David Kanter (dkanter.delete@this.realworldtech.com) on October 4, 2018 8:23 am wrote:
> Bloomberg released a fantastic report on Chinese intelligence inserting malicious
> HW into supply chains for servers: https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies?srnd=premium
>
> It sure gives a different angle to the move to a hardware root-of-trust by the industry. In reality though,
> I'm not sure if HW RoT is sufficient. You can always sniff capacitance across an exposed wire!
>
> David

A couple of notes from my read through of the article:

SuperMicro's engineers themselves are not taking part in this. Only the manufacturing wing seems to be compromised. This will certainly have ramifications within the company.

The server compromise with Apple seems to have happened based upon luck rather than explicit targeting. However, Apple's cloak of secrecy seemingly prevented the reverse engineering of these chips when they were discovered. Also Apple has a robust enough internal security team to actually catch this kind of compromise which is something that could easily be overlooked.

The pictured chip only has six pins which my novice guess would some sort of SPI module. This would explain how they were able to interface with various other components on motherboards and sneak the chip into so many designs: often the traces for SPI ports remain after debugging is complete but the headers are no populated once a board reaches production. What stands out here is that it seemingly communicated with system management as a means of by passing OS level restrictions. This also has me wondering if this some how ties into various Intel AMT/Management Engine exploits that were made public a bit over a year ago. Or this could be something new as well.

The line about embedding some of these chips into the layers of the motherboard seems a bit improbable. It would only make sense if the existing manufacturing lines supported this but my impression of the market is that such manufacturing is only used in mobile applications where space is at a very high premium. Various network and server hardware doesn't use that level of board level integration to my knowledge (though I will admit if it is used, slipping in a chip between PCB layers is indeed a very clever means of hiding a chip). The intent here doesn't seem to be aimed at mobile either as it is very arbitrary who would get a particular phone and there are fewer interfaces to leverage against mobile hardware. With phones coming from so many suppliers outside of Chinese influence, it doesn't seem that it'd be useful as a wide spread attack vector (ie shutting down mobile infrastructure).