Hacker News Reader

Comment by erostrate | Hacker News Reader

They attacked the Base Management Controller. There's an article by Bruce Schneier from 2013 warning about exactly this attack. Quoting:

"Basically, it's a perfect spying platform. You can't control it. You can't patch it. It can completely control your computer's hardware and software. And its purpose is remote monitoring. At the very least, we need to be able to look into these devices and see what's running on them."

https://www.schneier.com/blog/archives/2013/01/the_eavesdrop...

View on HN

> You can't patch it.

Sure you can. OEMs regularly release patches for platform BMCs.

Not sure about you, but I'm not an "OEM".

Well, you cannot patch the vast majority of the software in your computer (assuming you are like the vast majority of users using proprietary crap for everything). That does not mean it is all unpatchable. If supermicro care, they could release a BMC update, for example.

> They attacked the Base Management Controller.

Do you know this, or are you speculating?

It's in the article:

"The illicit chips could do all this because they were connected to the baseboard management controller..."

Can you quote a single source from that article, or is it all anonymous?

That is also in the article...

"17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."

So not a single source. Might as well be going to war over invisible weapons of mass destruction. Also, Apple and Amazon both has said they do not agree with these claims. So far this is nothing more than propaganda.

so you prefer to believe official corporate statements saying they didn’t have security leaks, rather than a news agency with 17 independent sources confirming they had ??

That’s an interesting choice.

17 independent sources doesn't mean anything. Again, this is the same as the sources that said their were weapons of mass destruction in Iraq. Companies and government use propaganda all the time, so until you have more information confirming these claims, then it is best to hold off before trying to say that Apple and Amazon denying the claims str proof that they are real.

Are you saying Bloomberg made the sources up, or that they exist but are all lying, because they won't go on the record?

Def possible they are lying. There are a lot of companies competing with white box manufacturers. If you can't name a single source, and you have two major companies saying these claims aren't accurate... then maybe you should hold off before making judgments.

Reply on news.ycombinator.com