New evidence of Chinese tampering with Supermicro hardware ‘found in US telecoms company’

[To-Whose-Benefit?]

South China Morning Post
PUBLISHED : Wednesday, 10 October, 2018, 2:30am
UPDATED : Wednesday, 10 October, 2018, 12:22pm

[excerpt]

https://www.scmp.com/news/china/article/2167737/new-evidence-chinese-tampering-supermicro-hardware-found-us-telecoms

A security expert has provided evidence that reveals how China’s intelligence services had ordered subcontractors to plant malicious chips in server motherboards

A major American telecommunications company discovered manipulated hardware from Super Micro Computer (Supermicro) in its network and removed it in August – fresh evidence of China tampering in critical technology components bound for the US, a security expert working for the company has said.

The expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery that detailed how China’s intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015.

Appleboum previously worked in the technology unit of the Israeli Army Intelligence Corps and is now co-chief executive officer of Sepio Systems in Gaithersburg, Maryland. His firm specialises in hardware security and was hired to scan several large data centres belonging to the telecommunications company. The company is not being identified because of Appleboum’s nondisclosure agreement with the client.
 

[Sighlass]

Wonder how the average Joe like me can tell if their computer is being used to spy for China (not to mention just used to ruin one's life like giving illegals access to information used to assume identities).

I would think they (Apple and others) would have to deny the claims else they would have to go public with just what and how much they and their customers were exposed, it could cost them millions. Imagine if they hid one in every iPhone and iPad?

Recalling and replacing that many phones and IPads along with the lawsuits and bad publicity that went along with it would destroy the company.

This does make one wonder just where China's technological advancement would be today without industrial espionage and reverse engineering.

Security researcher cited in Bloomberg's China spy chip investigation casts doubt on story's veracity

Apple denies....

Security researcher cited in Bloomberg's China spy chip investigation casts doubt on story's veracity

https://appleinsider.com/articles/18/10/08/security-researcher-cited-in-bloombergs-china-spy-chip-investigation-casts-doubt-on-storys-veracity

[PeteS in CA]

1. This claim is patently absurd, for a very simple reason. Data signal lines in computer motherboards have been carefully impedance-matched since the days of the 80386 or 80486 microprocessors. They are transmission lines, not just conductors. At those clock frequencies a wire or PCB trace is no longer just a conductor. Because motherboards are finely tuned, matched to each component in each circuit, "planting malicious chips" into impedance-matched circuits would unbalance the signal lines and disrupt performance at best, and probably render the motherboard inoperable.

Further, modern server motherboards have control software that continually monitors power consumption. An extra "chip" that is not part of the motherboard's design would be detected quickly because of its added power consumption and the motherboard would be reported to the system or network as defective in some way, and the motherboard would probably be disabled.

I would not expect a "journalist" to understand this, but I would expect a real journalist to find some knowledgeable people to factcheck their expert's claims.

2. So, how well did Supermicro weather this storm? This quarterly revenue chart gives the broad picture, https://www.macrotrends.net/stocks/charts/SMCI/super-micro-computer/revenue . Supermicro is doing quite well.

In the years since this "planting malicious chips" claim Supermicro has built and brought online several new manufacturing buildings in San Jose on a site purchased in 2013, and last month purchased another large site in San Jose, https://therealdeal.com/sanfrancisco/2024/02/14/super-micro-computer-buys-former-frys-hq-in-san-jose/ . Whether they will use the existing building on that site or tear it down and build new (as they did with the 1960s vintage building in the 2013 purchase) has not been in the news (that I know of).

[DefiantMassRINO]

No shock here.  Just commies being commies.  We need to stop giving our business to our enemies.

[PeteS in CA]

1. Supermicro is a US company. Try Googling or W'pedia'ing it.

2. Charles Liang was born in Taiwan, not mainland China, and is a US citizen.

[Smokin Joe]

1. This claim is patently absurd, for a very simple reason. Data signal lines in computer motherboards have been carefully impedance-matched since the days of the 80386 or 80486 microprocessors. They are transmission lines, not just conductors. At those clock frequencies a wire or PCB trace is no longer just a conductor. Because motherboards are finely tuned, matched to each component in each circuit, "planting malicious chips" into impedance-matched circuits would unbalance the signal lines and disrupt performance at best, and probably render the motherboard inoperable.

Further, modern server motherboards have control software that continually monitors power consumption. An extra "chip" that is not part of the motherboard's design would be detected quickly because of its added power consumption and the motherboard would be reported to the system or network as defective in some way, and the motherboard would probably be disabled.

I would not expect a "journalist" to understand this, but I would expect a real journalist to find some knowledgeable people to factcheck their expert's claims.

2. So, how well did Supermicro weather this storm? This quarterly revenue chart gives the broad picture, https://www.macrotrends.net/stocks/charts/SMCI/super-micro-computer/revenue . Supermicro is doing quite well.

In the years since this "planting malicious chips" claim Supermicro has built and brought online several new manufacturing buildings in San Jose on a site purchased in 2013, and last month purchased another large site in San Jose, https://therealdeal.com/sanfrancisco/2024/02/14/super-micro-computer-buys-former-frys-hq-in-san-jose/ . Whether they will use the existing building on that site or tear it down and build new (as they did with the 1960s vintage building in the 2013 purchase) has not been in the news (that I know of).

I claim no expertise in this field, but couldn't those circuits be rebalanced by other components (or even the same components) in the balancing side? You can set the baseline on a wheatstone bridge for example by simply adjusting the baseline to compensate for sensor drift or age, why not do the same with the circuits that you want to compromise?

Not arguing, just asking, thanks.

[PeteS in CA]

I claim no expertise in this field, but couldn't those circuits be rebalanced by other components (or even the same components) in the balancing side? You can set the baseline on a wheatstone bridge for example by simply adjusting the baseline to compensate for sensor drift or age, why not do the same with the circuits that you want to compromise?

Not arguing, just asking, thanks.

Hypothetically, yes, for one or two easily accessible signal traces. Since we are talking of dozens or scores of traces in one or several inner layers of a multilayer printed circuit board, no. It's impractical to the point of impossibility. There is also the fact that the motherboard and system software would detect the increased load current from an added "chip". Whether the system disabled the MB or reported it as defective, this would be detected during system integration, which Supermicro does in San Jose, not China.

Bloomberg's story is false. Whoever sold it to them, for whatever reason, it is absurd.