Attacks/Breaches

10/4/2018
03:30 PM
50%
50%

Report: In Huge Hack, Chinese Manufacturer Sneaks Backdoors Onto Motherboards

If true, the attack using Supermicro motherboards could be the most comprehensive cyber breach in history.

According to a new article in Bloomberg BusinessWeek, manufacturing plants in China implanted tiny network monitoring and control chips on motherboards made for U.S. manufacturer Supermicro. Supermicro motherboards are commonly used in white-box servers, including those purchased for data center use by companies like Amazon and Apple.

The article says that the chips were discovered during a due-diligence security survey conducted on computers manufactured by Elemental, a company making systems for high-speed data streaming. Worse yet, according to Bloomberg, "Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. And Elemental was just one of hundreds of Supermicro customers."

Security researchers quoted in the piece say that the purpose of the chips is to change the operating system core so that it will accept externally sourced changes, opening a backdoor into the system that can be used for a variety of purposes. Amazon, Apple, and Supermicro have all denied the details of the article, though Bloomberg is standing behind its reporting and says that critical details have been corroborated by current and former government employees.

In a statement to Dark Reading, Joseph Carson, chief security scientist at Thycotic, said: "We are one step away from a major cyber conflict or retaliation that could result in serious implications. However, what is clear is that it is a government behind this cyber espionage and I believe it is compromised employees with privileged access that are acting as malicious insiders selecting specific targets so the supply chain has been victim of being compromised. The motive will not be clear until exact details of the hardware chip is reversed to know what it is capable of and who are the victims since no one is owning up from any of the Supermicro’s customers."

Dark Reading will continue to follow this story as it develops.

For more, read here

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Alexandre Cagnoni
50%
50%
Alexandre Cagnoni,
User Rank: Author
10/5/2018 | 5:29:08 PM
Economic effects as well
This could have major economic impacts beyond the obvious security ones. If true, it could change the way the world has to manufacture and buy computers if the country that is responsible for 90% of computer hardware is doing this. That's a major shift in manufacturing that we are not prepared for!
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
10/5/2018 | 3:09:48 PM
Made in China - it's cheaper
For years, American manufacturing firms have let Chinese workers build a wide range of products, consumer and tech intensive and for those years we have freely given them our technology to replicate, study and use.  Every laptop that went to the old Olympic game came back with malware.  Every one.  Nobody talks of that nor the blatant opportunity to just COPY what we give them.  And for this we are now surprised!!!   They are NOT friendly to us - get that!!!   Neither Russia and host of other countries.  This tech achievement is impressive in scope but should have been expected all along.   We are blind on many things.  
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10014
PUBLISHED: 2019-03-24
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
CVE-2019-10015
PUBLISHED: 2019-03-24
baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.
CVE-2019-10017
PUBLISHED: 2019-03-24
CMS Made Simple 2.2.10 has XSS via the advanced_search.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
CVE-2019-10010
PUBLISHED: 2019-03-24
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.
CVE-2019-9978
PUBLISHED: 2019-03-24
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.