Bloomberg: China broke into US companies by adding chip on server motherboards

by Hilbert Hagedoorn on: 10/04/2018 02:15 PM | source: bloomberg | 49 comment(s)

Likely the story of the day. Bloomberg posted an extensive article where they claim that the Chinese government tried to infiltrate into US companies by adding chips on server motherboards.

First, off this, the companies involved and the Chinese government is denying the story, but it seems well investigated, and if true the implications would be enormous as server/mobo provider SuperMicro is involved. And adding a chip into a PCB, is not something you do without corporation of the server motherboard manufacturer.

So the story is that basically some core logic was added onto the motherboards, chips the sized as a single grain of rice that had it's own IO, a networking interface and even a micro CPU. The discovery was made at Amazon who researched Elemental Technologies, a maker of software for servers that the American company Super Micro Computer, or Supermicro, uses. During that investigation, Amazon stumbled on the extra chip on the motherboard. Initially sized slightly smaller than a fingernail and later on an even smaller version. This chip would be able to contact servers over the web and receive instructions, and it's claimed it would be able to modify the server software, a backdoor.

The stories get weird here; Apple and Amazon are denying any existence of the chip. "Apple has never found malicious chips, hardware manipulations or vulnerabilities that have been deliberately placed on a server, Apple has never had contact with the FBI or any other service about such an incident," Apple says it has 2000 servers from Supermicro, but denies that it has found the chips. Amazon says in its denial that it found four problems with the purchase of Elemental, a takeover that took place in 2015. None of those were in the hardware.

Have a read here, at bloomberg.

4 pages 1 2 3 4

Typhoon2097
Junior Member

Posts: 3
Joined: 2018-09-29

#5592134 Posted on: 10/04/2018 02:34 PM

Riiiiight... It's not the russians this time, now it's the chinese again... And coincidentally this is published in the middle of US-China trade war

poornaprakash
Member

Posts: 80
Joined: 2008-06-25

#5592139 Posted on: 10/04/2018 02:37 PM

If we see things as a whole China now exactly behaving like the old US were. Karma retaliation :p

Brasky
Member

Posts: 2105
Joined: 2011-05-19

#5592140 Posted on: 10/04/2018 02:37 PM

5$ says typhoon is a bot. any takers?

msotirov
Member

Posts: 29
Joined: 2017-08-28

#5592141 Posted on: 10/04/2018 02:38 PM

But a better questing, how does the chip work without drivers? What about OS support?
Or is the chip so simple (dumb) that it doesn't need anything from the OS and just passes info gathered form the onboard nic or hdd controllers to where ever?
The same way your Intel or AMD CPU works without drivers. The driver is embedded in the chip itself and is called "firmware".

By the way, you realize that Intel ME is essentially the same thing like this new supposedly Chinese spy chip. Intel ME has it's own mini-OS running separate from everything else on your PC, complete with network access to top it off.

Typhoon2097
Junior Member

Posts: 3
Joined: 2018-09-29

#5592144 Posted on: 10/04/2018 02:41 PM

5$ says typhoon is a bot. any takers?

I'll take that 5 bucks anytime

Valken
Senior Member

Posts: 1439
Joined: 2011-01-05

#5592146 Posted on: 10/04/2018 02:47 PM

oh noes... them pesky Russians, err... Chinese are SPYING AGAIN!!!

"The stories get weird here; Apple and Amazon are

denying any existence of the chip.

"Apple has
never
found malicious chips, hardware manipulations or vulnerabilities that have been deliberately placed on a server, Apple has never had contact with the FBI or any other service about such an incident,"

Apple

says it has 2000 servers from Supermicro, but

denies that it has found the chips

. Amazon says in its denial that it found four problems with the purchase of Elemental, a takeover that took place in 2015. None of those were in the hardware."

But of course, you can't believe any of those Commie Tech companies like Apple or Amazon... Still waiting for Trump to drain that swamp...

gx-x
Senior Member

Posts: 1192
Joined: 2007-03-18

#5592150 Posted on: 10/04/2018 02:52 PM

Bloomberg is fake news.

vbetts
Moderator

Posts: 14211
Joined: 2006-07-04

#5592152 Posted on: 10/04/2018 02:53 PM

I just want to say something real quick, let's not make this into a political debate. I already got enough of that going around with all the freaking political ads everywhere!

schmidtbag
Senior Member

Posts: 3722
Joined: 2012-11-10

#5592154 Posted on: 10/04/2018 03:03 PM

And this is why I get my servers and parts from small US company's. Its nice to have parts in your PC that say made in USA or Germany, UK and not china, Taiwan or something. But my wallet hates me for it :p

As an American, I can't say US-based companies are a whole lot more trustworthy than Chinese or Russian. But... I also don't really care if a government (domestic or foreign) is spying on me, so despite this news, I'll still gladly buy Chinese (or American) parts. All I care about is price and performance.

Anyway, a simple fix. take the chip off the board?
But a better questing, how does the chip work without drivers? What about OS support?
Or is the chip so simple (dumb) that it doesn't need anything from the OS and just passes info gathered form the onboard nic or hdd controllers to where ever?

I was also thinking of just simply removing the chip. Or, take a screwdriver and a hammer and just give it a little tap to crush it. Surely, the chip is not crucial to the functionality of the board, so might as well ignore it.
As for the driver thing, there are plenty of hardware features that work without drivers. Drivers are nothing more than just basic code that allows the OS to have control/access over hardware. There is nothing preventing hardware from performing logic functions without the OS being aware of it. Take keyloggers for example, or the potential malware that takes advantage of Spectre and Meltdown.
That being said, I wouldn't be surprised if the chip sits somewhere between the storage controller, the chipset, and the NIC. It probably just listens in on the data and encodes it to be sent over the NIC. I'm sure it's completely isolated and undetectable by the rest of the system.

Denial
Senior Member

Posts: 11944
Joined: 2004-05-16

#5592161 Posted on: 10/04/2018 03:17 PM

^this.
I don't see why it would need to get political. This is more of issue of security more then anything.

I'd like to see how the server OS maintainers and how supermicro deal with this. Its not like you can always drop everything and get a new server right away.

It would get political because all the companies that Bloomberg said this happening to are outright denying the story. Typically if they want to keep shut they'll use boilerplate "No comment" but they are literally saying this didn't happen and it's entirely fabricated news story. Bloomberg itself posted a counter article summarizing it.

https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond

So what exactly is going on here? Seems extremely weird for them to deny it like this because any indication of a real attack would open them to a massive legal liability after a denial like that.

tunejunky
Senior Member

Posts: 800
Joined: 2017-08-18

#5592167 Posted on: 10/04/2018 03:30 PM

and i thought I was cynical...lol

anyhow, Denial is on point about the liability issues.

Amazon Cloud Services and Apple Cloud...
that's a lot of liability right there without bringing in government contracts.

SuperMicro, wow, i had such a high opinion of them.

one of the reasons (other than cheap labor and a huge market) tech companies produce in China is political stability. this is a gut punch to every American tech company with eyes on the fat wallets of the Pentagon.

nhlkoho
Senior Member

Posts: 7573
Joined: 2005-12-06

#5592177 Posted on: 10/04/2018 03:47 PM

It would get political because all the companies that Bloomberg said this happening to are outright denying the story. Typically if they want to keep shut they'll use boilerplate "No comment" but they are literally saying this didn't happen and it's entirely fabricated news story. Bloomberg itself posted a counter article summarizing it.

There isn't exactly any penalty to publicly lie about stories like this anymore. I can't even count how many times a story came out in the past year (politically motivated or not) that was denied and then turned out to be true in the end.

Denial
Senior Member

Posts: 11944
Joined: 2004-05-16

#5592189 Posted on: 10/04/2018 04:08 PM

There isn't exactly any penalty to publicly lie about stories like this anymore. I can't even count how many times a story came out in the past year (politically motivated or not) that was denied and then turned out to be true in the end.

You're right and it's definitely getting significantly more difficult to judge the accuracy of stories due to the increasing level of dishonesty across the board. Is Bloomberg outright fabricating this story? Are the six current/former white house officials lying? Are the companies lying that this didn't happen? I don't know - which is why I find this story so strange. Bloomberg is a fairly trusted news publication, it's rated typically as center/left center - most of the "conspiracy this is fake news" posts I see about this story are implying that it's a White House hit job on China designed to "promote" the ongoing trade dispute, in fact someone mentioned that here. I don't know why a slightly left leaning site (at worst) would fabricate or agree to fabricate a story about this. I'm also positive that if they didn't fabricate the story, they did some due diligence and vetted the sources - there is six of them from the white house and several "apple insiders" they are using as sources. That's like a fair number of sources - which would lead me to believe that there is some level of truth to the story. But even the company's responses are outright puzzling to me. In terms of PR you almost never outright deny a story like this - whether the story is true or false - it's just not worth the legal risk. Yet, despite the ongoing facebook saga, complete with multi-billion dollar fines due to them covering their hack up, all of these companies choose to outright deny this story.

I'm not really taking a side or saying who is lying or not but it's just extremely weird to me. None of the "conspiracyesque" narratives I've seen thus far really fit what's going on here.

Fox2232
Senior Member

Posts: 8506
Joined: 2012-07-20

#5592196 Posted on: 10/04/2018 04:19 PM

Bloomberg being hacked with fake article? Or is that real article?
In-Q-tel? Good name for company... intel "Q"estion/ery/...

Secondly, I really want to see real photo of those microchips and to what components they were connected.
There are very few specific places where some chip can affect anything.

No way to affect code being executed in CPU, that's simply not possible as chip would have to intercept, analyze and change data going from memory/storage in real time.
(crazy computational capacity required, a lot of traces overriden, And a lot of hacking-chip-on-board-storage required to actually have reference on what to intercept.)

Maybe possible to send fake read and writes to storage controller, but again very complicated for anything this small without a lot of onboard memory and traces.

Most feasible way would be this having access to BIOS chip, simply parsing and altering/inserting modules. So basically rootkit deploy chip.
- reason here would be to survive BIOS update

But then following description is way too incorrect:
"⑤ When a server was installed and switched on, the microchip altered the operating system’s core so it could accept modifications. The chip could also contact computers controlled by the attackers in search of further instructions and code."

= = = =
And then there is that F*ing Big Important thing:
IIRC, US made some legislation changes which classify foreign cyber-attack as Act of War. I have no clue if it went through and under which conditions it should have apply. US guys will probably know.

HeavyHemi
Senior Member

Posts: 6021
Joined: 2008-10-27

#5592200 Posted on: 10/04/2018 04:22 PM

All that is missing is one PHYSICAL example of this. I find it impossible to believe that these are installed all over the planet yet nobody can find one? That not one single person in years has come forward and said 'hey look at this'. This story fails my basic sniff test for that basic reason.

4 pages 1 2 3 4

Post New Comment

Click here to post a comment for this news story on the message forum.