randy Stankey
Film God
Posts: 6539
From: Erie, Pennsylvania
Registered: Jun 99
|
posted 10-14-2018 10:22 AM
When I first heard this story, I was pretty shocked but, as time goes on and I have had a chance to think about it, this story just doesn't pass the smell test with me.
It would be a pretty huge undertaking to pull off an operation like this:
First, somebody would have to obtain the schematic diagrams for the circuit boards in question. That information would not ordinarily be released to a semiconductor assembly plant. The whole board would have to be reverse engineered if you don't have the schematics. That's not something that "just anybody" can do.
Then, the board would have to be redesigned. It might be as simple as adding one component but somebody would have to test the new design to be sure that it works as intended and remains undetectable. Again, "just anybody" would not be able to do this.
Next, somebody would have to get inside the PC Board manufacturing plant ("Board House") and substitute all the faked printing/etching masks for the real ones and get them into production. Most electronics assembly plants don't design and build their own boards. They usually get shipped in from a separate plant.
Then, somebody has to get inside the SMT Assembly plant and redesign ALL of the tooling to make these boards. The SMT (paste) stencils, the SMT "Pick-and-Place" machines and several Automated Optical Inspection programs would need to be changed... all undetected.
You would need to test all of these boards once them are made and all of the testing procedures would have to be re-created, too. Plus, the added chips/circuits would all have to be tested in secret.
You would have to do all of this, do it in secret while hundreds of people are involved in the manufacturing process and it all has to be done in a time frame that meets the customer's schedule.
That's a HUGE undertaking and I believe it would be a daunting task even for a government to do in the time frame we are talking about and it's difficult for me to believe that even the Chinese Government could pull this off and keep it secret for so long.
| IP: Logged
|
|
Harold Hallikainen
Jedi Master Film Handler
Posts: 906
From: Denver, CO, USA
Registered: Aug 2009
|
posted 10-14-2018 12:58 PM
It IS interesting that only Bloomberg is reporting this. Further, just because something is very difficult does not mean someone will not do it. Here's an article discussing ways this could be accomplished ( https://www.electronicdesign.com/embedded-revolution/how-hack-server-motherboard ):
How to Hack a Server Motherboard
Bloomberg Businessweek reported on an alleged hardware attack by China that impacted server motherboards. This is how it might work.
William Wong | Oct 10, 2018
Bloomberg Businessweek’s “The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies” article alleges Chinese-based corruption of the supply chain by adding a chip to the motherboard (see figure). This is likely replacing or intercepting communication from the baseboard management controller (BMC) and the serial flash-memory chip that holds the BMC’s code. One of the most common BMC chip families comes from Aspeed, a Chinese vendor. A number of chips populate this family, and they’re used on the motherboards in question.
The BMC is a typical Arm-based system-on-chip (SoC). It has on-board peripherals and some memory, but it can utilize off-chip memory as well. Often the boot code is contained in a serial flash device or a parallel NAND flash device.
What’s the Best Method to Fix the Problem?
In theory, it would be easy to replace the application in flash memory with compromised code, but this approach has a problem. The flash memory is often reprogrammed by the vendor when it receives the motherboard to allow for delivery of the hardware with the latest code. This is often done using a connection directly to the memory rather than booting the system and programming in new software, although that’s a possible method as well. However, it could be circumvented by a compromised system.
Another approach would be to replace the memory chip with a custom version that included compromised code. The challenge with this approach it twofold. First, creating such a chip is a major undertaking. Second, the size and capacity of the chip would be limited by the chip it replaced. This may be less of an issue given the size reductions available using new technology.
The baseboard management controller (BMC) is an SoC that can boot from off-chip flash or serial memory. Interposing a chip between the serial memory would be one way to take control of the system.
The third, and evidently the chosen approach, is to add a custom chip between the serial memory and the BMC. This has the advantage of not changing the flash memory, but it does mean creating a new chip which, as noted, isn’t an easy task. It could be a relatively simple chip, and it’s even possible to use an existing microcontroller.
The challenge is that the traces on the motherboard for the serial memory would have to be altered. According to Bloomberg, contractors building the boards and populating them were coerced to make these additions. The small size of the chip and minimal alterations would prevent a casual observer from noting a change. Hiding the chip near or under other hardware makes that task even more difficult.
The advantage of this approach is it would work with a wider range of motherboards. The attacker’s chip could be programmed to handle different BMC chips. Also, the amount of code that the attacker needs to include on their chip doesn’t have to be large since it can take advantage of the code that the BMC chip would load from the flash memory on boot. Attackers simply need to modify the code to suit their needs. The existing code is likely to include a small RTOS, communication support, etc., that could be exploited. Such an approach isn’t easy to implement but very practical.
There have been more details revealed lately and it appears that the motherboard circuit board did not have to be modified. Likewise, the additional chip may simply be a standard serial memory chip that was added to a location designed for the chip and left unpopulated. This is a common design approach to provide more options. For example, a TPM security chip is often an option for a server motherboard. The chip is simply left out if the motherboard will not provide that option.
Leaving out a single chip is common, but so is leaving entire sections of a printed circuit board (PCB) unpopulated. It would be impossible for someone without a circuit diagram and bill of materials to determine what should or should not be on a PCB.
The hack was supposedly caught, not by observing the changes to the motherboard, but by network traffic that was abnormal. A more sophisticated implementation might delay compromised communication until much later making it much harder to detect.
BMC at the Center of It All
The BMC is normally tied into one or two Ethernet ports. Normally one is designed to be connected to a dedicated administration network that’s often isolated so that traffic can’t get on the internet. Network managers are able to use this network to manage a server farm; the operating systems and applications that run on the server can’t even detect that this is being done. A BMC typically provides simulated serial ports and disk drives that are indistinguishable from the real thing. They can also control and modify the boot memory for the main processor.
A second BMC port is often piggybacked onto a network port used by the main processor. It would be connected to a more public network or the internet. This “feature” allows the public network to be used for administration, simplifying the operation of small networks by not requiring a parallel network for each server. Encrypted communication can prevent attacks even in this case, but it’s not the same thing as an isolated network. Of course, the compromised BMC could also gain control of the main processor, though that’s a much harder programming chore. Compromising the BMC is much easier.
The BMC has control of both ports; therefore, a compromised system could use the public connection even while the BMC application was using the administration network in the normal fashion. The BMC will need an IP address on the public network in addition to the one needed for the processor, so that could be a way of detecting a problem assuming the compromised system would operate in such a way.
Some SoCs are designed to address this type of attack, but most are not. Essentially, each SoC would need to have its own crypto identification that’s used to verify or decrypt boot code. This would prevent booting of a compromised system. It typically requires a signed version of code that’s unique to an SoC.
The advantage of this approach is that the SoC creation process needs to be secure, which tends to be much easier to manage than the assembly of boards, chips, and other hardware to create a server or other device. Unfortunately, this approach is relatively new, not available to most OEMs, and not used by most vendors—yet.
Antivirus software, even something implemented in the processor’s boot code, is incapable of detecting or preventing an attack like this from compromising the system.
If the attack winds up being real, then it could force many companies to reevaluate all aspects of their supply chain. It might be a good idea to do that anyway, because even if this instance was a hoax, the next one may not be. The method of attack is valid, although it’s difficult to implement unless one has influence over part of the supply chain. Still, there are many ways to do this.
System security is getting much better in general with features like secure boot—if they’re used. Attackers will likely continue to exploit holes or attack targets such as the BMC that bypass normal security measures. It simply means that security needs to be applied to all aspects of system design, deployment, and even during the building of a system.
| IP: Logged
|
|
Harold Hallikainen
Jedi Master Film Handler
Posts: 906
From: Denver, CO, USA
Registered: Aug 2009
|
posted 10-23-2018 11:46 AM
https://www.reuters.com/article/us-china-cyber-super-micro-comp/super-micro-to-review-hardware-for-malicious-chips-idUSKCN1MW1GK
Super Micro to review hardware for malicious chips
Sonam Rai
(Reuters) - Computer hardware maker Super Micro Computer Inc said on Monday it would review its motherboards for any proof of malicious chips as alleged in a recent media report.
“Despite the lack of any proof that a malicious hardware chip exists, we are undertaking a complicated and time-consuming review to further address the article,” the server and storage manufacturer said in a letter to its customers, dated Oct. 18.
Shares of the San Jose, California-based company rose 4.3 percent to $14.70 on Monday.
A Bloomberg report on Oct. 4 cited 17 unidentified sources from intelligence agencies and businesses that claimed Chinese spies had placed computer chips inside equipment used by about 30 companies, including Apple Inc and Amazon.com Inc and multiple U.S. government agencies, which would give Beijing secret access to internal networks.
Super Micro denied the allegations made in the report.
The company said the design complexity makes it practically impossible to insert a functional, unauthorized component onto a motherboard without it being caught by the checks in its manufacturing and assembly process.
It is entirely plausible that a malicious chip can be placed on a motherboard but it will be at a very high cost, and the risk of detection increases with every such chip in the field, said Jake Williams, a former National Security Agency analyst and founder of the cyber security firm Rendition Infosec.
“This technique would only be used for high value targets that couldn’t be easily compromised via another attack vector,” Williams said.
The Bloomberg report also said Apple in 2015 had found malicious chips on Super Micro motherboards and added that Amazon uncovered such chips the same year while examining servers made by Elemental Technologies, which Amazon eventually acquired.
Both Apple and Amazon have denied the allegations. Apple Chief Executive Officer Tim Cook told online news website BuzzFeed on Friday that Bloomberg should retract the story.
Amazon Web Services CEO Andy Jassy also joined Cook in asking Bloomberg to retract the report.
“Bloomberg story is wrong about Amazon, too ... Reporters got played or took liberties. Bloomberg should retract,” Jassy said in a tweet on Monday.
Bloomberg had previously said it stood by its report and was confident of its reporting, which was conducted for more than a year.
Security experts as well as the U.S. and U.K. authorities have said they had no knowledge of the attacks.
Reporting by Sonam Rai in Bengaluru; Editing by Arun Koyyur and Anil D'Silva
| IP: Logged
|
|
|
|
All times are Central (GMT -6:00)
|
This topic comprises 2 pages: 1 2
|
Powered by Infopop Corporation
UBB.classicTM
6.3.1.2
The Film-Tech Forums are designed for various members related to the cinema industry to express their opinions, viewpoints and testimonials on various products, services and events based upon speculation, personal knowledge and factual information through use, therefore all views represented here allow no liability upon the publishers of this web site and the owners of said views assume no liability for any ill will resulting from these postings. The posts made here are for educational as well as entertainment purposes and as such anyone viewing this portion of the website must accept these views as statements of the author of that opinion
and agrees to release the authors from any and all liability.
|
Home
Printer-friendly view of this topic