Hacker News Reader

Comment by stevemk14ebr | Hacker News Reader

I think this twitter thread is a very reasonable analysis of this article: https://twitter.com/pwnallthethings/status/13602327536236298.... I think critically there are a lot of claims here, and none of them provide _concrete_ proof of any form. There's a lot of 'senior official said X' and X number of people in the know declined to comment, but these are just appeals to authority/credentials. People are flawed and second hand rumours of rumours can easily bend the truth. I don't think it's necessarily fair to put out a story claiming this is 'the truth' when alot of the sourcing is indirect and 'declined to comment'. It's just not there with the facts! True or not, we can't know, but this report need more facts.

View on HN

> Alarmed by the devices’ sophistication, officials opted to warn a small number of potential targets in briefings that identified Supermicro by name. Executives from 10 companies and one large municipal utility told Bloomberg News that they’d received such warnings.

in my book that counts as "concrete proof."

Only if you believe that the warnings went out because of the "alarm over the devices' sophistication" and not "alarm over the idea this could happen" or even "alarm over a misidentification of a legitimate component and now we're too embarrassed to issue a retraction to those 10 CEOs"

Ok, but now you're making another argument with also zero evidence.

I think it's fair to say there are multiple circumstantial pieces of evidence that SuperMicro is inserting security vulnerabilities.

That should be enough to take the same decision that both the US gov't and Apple and others have made to avoid that manufacturer.

The article certainly quotes a wealth of sources - but all of them seem to be vague, third-hand stuff.

An unnamed "adviser" to security firms that analyzed Supermicro equipment. An executive for some unnamed company, who received a briefing. A venture capitalist who received a briefing. A retired FBI agent who was told there was an "additional little component" by someone he can't name. Some former FBI officials that refuse to name supermicro, and say only that supply chain attacks are possible. Fifty interviews with officials, all of whom asked not to be named.

So apparently this information is so public that everyone and their dog is happy confirm it - yet at the same time, so classified that the victims and the 50 sources can't be named?

That's pretty vague compared reports of hardware implants like credit card skimmers [1] which put pictures of the hardware front and centre and make it clear that the author has personally seen it and knows (basically) how it works.

[1] https://krebsonsecurity.com/all-about-skimmers/

first, I don't understand how this quote squares with your overall description -- it's specific, first-hand, from a named source, who should (on its face) know what he is talking about:

> “This was espionage on the board itself,” said Mukul Kumar, who said he received one such warning during an unclassified briefing in 2015 when he was the chief security officer for Altera Corp., a chip designer in San Jose. “There was a chip on the board that was not supposed to be there that was calling home—not to Supermicro but to China.”

second, the article presents a plausible scenario for why it would be difficult to get additional details: the U.S. govt's strategy for dealing with this was to let it play out, so they could learn more about the nature of the threat. any public disclosures about this are at odds with the strategy of the U.S. government in combating it.

it seems like a very realistic scenario to me that some of the details of what happened became "lost in translation" - but that there is a real underlying truth. the first article wasn't convincing to me, but this one is very difficult to dismiss.

> first, I don't understand how this quote squares with your overall description

A person who "received a warning in an unclassified briefing" isn't first-hand. At best it's second-hand, if whoever analysed the hardware implant was going out giving briefings in person. More likely it's third-hand.

> it seems like a very realistic scenario to me that some of the details of what happened became "lost in translation"

If the claim was an evil driver update, or a backdoored BIOS, that would be completely believable.

Indeed, most of the details of this attack could just be a miscommunication about a BIOS backdoor - supply chain attack, malicious, code that shouldn't have been there, stored in an eeprom on the motherboard, undetectable by visual inspection.

But the much more astonishing claim of a malicious hardware implant between layers of a PCB? Something that surprising needs the testimony of an electronics expert, not a cop or a C-suite officer. Especially after the purported victims from the first article denied knowing anything about it.

"first hand" as in, 'the govt told me that china bugged supermicro motherboards,' as opposed to, 'I was told the govt briefed tech companies about how china bugged supermicro motherboards.' honestly, describing the testimony I quoted as "third hand", simply because the person doing the briefing for the govt was not the same person to have discovered the breach, is completely ridiculous.

do you agree the article establishes that the U.S. govt repeatedly warned private sector companies that supermicro servers had been bugged by china? maybe the us govt was wrong about that! could be! but it's still a huge story and much more than what was established by the first bloomberg article.

> do you agree the article establishes that the U.S. govt repeatedly warned private sector companies that supermicro servers had been bugged by china?

I agree the article establishes that unnamed sources in government are giving out briefings.

But I don't think that was ever in doubt.

Even when the first article was written, I could easily believe the journalist's claim they were told what they wrote by some sketchy anonymous government source. I just think they didn't demonstrate the truth of their source's claim.

There's always some anonymous "senior government official" ready to tell a journalist that Iraq has weapons of mass destruction (but they can't show the evidence as it's classified) or whatever other narrative they're pushing at the time. It's a journalist's responsibility to apply due skepticism.

> some sketchy anonymous government source

for whatever reason, you are refusing to grapple with the fact that the second, just-released article, does not rely on the testimony of anonymous government sources, "sketchy" or otherwise, but on multiple, named, private sector sources. the people who are quoted have reputations that are important to them. they are claiming to have participated in concrete events. it's a very different category of testimony than "government sources say."

> the second, just-released article, does not rely on the testimony of anonymous government sources

The first article relied on briefings from unnamed government sources.

The second article has named private sector sources who say "an unnamed government source briefed me too"

That's just anonymous government sources, but with extra steps.

the difference is, the motivation for the two kinds of communication are completely different. anonymous govt sources talking to the media want the info to be public. govt officials telling a limited circle of people involved in core infrastructure generally do not want the info to be public. if you are trying to broadcast info to the public, your message is much more suspect, because the likelihood of an intent to deceive is higher. if you wanted the message to get out, there are far easier ways that telling a small circle of private sector people. generally govt isn't going around telling dams, nuclear power plants and drinking water plants about bogus chinese hacking threats on purpose. they can easily be wrong. it's a lot less likely they are lying about something like this.

This is `usually how national security problems are reported on, due to the classified nature of the work. You don't have to believe it, but it's naive to think that you're going to see actual chips. Currents and formers can talk about the what, but not the how. I mean even China knows the "what". Methods and means are a big deal, PRB kills entire chapters because of it.

Reply on news.ycombinator.com