The Messy Truth About Infiltrating Computer Supply Chains (theintercept.com) 69
In October last year, Bloomberg Businessweek published an alarming story: Operatives working for China's People's Liberation Army had secretly implanted microchips into motherboards made in China and sold by U.S.-based Supermicro.
While Bloomberg's story -- which has been challenged by numerous players -- may well be completely (or partly) wrong, the danger of China compromising hardware supply chains is very real, judging from classified intelligence documents, reports The Intercept.
From the report: U.S. spy agencies were warned about the threat in stark terms nearly a decade ago and even assessed that China was adept at corrupting the software bundled closest to a computer's hardware at the factory, threatening some of the U.S. government's most sensitive machines, according to documents provided by National Security Agency whistleblower Edward Snowden. The documents also detail how the U.S. and its allies have themselves systematically targeted and subverted tech supply chains, with the NSA conducting its own such operations, including in China, in partnership with the CIA and other intelligence agencies. The documents also disclose supply chain operations by German and French intelligence.
What's clear is that supply chain attacks are a well-established, if underappreciated, method of surveillance -- and much work remains to be done to secure computing devices from this type of compromise. "An increasing number of actors are seeking the capability to target ... supply chains and other components of the U.S. information infrastructure," the intelligence community stated in a secret 2009 report. "Intelligence reporting provides only limited information on efforts to compromise supply chains, in large part because we do not have the access or technology in place necessary for reliable detection of such operations."
What's clear is that supply chain attacks are a well-established, if underappreciated, method of surveillance -- and much work remains to be done to secure computing devices from this type of compromise. "An increasing number of actors are seeking the capability to target ... supply chains and other components of the U.S. information infrastructure," the intelligence community stated in a secret 2009 report. "Intelligence reporting provides only limited information on efforts to compromise supply chains, in large part because we do not have the access or technology in place necessary for reliable detection of such operations."
Of course they do this. (Score:2, Informative)
The NSA admits doing exactly this to target high-value individuals. Order a computer, they intercept the package, in a few hours it's opened and modified and packed back up with OEM stickers like new. You would never know.
China is just much more broad and bold with their attempts to catch up using 3rd party companies that are actually 1st party ChiCom Party owned entities.
Supermicro may or may not have been a real story - however, if it WAS REAL, the NSA and SECINT have no obligation to inform the public of
Re: (Score:2, Insightful)
How does it "generate hate" to point out that China attacks the US constantly online and seeks to overthrow our superpower status technologically through subterfuge because they have a less capable military currently?
Maybe you just don't understand hegemony? It's always going to be there until we have either world governance (UN is toothless by design..) or one power cements itself as the only power.
Pretending China is an equal-opposite analogue of the US is where these analogies fail. They are not a cou
Re:Well, whom does it serve? (Score:5, Interesting)
Maybe you didn't consider the possibility that from China's standpoint, the US started it, and the only reason the US citizens aren't outraged about this is because they've been outright lied to by their own intelligence agencies gone rogue.
Tariffs (Score:2)
Re: (Score:2)
Just the opposite.
Many parties are "guilty" here... (Score:2)
While Bloomberg's story -- which has been challenged by numerous players -- may well be completely (or partly) wrong, the danger of China compromising hardware supply chains is very real, judging from classified intelligence documents, reports The Intercept.
While Bloomberg's story -- which has been challenged by numerous players -- may well be completely (or partly) wrong, which contributes to fake news, the danger of China compromising hardware supply chains is very real, judging from classified intelligence documents, reports The Intercept.
(...bold mine...)
The result of any compromising is the same as what the CIA/NSA have done to foreign entities, if I may add.
Re:Many parties are "guilty" here... (Score:5, Insightful)
Think about it: if every computer on the planet is streaming private material to China, what the hell would China do with all that data? And why would I care? its not like the Chinese are going to send me for re-education. OTOH, we can see what happens when the NSA comes after you.
Re: (Score:2)
Ever hear of encryption?
Re: (Score:2)
The result of any compromising is the same as what the CIA/NSA have done to foreign entities, if I may add.
The result of any compromising is the same as what the CIA/NSA have done to domestic entities, if I may add.
Yet another reason to diversify your supply chain (Score:2)
Want to protect your supply chain from tariffs, spying, and other political crap? Diversify! Make components in as many countries as possible, and when one is compromised, shut it down and make it someplace else.
Re: (Score:1)
Yes, in fact it is. Or to put it another way, don't keep your investment eggs all in one basket less the nuclear hammer smash them.
Re: (Score:1)
In the design of electronic voting machines, I've suggested that the machines need to not have wireless networking capabilities, not connect to networks, and...be sourced at least a year before any election in which they're used.
Hardware-level attacks aren't very effective when you don't know the exact software, data formats, and goals of your attack, and have no communication channel.
This is also why parallel testing and, yes, selling off a random sample of your stock after the elections is helpful. E
Re: (Score:1)
Even though I now work for a large chip manufacturer, I have a tendency to agree. That chip manufacturer missed it's earnings target by $1.8 billion due to the trade war with China and a disruption of a supply chain, a disruption that would simply not have happened with a diversified supply chain.
Anyone else find it creepy (Score:3)
I don't think it matters that we've handed so much manufacturing over to the Chinese. The folks running the show, what we usually call the Ruling Class, are global now. They might have the occasional spat here and there over who's yacht's bigger or who's the richest this week but they're not really fighting (and by extension the countries they run aren't fighting).
I suppose it's a good thing. A World War isn't the solution (though it's one way to kick your economy up a notch). But anything we're seeing here is at best a pissing match between billionaires.
Re: (Score:2)
Not to mention the Uighurs, whose plight has gotten some attention recently from the BBC, among others.
Re: (Score:2)
Now its computer networks that will have to collect it all for a Communist government.
Re: (Score:2)
Re: (Score:2)
Guess you totally missed AHuxley's point...
Re: Anyone else find it creepy (Score:1)
I find it creepy thar Americans called the destruction of Iraq "Operation Iraqi freedom" ...
intel management engine ? (Score:1)
'nuff said
Cute propaganda piece (Score:1)
Cute propaganda piece that builds upon the shaky claims of the original bloomberg story.
Re: Cute propaganda piece (Score:1)
Slashdot has been a constantly dripping spigot of US state propaganda for years now. This article seems like a patch over the last non-story about Chinese chip-trojaning injected into media which turned to to be pure bullshit.
Greed (Score:3)
Truth following Fiction? (Score:4, Funny)
Could something like this be used by China to cripple enemy economic and military might in a future conflict? We'd be fools not to consider this a very realistic possibility.
The pot calling the kettle black (Score:1)
Wait - Wut? Vendors don't check their products? (Score:1)
I worked in a company that created its own boards which were outsourced offshore. Every batch received in the plant where the devices were delivered had random inspections for quality. The company designed the boards and the offshore fabricators created the boards, populated them with chips (which contained company designed special purpose devices) and sent them to the plant. These custom boards were tested for QA and Government certification standards.
So the article suggests that SuperMicro did not, does n
Re: (Score:2)
Intel Management Engine (Score:5, Interesting)
Closed firmware... How is there not a class action lawsuit against Intel for this?
You're all fascists. (Score:1)
All foreign IC is suspect. And we can't trust imported food. And definitely not their unsafe cars...
In growth, the industry wants free trade. In a recession, they want protectionism. The form of government in which they have their way all the time is not democracy. It's fascism. And not one person living in an English speaking country and reading this post right now was born to a democratic regime.
Iran knows not to buy from us (Score:3)
Iran knows not to buy industrial controls from the U.S. (Stuxnet [wikipedia.org]). And the U.S. should know not to buy computers and phones from China.