Hacker News Reader

Comment by setquk | Hacker News Reader

Nothing adds up here. Supermicro boards have "designed in the USA" proudly stamped all over them. This means that either:

(a) the design process was infiltrated, which would have been done US side thus the nationality of the actors is debatable.

(b) the manufacturing process was infiltrated, which SHOULD have been picked up during design validation and production sampling.

Lots of questions here. This is not a tinfoil hat measure as well; genuine questions from someone who HAS worked in the EE side of things.

I wonder if this is a bunch of pre-emptive finger pointing and ass covering for an implant closer to home?

I don't trust either side of the fence if I'm honest.

View on HN

I think the article is implying that the implanted chips might not have been detected due to their low profile design. Given that the bad manufacturers were subcontractors it's likely only a fraction of all the boards manufactured were compromised. It's either that or someone at Supermicro was in on it.

See my comment here: https://news.ycombinator.com/item?id=18139739

I don't find that method feasible.

Infiltration of supermicro IS but then you have to ask the question: who really did it as they are on US soil.

The article alleges (b), and give indications of why it wouldn't necessarily be picked up:

> In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. That generation of chips was smaller than a sharpened pencil tip, the person says. (Amazon denies that AWS knew of servers found in China containing malicious chips.)

There's plenty of precedent for missing things hidden away in stuff: https://en.wikipedia.org/wiki/The_Thing_(listening_device)

That is possible but unlikely. Firstly you'd have to do this at the PCB fab phase as this can't be retrospectively applied, so you'd have to have infiltrated two times as many companies and add complex manufacturing exceptions to their workflow. Secondly you'd have to get it through AXI process which is used on these larger boards (Automated X-ray Inspection) which is used by the larger companies for manufacturing AND design validation. So you'd have to infiltrate another company.

Also stuff like this tends to show up on boundary scans. It's not that easy to cock around with signal integrity on these sorts of boards and get away with it.

I find the whole thing infeasible from a cost and logic perspective. The SMbus firmware and Aspeed sub-vendor are so much easier to hit and don't leave any corpses around to find after the fact.

I'm not sure "infiltrated" is the right word when discussing a state-level actor in a totalitarian country.

That's fair.

I'll accept that it may seem infeasible. But so did something like Stuxnet [1] seem infeasible, until it was discovered.

Perhaps the lesson is not to underestimate the resources of a determined nation state with an economy the size of the USA's (or China's).

[1] https://en.wikipedia.org/wiki/Stuxnet

They're designed in the USA, but manufactured overseas (although in some cases the components are assembled in the US).

Yeah I did say that. I covered both vectors.

Reply on news.ycombinator.com