The Big Hack - China Inflitrated Major Businesses Using Microchips

[Cristiano]

This is devastating if true:

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

Apple and Amazon have issued vigorous denials:

Apple and Amazon explicitly deny claims that servers were compromised by Chinese chips

More:
Chinese spy chips would be a "god-mode" hack, experts say

 

[Kara Spengler]

On the daily show last night he was saying he put false data on his phone in addition to the real data. I assume this was a joke but is not a bad strategy really. I just assume any piece of data I deal with is compromised.

 

[Cristiano]

Bloomberg’s spy chip story reveals the murky world of national security reporting

 

[Essence Lumin]

One thing I don't understand about the story is the claim the chip is impossible to detect. It needs to send information back to its creators. If some of these motherboards were in computers meant for internal use only, couldn't the attempt to send packets to the outside world be logged by a router?

 

[Lori Claremont]

One thing I don't understand about the story is the claim the chip is impossible to detect. It needs to send information back to its creators. If some of these motherboards were in computers meant for internal use only, couldn't the attempt to send packets to the outside world be logged by a router?

Unfortunately that presumes that someone is logging those sort of events, and further that someone is looking at those logs.

The chip could make some educated guesses whether or not it's cable to get outside the local network by watching local traffic, or by attempting to contact innocuous locations like google. Then the question is what sort of traffic is it going to send if it does determine it's able to connect to the outside world? I guarantee it's not going to attempt to connect to http://china-intelligence-phonehome.cn, they'll have some innocuous looking domain name it's contacting, likely located at a hosting provider somewhere innocent, which then relays (possibly several times) before the traffic is fully exfiltrated to China.

I'd say "Impossible to detect" is a bit strong, but not necessarily too far off the mark.

 

[Lori Claremont]

Quick follow up for anyone interested in a well regarded security journalist's take on this: Supply Chain Security is the Whole Enchilada, But Who’s Willing to Pay for It? — Krebs on Security

 

[Essence Lumin]

That sounds right for the most part. I would hope after a story like this came out that companies the size of Amazon or Apple would put systems in place to catch this. They would just need to put various kinds of hardware they buy into an environment where a router could immediately raise a red flag in the future. Have other computers make outside connections and if any of the computers they are checking make an outside connection do an investigation.

 

[Ashiri]

I can believe this could well be true despite the denials, if there is a way of accessing the IME using a tiny microcontroller.