nanog mailing list archives
Re: bloomberg on supermicro: sky is falling
From: Matt Harris <matt () netfire net>
Date: Thu, 4 Oct 2018 14:51:43 -0500
On Thu, Oct 4, 2018 at 2:26 PM William Herrin <bill () herrin us> wrote:
On Thu, Oct 4, 2018 at 3:07 PM Denys Fedoryshchenko <denys () visp net lb> wrote:It would be better for them(AMZN, SMCI, AAPL) to prove that these events did not take place - in court."Can't prove a negative."In the opposite case, even if this article is full of inaccuracies, judging by the discussions of security specialists, the scenario indicated in the article is quite possible.The Bloomberg article described them as looking like 'signal conditioning couplers" on the motherboard. There is no such part on server boards but maybe they meant optoisolators or power conditioning capacitors. The former is a hard place to tweak the BMC from without a high probability of crashing it. The latter doesn't touch the data lines at all.
One wonders if, with the quality of BMC's in general being as low as it is, and their security as bad, if any sort of extraneous hardware is necessary to facilitate a compromise of a system where any of these BMCs is present. Keep in mind many of these devices for some time included a "feature" where telnet'ing to a specific port and typing in a short string would result in a response containing a cleartext list of usernames and cleartext passwords. ;)
Current thread:
- Re: bloomberg on supermicro: sky is falling, (continued)
- Re: bloomberg on supermicro: sky is falling Mark Rousell (Oct 04)
- Re: bloomberg on supermicro: sky is falling William Herrin (Oct 04)
- RE: bloomberg on supermicro: sky is falling Naslund, Steve (Oct 04)
- Re: bloomberg on supermicro: sky is falling Denys Fedoryshchenko (Oct 04)
- RE: bloomberg on supermicro: sky is falling Naslund, Steve (Oct 04)
- Re: bloomberg on supermicro: sky is falling valdis . kletnieks (Oct 04)
- Re: bloomberg on supermicro: sky is falling Eric Kuhnke (Oct 04)
- Re: bloomberg on supermicro: sky is falling Mark Rousell (Oct 04)
- Re: bloomberg on supermicro: sky is falling William Herrin (Oct 04)
- RE: bloomberg on supermicro: sky is falling Naslund, Steve (Oct 04)
- Re: bloomberg on supermicro: sky is falling Matt Harris (Oct 04)
- Re: bloomberg on supermicro: sky is falling valdis . kletnieks (Oct 04)
- RE: bloomberg on supermicro: sky is falling Naslund, Steve (Oct 04)
- Re: bloomberg on supermicro: sky is falling Randy Bush (Oct 04)
- RE: bloomberg on supermicro: sky is falling Naslund, Steve (Oct 04)
- Re: bloomberg on supermicro: sky is falling William Herrin (Oct 04)
- RE: bloomberg on supermicro: sky is falling Naslund, Steve (Oct 04)
- Re: bloomberg on supermicro: sky is falling Jason Hellenthal (Oct 04)