35C3 - Modchips of the State

What people said

shasheene · 2019-06 · Recommendation

You may not be aware of the great talk titled "Modchips of the State" [1] (presented at 35C3 in Dec 2018). The speaker managed to reproduce the exact single-chip hardware implant attack suggested in the Oct 2018 Bloomberg Businessweek story [2] [3], which claimed Amazon and Apple found malicious hardware implants in Supermicro motherboards while conducting detailed inspections. While Bloomberg has never retracted the story, there's an argument that the sources have vested interests in lying to Bloomberg suggesting that attacks developed in lab-conditions actually occurred in the real-world, in order to raise awareness of supply-chain risks (something the current US administration has been attempting to do for some time). There's also a suggestion that the journalist was acting in good-faith but mixed up a few different attacks, with the sources reluctant to clarify things. Another suggestion is that the attack did happen, and Amazon and Apple were forced to issue denials. It's a very fascinating story. Maybe I'm naive, but if Bloomberg was in-fact wrong, they would issue a correction or a retraction. The fact they haven't retracted it suggests to me that there's truth to the story. [1] [VIDEO] [2] [LINK] [3] [LINK]

Read the original HN comment ↗

wahern · 2019-10 · Reference

Several months after the story was published someone actually presented a proof of concept demonstrating the practical feasibility of the claimed hack[1]. See presentation at [LINK] ( [VIDEO] ), and project website at [LINK] There's irony in how people repeat and share the technical rebuttals long after those rebuttals have been conclusively rebutted themselves. That in no way absolves Bloomberg, but the indignation of their critics is tiresome. [1] Of course the specific details of the claimed hack were never reported, but the proof-of-concept fits the claims, and in any event is more than sufficient to rebut the rebuttals.

Read the original HN comment ↗

wahern · 2019-03 · Reference

If you look at the Huawei controversy the intelligence community appears utterly convinced that these hacks are occurring. But the current trade war with China makes one wonder whether the threats are exaggerated or outright fabricated. OTOH, the negotiations also mean the U.S. has an interest in not disclosing details of actual incidents, to help China save face and also to preserve U.S. domestic markets as gambling chips--i.e. if it disclosed serious and pervasive attacks then nobody would buy Huawei, so China would have less of an interest in making concessions so sellers like Huawei can grow in the U.S. market. (Similarly, SuperMicro, Apple, and Amazon are American companies so U.S. officials have an interest in limiting the fallout to any actual attacks as long as the immediate threats are removed, which doesn't necessarily require the knowing cooperation of those companies.) The last public statement from Bloomberg was that they were going to perform an in-house review. I'm just going to wait things out. That said, the evidence for the viability and practicality of the alleged attacks has only grown. The alleged technique has already been demonstrated. See [VIDEO] Nobody seriously doubts that China is motivated to perform such hacks, and we know that the NSA has performed similarly complex hacks (the cost+benefit calculus isn't always intuitive to outsiders). So whether it has or has not happened is really only consequential for the credibility of Bloomberg.

Read the original HN comment ↗