Hacker News Reader

Comment by jlgaddis | Hacker News Reader

The BMCs on the newest Supermicro servers are from ASPEED. The X10 models have the AST2400 [0] and the X11 models have the AST2500 [1]. They have ARM CPUs and run, basically, an embedded Linux.

If you wanted to "backdoor" motherboards that shipped with these BMCs, wouldn't it would be much easier to just install your own "customized" version of the firmware on them? It certainly seems that it'd be much more difficult to incorporate another device into the system.

[0]: https://www.aspeedtech.com/products.php?fPath=20&rId=376

[1]: https://www.aspeedtech.com/products.php?fPath=20&rId=440

View on HN

If I'm right, that's exactly what they did. When the BMC chip boots, it checks two flash chips for firmware so the attacker just uploaded their own code to one of a million standard SPI flash chips and plopped it onto the board. They didn't have to incorporate another device into the system, the system was already designed for two flash memory chips. However, to save money on some SKUs, the manufacturer left one of the positions on the board open.

Normally this wouldn't be worth talking about because most active chips are too complicated and too design/supplier specific to carry out an attack like this, but SPI flash is about as standard a footprint/protocol as you can get in EE short of transistors so if you ship a product that could be reprogrammed from unpopulated pads, you're opening yourself up to a large attack surface.

Honestly, after I read the latest BMC chip theory I was like: "Oh, shit. Have I done that?"

If possible, it is better to have separate hardware that can continuously compromise the firmware. That way your exploit continues to exist even if valid firmware is flashed directly onto the memory module.

well companies like Apple and Amazon are reflashing/updating, so that wouldn't stick.

because all it takes for it to be discovered is someone checking the SPI flash contents

Reply on news.ycombinator.com