4 ms·
I also feel that the hack described is only borderline technically feasible. They describe a microcontroller the size of a decoupling capacitor that is install
by xevb3k 8y ago
I also feel that the hack described is only borderline technically feasible.
They describe a microcontroller the size of a decoupling capacitor that is installed between the main CPU and main memory (as far as I can tell from the vague description).
I assume this would have to be done without layout changes. On a part of the board that is quite sensitive to layout changes. It just doesn’t seem likely that you’d do a hack like this. You’d need a micro controller or ASIC that was running as fast as main memory. You’d need to make it cope with different kernels... and edit memory such that remote servers could reliablely be contacted.
Why not just swap out some other part? Like the IPMI controller? Or the Ethernet controller? Something that has access to main memory, that would hide the functionality even better, and that would give the attacker more space to work with?
I don’t get it.
- DenisM 8y agoMaybe it’s just a very simple mod that slightly delays the signal based on the content - just enough to be another rowhammer.
- mrb 8y agoExcept... a key word in the article makes the hack perfectly believable and feasible: "baseboard management controller". If the chip is inserted on the serial data line between the SPI flash memory and the BMC CPU, then, as an ex-InfoSec engineer, the whole thing sounds very plausible and even easy IMHO... You have to expect that any article about intricate tech details written for a general audience will get parts of their descriptions wrong. Like you I was raising my eyebrows when I started reading. But when they mentioned the BMC, I believed. The author did not make a vague mistake when mentioning this very specific technical term. In fact, the BMC is the perfect target for such a hardware hack: low-speed SPI flash memory interface easy to man-in-the-middle, BMC more privileged than the OS (can virtualize storage, keyboard, etc), BMC code independent of the OS (infect both Linux and Windows at once), BMC code changes so rarely that a backdoor making assumptions about the code layout and content would still work after many years of updates, etc. Edit: I checked Supermicro servers from the 2015 era. Most used the AST2400 BMC. It boots from SPI flash so this backdoor chip only has to intercept and modify bytes on the data out (DO) line to inject malicious code.
- alexeldeib 8y agoThis was my thinking as well. I was curious how such a device would do what they are claiming. And BMC is the perfect candidate to make this whole bit work. Reading that phrase definitely made the gears turn and the whole thing started to piece together a clearer picture.
- baybal2 8y agoI checked the photo. AST2400 has option for two spi memories, one overrides the other by default. They simply put a microscopic spi flash in place of the second "recovery" flash. I heard before the rumors of Chinese server mobos "talking" some gibberish on ICMP, so that must be it.
- mrb 8y agoYou could be right. But stuffing megabytes of a full copy of the BMC flash image in such a chip may be overkill. You could just as easily man-in-the-middle bytes sent by the legit flash over the SPI DO line...
- ficklepickle 8y agoIs this[1] possibly what you were referring to? It might be interesting to try and reach out to that person, they may still have the hardware. [1] https://communities.intel.com/thread/123362 https://communities.intel.com/thread/123362 Edit: the mobo in that post is the X11SPH-nCTF, which has the AST2500 BMC