<story><title>Bloomberg’s ‘The Big Hack’</title><url>https://daringfireball.net/2018/10/bloomberg_the_big_hack</url></story><parent_chain><item><author>lacker</author><text>It does not seem like this story is true. If it&amp;#x27;s true, it makes absolutely no sense for Apple and Amazon to attack Bloomberg. Sure, a national security letter could force them to stay quiet, or maybe even to lie to the public and say it didn&amp;#x27;t happen, but it can&amp;#x27;t make them criticize Bloomberg. Attacking Bloomberg if the story is true is only going to convince Bloomberg to dig deeper. And the story isn&amp;#x27;t even &lt;i&gt;that&lt;/i&gt; bad for Amazon or Apple - it&amp;#x27;s much worse for US-China relations than it is for either of those companies.&lt;p&gt;The key technical detail of what these chips are allegedly doing also does not make sense. From the article:&lt;p&gt;&lt;i&gt;the chips allowed the attackers to create a stealth doorway into any network that included the altered machines&lt;/i&gt;&lt;p&gt;How can you get around a firewall by using a compromised machine that&amp;#x27;s part of the internal network?&lt;p&gt;I don&amp;#x27;t think Bloomberg reporters are just making stuff up. But the technical confusion here makes me suspect that the government officials who leaked this story just didn&amp;#x27;t understand the details of a real incident that happened, and in the leaking the story got mangled into inaccuracy.</text></item></parent_chain><comment><author>akiselev</author><text>The actual details on the hardware are also sketchy. Based on my reading of the article, this wasn&amp;#x27;t a chip swap where one chip is replaced by a backdoored version. The article implies that this was an extra chip so either dozens (possibly hundreds) of engineers were in on the operation from the beginning to slip the chip into the design undetected or the chip was mounted &lt;i&gt;without any changes to the board design.&lt;/i&gt; The former is much riskier than backdooring the chips and the latter, as far as I know, has not been done before with a nontrivial chip.&lt;p&gt;Fitting any chip capable of exfiltrating a nontrivial amount of data onto a modern motherboard without going through many rounds of simulation or significantly impacting performance, while also putting it in a place it is capable of intercepting valuable data is practically impossible. Hell, just getting the right power domains wired to the chip is going to be tough enough.</text></comment>
<story><title>Bloomberg’s ‘The Big Hack’</title><url>https://daringfireball.net/2018/10/bloomberg_the_big_hack</url></story><parent_chain><item><author>lacker</author><text>It does not seem like this story is true. If it&amp;#x27;s true, it makes absolutely no sense for Apple and Amazon to attack Bloomberg. Sure, a national security letter could force them to stay quiet, or maybe even to lie to the public and say it didn&amp;#x27;t happen, but it can&amp;#x27;t make them criticize Bloomberg. Attacking Bloomberg if the story is true is only going to convince Bloomberg to dig deeper. And the story isn&amp;#x27;t even &lt;i&gt;that&lt;/i&gt; bad for Amazon or Apple - it&amp;#x27;s much worse for US-China relations than it is for either of those companies.&lt;p&gt;The key technical detail of what these chips are allegedly doing also does not make sense. From the article:&lt;p&gt;&lt;i&gt;the chips allowed the attackers to create a stealth doorway into any network that included the altered machines&lt;/i&gt;&lt;p&gt;How can you get around a firewall by using a compromised machine that&amp;#x27;s part of the internal network?&lt;p&gt;I don&amp;#x27;t think Bloomberg reporters are just making stuff up. But the technical confusion here makes me suspect that the government officials who leaked this story just didn&amp;#x27;t understand the details of a real incident that happened, and in the leaking the story got mangled into inaccuracy.</text></item></parent_chain><comment><author>parliament32</author><text>It depends. These chips were specifically connected to the BMC&amp;#x2F;IPMI:&lt;p&gt;&amp;gt;The illicit chips could do all this because they were connected to the baseboard management controller, a kind of superchip that administrators use to remotely log in to problematic servers, giving them access to the most sensitive code even on machines that have crashed or are turned off.&lt;p&gt;Is your OOB-management VLAN&amp;#x2F;network firewalled off from outgoing access to the internet? If not, this chip can make requests out to another host, who gives it code to run. This code can then either collect data and send it back out, or do other nefarious things.</text></comment>