Supermicro server motherboards with hardware backdoor?

The requests have become more than just requests. Merely checking to find out if there's an update gives MS the go-ahead to install it, you won't get to decline. See the article at the link below.

It looked like Jeff L. meant to post a link like this one,

but posted something else instead.

Yep. That's how it works.

There is nothing wrong with your computah. Do not attempt to tweak any settings. We are controlling your computer. If we wish to make it faster, we will remove some bloatware. If we wish to make it slower, we will upgrade your system. We will control the updates. We will control the bug fixes. We can screw with your files, make them disappear. We can change the frustration level to a mild panic, or induce an epileptic seizure. For the next few hours, sit quietly, and we will assume control of your computah. We repeat: there is nothing wrong with your computah. You are about to participate in a great adventure. You are about to experience the awe and mystery which reaches to a new level of vendor arrogance... The Microsoft Limits.

We now return control of what is left of your computah to you, until the next 2nd Tuesday, at the same time, when yet another forced update will take you to... The Microsoft Limits.

I didn't know MS had pulled the plug on the update when I wrote my last rant on the topic.

Deja Vu. I wrote this bit of doggerel in about 1996 after trying to do an in place upgrade to Windoze 95. Not much has changed in 20 years except the extent of the damage:

Ninety Five fits on my disk. I read the docs, there is no risk. Fully tested and well planned. Just type the words that they command. Answer questions one by one. Are you sure? You're almost done. Pull the CD from the slot. It all worked fine, and thanks a lot. With a reboot and to my dismay, all my programs went away.

Full disclosure: I only write poetry when I'm frustrated, angry, disgusted, irritated, pissed off, etc.

Embedded passives are normal SMT components iirc. Dunno how they're attached.

Cheers

Phil Hobbs

So most of the time when dealing with Windows updates?

Rick C.

om adding chips. In the late 70s or early 80s an array processor I worked on used a 16 or 18 layer board with an "omega" layer for termination resist ors in ECL. That was basically painted on the fiberglass between layers. I expect capacitors would not have been so easy since they require much mor e height. Do they add capacitors between layers now?

As I tried to explain resistors can be printed onto a board layer with virt ually no thickness. Capacitors more than a very few pF can not be added th is way. Inductors are even harder to add if they are more than a very few uH which can be done via traces on the PCB. So I'm not sure why you think normal SMT devices can be added within the layers of a PCB... at least with out creating visible bumps. Are you suggesting they make holes in some of the layers to accommodate the thickness of the SMT parts? Since you say yo u don't know how they are attached, I guess you can't answer any of this.

So what makes you think this is possible?

Rick C.

snipped-for-privacy@gmail.com wrote in news:a5bce5ac-f15d-4037-979a- snipped-for-privacy@googlegroups.com:

You idiots seem to be getting everything you deserve.

Funny too, 'cause... my shit works... Regardless of what I boot on it. That... That is poetry. Bwuahahahaha!

snipped-for-privacy@gmail.com wrote in news: snipped-for-privacy@googlegroups.com:

We had HVPS designs where we had internal layers milled to create pockets and the PCB house had no problem with it.

Still, this hack was not that and such a change would get caught almost immediately. PCBs get tested on continuity machines.

Server m/boards are multilayer and can be 4-5mm thick these days, so a 1mmx1mmx0.5mm device could easily be hidden between the layers. A few added vias for signal and power.

Not only are the blank boards made China, ie: they have the Gerber, drill and layout files, most of the parts are made there as well, so they effectively have full control over production from design to finished product. A government organisation with unlimited resources could easily interfer with that process at some stage.

What is interesting about this are all the denials, which suggests our own side have been aware of this for some time and may even be involved themselves. Government agencies always wanted back doors to enable access to systems anyway and this is just one more possible pathway...

Chris

Chris wrote in news:ppi2gj$lae$1 @gioia.aioe.org:

so

they're

with

be

are

That is not the point. Such an inclusion would get spotted both visually and in the testing of the PCBs.

No. They are designed and even proven and subsequently approved here. Modifications would get caught. ECOs get processed upstream too.

No... This is a single (spy) person doing a job on the selected trace and adding the part during the build phase and could be done right up to the moment it goes into an ESD bag. If the number of spy folks increases, the odds of it getting caught goes up. It all comes down to just what position the culprit holds as well.

Yes... the ONE location I stated. ZERO engineering change in the gerber or anywhere else. It comes down to getting a board as soon as it gets into production and get it over to the hackers to find the one place to put the part, then the info gets fed back to the guy to implement... Easy Peasy. Chinkaneezy.

(almost off thread topic)(below... not you)

There is no way in hell that Sotheby's did not know about the shredder. For one thing, it would have to have been triggered, and if hidden away for years, any trigger device would not have the juice. And the shredder itself needed juice to feed to painting. Was the trigger device a cellphone? No... Sotheby's knew about it.

Government agencies always wanted back doors

Which is what I am sure the "intel flaw" was/is. Update your bios.

No. The chinese hack is major spy activity, not personal info mining.

I learned something! I have a few questions about that.

Is this capability common in PCB production equipment? Is it likely to be available in mass-production for server motherboards? When is it necessary anyhow? What PCB design software supports it?

Inquiring minds...

Clifford Heath.

You keep saying that, as if someone who had access to make the change wouldn't also have access to change the test expectations.

Clifford Heath.

Unknown. Embedded passives (mostly de-caps) were being explored by about 2000 for improving signal integrity by reducing supply inductance.

Cheers

Phil Hobbs

Why do people have so much trouble understanding that this hack was done at the factory with the knowledge and cooperation of the factory. Every test program and method was testing the boards to make sure they were the modified boards.

The hacks were only found when the boards went to a third party who verified the boards against the original design information. Well, in the case of Apple it's claimed they found the problem because of anomalous network activity.

Rick C.

On Wednesday, October 10, 2018 at 9:47:18 AM UTC-4, snipped-for-privacy@gmail.com wrote :

That sounds a bit specious. I took a course in high speed design with Lee Ritchey where he showed the extreme effort that many use to shorten decoupl ing capacitor trace and thereby minimize inductance is overkill when embedd ed power planes are used. After showing the theory and running a simulatio n he built a board to measure the effect and found there was very little di fference between having a decoupling cap right next to the power pins, an i nch away and even near the other side of the board some six inches away. T he power planes provide the needed current to the chip while the wave front propagates to the capacitor and even beyond as the wave front continues to propagate across the board. So the "slow" rise time of the capacitor curr ent due to parasitic inductance is almost completely masked resulting in a very small dip in voltage at the power pin increasing only slightly at long er distances. In reality the power plane completely decouples the power pi ns and the capacitors serve to replenish the power planes.

So clearly there would be very little advantage to using intra-layer decoup ling caps vs using power planes. I suppose if you wanted to save the cost of the added layers in a high volume run then it might be worth while. But the cost of the additional routing on some layers may well mitigate the sa vings.

Rick C.

You will never get him to acknowledge this. He has made up his mind in spi te of the fact that the article clearly talks about factory managers being bribed and/or threatened which means the entire job would be modified since the boss isn't going to be soldering boards himself.

Also, if an individual could do this, it could be done anywhere, anytime si nce it is always possible to get a "spy" into a non-classified industrial j ob. Moving production to another country, including the US, would not prev ent a single actor from repeating the exploit in the future.

He doesn't care about the facts, he has decided.

Rick C.

snipped-for-privacy@gmail.com wrote in news: snipped-for-privacy@googlegroups.com:

No, it was not. IF it were then ALL of the motherboards produced would contain the hack part and they do not. It was specifically targetted and individusally implimented by one or just a couple of folks there.

Sorry, bub... but I do not believe than there is an entire factory of spies there. We see shit like that with Iran and their nuke program... not this. This was far more subtle.

I do not see how you cannot see that.

Am 11.10.2018 um 14:16 schrieb snipped-for-privacy@decadence.org:

Given that experience with their centrifuges, the Iranians seem to be more on the victim side of western hacking onslaughts.

And if the NRA can intercept DSL modem deliveries and replace them with hacked ones, why shouldn't the Chinese follow their example?

It occurred to me that I read about this about 4 years ago.

Read the article. They clearly indicate what I said in my post. You don't have to believe anything you read or don't read, but that doesn't make you r fantasy real.

Just to be clear, if a high level employee is turned he can modify the orig inal requirements and design documents so that very few if any other person nel need to be involved or even aware of the change. Most workers are just automatons who stamp out work day in and day out following directions from above.

Since high level managers seldom get involved in lower level work, it is li kely that one or two others were involved, some key employee who knows pret ty much everything about the details of the operation of the factory. He m akes the required changes to the original design used at the factory and th e factory is now making the modified boards with no one else the wiser othe r than his boss, the one giving orders to the entire factory.

I saw nothing in the original article that indicated the hacked boards didn 't go out to a wide market other than the fact that Elemental's forte was t ailored or full custom designs that would only be produced for a given user . I don't think Supermicro did the custom thing exactly, but that wasn't a ddressed. The article was about how the exploit worked, not how it didn't work.

This reminds me of how a retro-virus works. Get into the DNA of the host a nd use the host factory to produce viral proteins.

Rick C.