Hacker News Reader

Comment by akiselev | Hacker News Reader

The actual details on the hardware are also sketchy. Based on my reading of the article, this wasn't a chip swap where one chip is replaced by a backdoored version. The article implies that this was an extra chip so either dozens (possibly hundreds) of engineers were in on the operation from the beginning to slip the chip into the design undetected or the chip was mounted without any changes to the board design. The former is much riskier than backdooring the chips and the latter, as far as I know, has not been done before with a nontrivial chip.

Fitting any chip capable of exfiltrating a nontrivial amount of data onto a modern motherboard without going through many rounds of simulation or significantly impacting performance, while also putting it in a place it is capable of intercepting valuable data is practically impossible. Hell, just getting the right power domains wired to the chip is going to be tough enough.

View on HN

The most plausible theory I have seen so far it that this chip was embedded in the pcb below an empty pad for the backup flash that loads the management system firmware. Three reasons this would work well: 1. The pad looks empty on casual inspection. 2. The data and power traces are already routed to that spot 3. The management system is already set up to load from this flash if it is populated.

That's sounds like the best theory I've heard so far but I'm still skeptical. I've only worked with simple embedded PCB components like resistors or an inductor substrate, but in my experience if there are high speed signals anywhere near the passive, the design has to account for it from the beginning. There's a few clever ways to monkey patch unpackaged silicon into an existing board but AFAIK they all require access to some precise equipment to create a space for the wafer and wire bond it without causing some obvious physical modifications.

Edit: Based on other posts in this topic, it appears that the chip wasn't embedded in the PCB - it was just placed on top of an empty footprint for recovery flash. If that's the case, then this hack is technologically uninteresting.

It looks to be in this position (on an empty pad) in the first two frames of the animated graphic on the article's page, too.

Placing it on a low speed SPI read/write trace to the flash chip containing the BMC firmware is entirely plausible, and in no way would require "dozens (possibly hundreds) of engineers."

EDIT: https://news.ycombinator.com/item?id=18138638

It's entirely plausible as long as no one is inspecting the final product. The hard part isn't connecting the traces, it's doing so without immediately arousing suspicion when a tech open the server and sees a ghetto engineered chip hanging off the PCB at a weird angle.

I hadn't read the detail about the second flash chip. Obviously, if they're just putting compromised flash into a footprint left empty by the manufacturer on purpose for recovery, it's much easier, cleaner, and can be done with a small group.

How does the bogus chip exfiltrate data out of the system, wouldn't the alarms go off at the network level?

Most network level firewalls don't block/inspect outbound packets at this level, and even if they did they could just tunnel (e.g. ssh) through an open port. I think I also read that there was no actual sign of data exfiltration - they were just sending "keep alives" to the C&C hosts.

This was my question also. Typically you do not allow servers Internet access and even where you do it is via an authenticated proxy to an approved set of URLs. If there was traffic to a C&C this would be come fairly obvious especially in a spray and prey type attack like this where it is hard to control where the infected servers go it is surprising that there is no evidence presented of this being detected. Your servers or endpoints contacting unusual internet addresses and especially setting up tunnels is something any monitoring system would be looking for

But the packets would have a destination that's inspectable isn't it?

Reply on news.ycombinator.com