Bloomberg has a fascinating report on how China used a tiny chip to infiltrate U.S. companies. The attack by Chinese spies reached almost 30 U.S. companies, including Amazon and Apple, by compromising America’s technology supply chain, according to extensive interviews with government and corporate sources.
Please consider The Big Hack.
In 2015, Amazon.com Inc. began quietly evaluating a startup called Elemental Technologies, a potential acquisition to help with a major expansion of its streaming video service, known today as Amazon Prime Video. Based in Portland, Ore., Elemental made software for compressing massive video files and formatting them for different devices. Its technology had helped stream the Olympic Games online, communicate with the International Space Station, and funnel drone footage to the Central Intelligence Agency. Elemental’s national security contracts weren’t the main reason for the proposed acquisition, but they fit nicely with Amazon’s government businesses, such as the highly secure cloud that Amazon Web Services (AWS) was building for the CIA.
In late spring of 2015, Elemental’s staff boxed up several servers and sent them to Ontario, Canada, for the third-party security company to test, the person says.
Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design. Amazon reported the discovery to U.S. authorities, sending a shudder through the intelligence community. Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships.
The chips on Elemental servers were designed to be as inconspicuous as possible, according to one person who saw a detailed report prepared for Amazon by its third-party security contractor, as well as a second person who saw digital photos and X-ray images of the chips incorporated into a later report prepared by Amazon’s security team. Gray or off-white in color, they looked more like signal conditioning couplers, another common motherboard component, than microchips, and so they were unlikely to be detectable without specialized equipment.
This system could let the attackers alter how the device functioned, line by line, however they wanted, leaving no one the wiser. To understand the power that would give them, take this hypothetical example: Somewhere in the Linux operating system, which runs in many servers, is code that authorizes a user by verifying a typed password against a stored encrypted one. An implanted chip can alter part of that code so the server won’t check for a password—and presto! A secure machine is open to any and all users. A chip can also steal encryption keys for secure communications, block security updates that would neutralize the attack, and open up new pathways to the internet.
Tiny Chips Disguised as Couplers
Big Hack
Satan’s Bargain
Over the decades, the security of the supply chain became an article of faith despite repeated warnings by Western officials. A belief formed that China was unlikely to jeopardize its position as workshop to the world by letting its spies meddle in its factories. That left the decision about where to build commercial systems resting largely on where capacity was greatest and cheapest.
“You end up with a classic Satan’s bargain,” one former U.S. official says. “You can have less supply than you want and guarantee it’s secure, or you can have the supply you need, but there will be risk. Every organization has accepted the second proposition.”
Bloomberg notes there was a small, invite-only meeting in McLean, Va., organized by the Pentagon to discuss these attacks. “Attendees weren’t told the name of the hardware maker involved, but it was clear to at least some in the room that it was Supermicro.”
No Commercially Viable Way to Detect Attacks
In the three years since the briefing in McLean, no commercially viable way to detect attacks like the one on Supermicro’s motherboards has emerged—or has looked likely to emerge. Few companies have the resources of Apple and Amazon, and it took some luck even for them to spot the problem. “This stuff is at the cutting edge of the cutting edge, and there is no easy technological solution,” one of the people present in McLean says. “You have to invest in things that the world wants. You cannot invest in things that the world is not ready to accept yet.”
The report is fascinating as well as scary. 30 US corporations were hit.
Hardware chips can do virtually anything. These tiny chips communicated to external servers and received instructions back from them.
The report did not say what information was stolen. Likely, no one even knows.
Mike “Mish” Shedlock
This proves that the outsourcing mad rush was fueled by…greed…surprise..
Why not buy chinese jets, with a free..built in kill switch…
(just like the f35, the Usa sells to all its allies….
Funny, that now they refuse to sell the defect/useless f35 to Turkey…
witch is a blessing in disguise
and Trump claimed that STEEL was a national security issue…
basically just about every thing is…over 2$
Pathological trust: getting “mission critical” components from an adversary. This is globalism in a nutshell….stupid is as stupid does.
I’d be pretty sure that this is just the tip of the iceberg. If you have a router, smart tv, or anything connected to the internet with Chinese chips in it there there might be a Trojan. They might snoop, might self destruct on command. No one knows how many such things there are
Further, there is the domestic problem, both public and private. Do you have an Echo Dot, or smart TV with a microphone, fitbit…..??? all of this crap talks back to servers at the manufacturer’s data centers. These things with microphones listen 24/7. There is no problem to make them record every word that is said and send it back time-stamped to the mother ship. Do they? There is no way to tell. 10000 words can be compressed into a 20k file, encrypted and sent as “maintenance packets.” Then there is the public threat. The government agencies are required to snoop us to prevent terrorism. And they do.
The less of this stuff you have in your house the better. As for the larger threat to our infrastructure, I can’t imagine. I know for sure that I won’t buy a networked autonomous vehicle. Imagine 40,000,000 cars accelerating then making a hard left at 8:30 some workday. This stuff is terrifying.
An Occam’s razor solution after noodling overnight on this: First, Super Micro is a corporate dead-man-walking. Every advanced manufacturing team on their customer list is likely scrambling to re-source elsewhere today and the sanity of any design team member proposing to source from Super Micro is instantly in question because of the cloud now over this vendor.
Next, what is the likelihood this could have been happening for years without discovery? Nil, there’s simply too much involved in the process: High-speed chip shooter programming, pick and place gear, etc., etc. It simply cannot have been happening without massive, ongoing plant management knowledge and collusion…and subsequent discovery by our NSA.
The simplest answer: It’s a deliberate leak and retaliation for the Chinese destroyer stunt of four days ago. Message: Don’t screw with us; we can dump hundreds of thousands of unemployed, pissed off people on your streets if you do.
“… subsequent discovery by our NSA.”
Not to sound more cynical than we all should be — but it is very unlikely the NSA could discover much of anything. For 8long years of Obamination, the NSA has been focused more on internal enemies of the Democrat Party than on external threats.
The whole US security apparatus has shown itself to be guilty of false advertising. Not just Muller, Comey, and the rest of the FBI hierarchy – same FBI that needlessly murdered women & children at Waco. And the all-knowing CIA that missed the collapse of the Soviet Union. Not to mention a Navy that can’t avoid a ship the size of an island on the open seas because its female officers were not talking to each other.
No, very sadly, the initial hypothesis has to be that the NSA is as much kabuki theater as the Homeland Security team at the airport.
I’d be curious if the phone-home network activity of these chips raised alarms. Automatically alerting IT teams of suspicious network activity is a standard threat detection tool these days.
No! You might be assuming it isolates and sends entire databases of data or even partial documents.
There are very specific machine level instructions that for example validate a security Key. These are bytes, not megabytes.
Blockchain and other security key measures depend on distributive computing. If this hack is found in enough distributed servers, it is possible the tiny packages, less than 0.000001% of the netowrk traffic could ride along other transmissions from one server to another.
Silly consideration, if CryptoCurrency key were matched across the span of networks, it might be available to an outsider for makeing a withdrawal.
We witnessed China seriously cracking down on domestic crypto currencies about a year ago. If this group has acquired just 1% of he crypto security keys world-wide, and transfered the funds elsewhere, what country will care?
It could be a perfect crime that drives funds out of crypto back into central banks for safety. A country or the rest of us could care less if some crypto trader was cleaned out.
If the Federal Reserve discovered this, they would smile and say “not our problem”. The competition self-destructs.
In reality, few college graduates undersand binary at this point. They focus on language, OS and higher levels of the HAL.
The skills to discover and deal with this are all obsoleted or retired.
Microsoft use to have two certification exams WOSA I dna WOSA II for programmers to deal with OS interfaces at the motherboard level. Steve Ballmer cut all of that out as his focus was on .NET to increase sales. The US traded graphics artist for engineers.
Show anyone an engineer in the gatekeeper purchasing dept.
The average turnover rate of engineer’s employment is higher than a one year T-Bill.
Amazon is rotten to the core. Already no stranger to sweetheart deals, Amazon which has lined the pockets of its CEO Jeff Bezos at taxpayer expense is quietly moving in a direction that is destined to create even more controversy. Amazon through its lobbying efforts is on the verge of winning a multibillion-dollar advantage over rivals by taking over large swaths of federal procurement.
When you couple the voice of the Washington Post with a company so deeply involved with discovering and archiving detailed files and information about individuals and politicians across America you command a great deal of muscle and clout. The article below delves into why it is time to face the fact Amazon needs to be curtailed.
IN some circles, the way to prevent threats to “capitalism”, is always to have government curtail people engaging in it, it seems…. Nothing new under the sun.
Both Apple and Amazon have denied what Bloomberg reports. So far it looks to me like “a lot of smoke with no fire”:
I wonder what this smoke is supposed to cover.
There was a movie about this. Dragon Day. Not a great movie, but life follows art again.
I’ve witnessed more than once a story being published as a distraction from a real story. So while we were distracted by Russia, the real enemy was China.
Eh if Russia had the capability they would try this too… they work other ways.
Well, generally I’ve found Bloomberg articles content free, at best, and misleading gobbledygook, at worst. But the following quote from this article redeems Bloomberg in all ways:
“Two of Elemental’s biggest early clients were the Mormon church, which used the technology to beam sermons to congregations around the world, and the adult film industry, which did not.”
The bigger story should be how the “free-trade” outsourcing zealots have opened us up to this impossible-to-defend espionage through their own greed. They’ve wiped out our middle-class manufacturing for the sake of their own stock portfolios. This result was predicted decades ago.
This is not a “China” story. If you think finding an extraneous chip on a motherboard is tough, try fingerprinting similar code inserted at the heart of the latest Intel CPU….
Those who insist on living under the delusion that scum in Washington is for some mystical reason more justified than their entirely similar colleagues in Beijing, should feel all warm and fuzzy knowing that the Chinese are much more fundamentally exposed via dependence on US chips, than Americans are from dependence on Chinese circuit boards. Those who can spy on you, do. Because they can. Not because they are baaaad. While someone else is gooood. Because they say so on TV.
Bitcoiners have been concerned that cryptographic accelerators on modern CPUs have been compromised ever since they where first implemented. And other parts of chips as well. For Joe Blow, the safest may well be to run critical code, like big crypto wallets, on pared down linux distros on old, old CPUs, and other hardware, from an era before cybersnooping became a big initiative.
Over time, one could hope open source chip designs (AND chip fabs, along with better procedures for verifying both), even if the resulting chips are far, far, far from current state of the art, will become available. As the current stuff, is far to complex for anyone to make heads or tails of, without knowing exactly where to look and what to look for.
As of current, intelligence agencies, and others, with access to the manufacturers of hardware central to your computer, can spy on you. Data overload is all that keeps them from doing so. And unwillingness to tip their hand, is all that prevents them from taking advantage of what they can thus learn.
Intel’s AMT and IME engines have been suspect for (once again) over a decade. Eavesdropping capabilities have been built in for a long time at the behest of friendly intelligence agencies. None of this should come as a surprise to anyone.
Yup.
Which every walking Chinese above 3 years old, is well aware of. Hence why they’ll have a hard time getting all that excited about the “evil” Supermicro in their midst. It’s just another day of being spied on by someone.
From Amazon’s POV, being primarily a US/Western focused outfit; it’s less of a problem if some Chinese spies a bit on them, that if Americans does so. It’s just that wrt the Chinese, they can at least attempt to fight back. While wrt US spies, even mentioning they exist, will have them carted off to Gitmo, or tossed in jail on trumped up rape charges by notoriety seeking sluts volunteering their time for the Junta that indoctrinated them.
This has been a complete no-brainer for more than a decade (or longer). Supermicro took the hit today since they were singled out in the report but there should be no doubt that every manufacturer has fallen victim to this. Every circuit board is mfgd in China and has been for a very long time. Of course Chinese Intelligence is manipulating them – we would be too. We know from the Snowden docs that the NSA has to interdict shipments of hardware to insert their chips; inserting them during the manufacturing process is much easier. State-level intelligence agencies have unlimited budgets for stuff like this. It’s what they exist to do.
The smart move would have been to go to quietly go to Super Micro, confront them with certain corporate death, and agree to their hanging an engineering change on all the compromised servers providing an NSA back door to the Chinese back door…
Newsflash: It’s not just Supermicro.
Of course not, but I’m assuming the others have complied. Super Micro probably jumped on their high horse and refused and will now become roadkill, like the firm providing the back door that fingered Libya in the 1986 German disco bombing.
Complied with what? It is very easy for the PCB manufacturing houses to insert this spy tech on boards without the hiring co. to even know its happening. They print these boards in batches of 10-100 thousand. You don’t expect parent co’s to inspect each one with a microscope + oscilliscope every trace? Even if they did these chips were camoflaged and virtually impossible to detect.
Interesting that Maven did not pick up this article by Mish. (Censor it ???) Makes one wonder whether Maven runs on severs with Chinese motherboards.
Because China makes the motherboards for most servers worldwide, this affects the EU, Russia, Japan, India too. Are the Chinese looking for data — or do they want to be able to switch off the enemy servers before a military attack?
China makes the circuit boards for every piece of electronics kit in the world.
No they don’t. Maybe the epoxy boards and components, but there are some very high reliability military boards and components that are made from ceramics because they need to be 100% hermetically sealed and have to withstand very high temperatures.
This is one of many reasons to finally get the unfair trade practices that China engages in rectified. Milton Friedmans recommendations on free trade don’t account for engaging in free trade with a maleovlent country trying to essentially dominate you fiancially and militarily. We are giving them the rope to hang ourselves with. On a different playing field the competition would be good for the USA and hopefully make us more comptetive even if they had uneven advatages on their end. But to let a country that killed 50 million of their own citizens become a world power fiancially and militarily would be suicide. I am okay with the increase in costs a trade war would bring abou,t but this sacrifice is better than going into a hot war. I am hoping the Chinese economic miracle implodes before this happens. No centrally controlled command economy has ever been successful in the long run. Free market capitalism has been the most successful economic model in history and has lifted more people out of poverty than any other system. The problem over here is that it has evolved in a corrupt crony capitalist system. We now have the best govt money can buy.
The one thing you can count on the Chinese to do is steal any technology or secrets that they can. This should not surprise anyone. Maybe US companies and government will get more serious about security now; they cannot ignore this.