Attacks/Breaches

10/4/2018
03:30 PM
50%
50%

Report: In Huge Hack, Chinese Manufacturer Sneaks Backdoors Onto Motherboards

If true, the attack using Supermicro motherboards could be the most comprehensive cyber breach in history.

According to a new article in Bloomberg BusinessWeek, manufacturing plants in China implanted tiny network monitoring and control chips on motherboards made for U.S. manufacturer Supermicro. Supermicro motherboards are commonly used in white-box servers, including those purchased for data center use by companies like Amazon and Apple.

The article says that the chips were discovered during a due-diligence security survey conducted on computers manufactured by Elemental, a company making systems for high-speed data streaming. Worse yet, according to Bloomberg, "Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. And Elemental was just one of hundreds of Supermicro customers."

Security researchers quoted in the piece say that the purpose of the chips is to change the operating system core so that it will accept externally sourced changes, opening a backdoor into the system that can be used for a variety of purposes. Amazon, Apple, and Supermicro have all denied the details of the article, though Bloomberg is standing behind its reporting and says that critical details have been corroborated by current and former government employees.

In a statement to Dark Reading, Joseph Carson, chief security scientist at Thycotic, said: "We are one step away from a major cyber conflict or retaliation that could result in serious implications. However, what is clear is that it is a government behind this cyber espionage and I believe it is compromised employees with privileged access that are acting as malicious insiders selecting specific targets so the supply chain has been victim of being compromised. The motive will not be clear until exact details of the hardware chip is reversed to know what it is capable of and who are the victims since no one is owning up from any of the Supermicro’s customers."

Dark Reading will continue to follow this story as it develops.

For more, read here

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Alexandre Cagnoni
50%
50%
Alexandre Cagnoni,
User Rank: Author
10/5/2018 | 5:29:08 PM
Economic effects as well
This could have major economic impacts beyond the obvious security ones. If true, it could change the way the world has to manufacture and buy computers if the country that is responsible for 90% of computer hardware is doing this. That's a major shift in manufacturing that we are not prepared for!
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
10/5/2018 | 3:09:48 PM
Made in China - it's cheaper
For years, American manufacturing firms have let Chinese workers build a wide range of products, consumer and tech intensive and for those years we have freely given them our technology to replicate, study and use.  Every laptop that went to the old Olympic game came back with malware.  Every one.  Nobody talks of that nor the blatant opportunity to just COPY what we give them.  And for this we are now surprised!!!   They are NOT friendly to us - get that!!!   Neither Russia and host of other countries.  This tech achievement is impressive in scope but should have been expected all along.   We are blind on many things.  
Microsoft, Mastercard Aim to Change Identity Management
Kelly Sheridan, Staff Editor, Dark Reading,  12/3/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19991
PUBLISHED: 2018-12-10
VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args or get_post_args) to block the API misuse described in CVE-2018-9230.
CVE-2018-19653
PUBLISHED: 2018-12-09
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
CVE-2018-19982
PUBLISHED: 2018-12-09
An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controller (HUB) > Node (products which are controlled by HUB). The prerequisite is that the attacker is on the same network as the target HU...
CVE-2018-19983
PUBLISHED: 2018-12-09
An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending ...
CVE-2018-19980
PUBLISHED: 2018-12-08
Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operating system) via a crafted application that sends data to WifiService.