[PLUG] The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

[Ron Guilmet <ronpguilmet@gmail.com>]

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

The Supermicro attack 

The attack by Chinese spies reached almost 30 U.S. companies, including
Amazon and Apple, by compromising America’s technology supply chain,
according to extensive interviews with government and corporate
sources.

Since the implants were small, the amount of code they contained was
small as well. But they were capable of doing two very important
things: telling the device to communicate with one of several anonymous
computers elsewhere on the internet that were loaded with more complex
code; and preparing the device’s operating system to accept this new
code.

1. A Chinese military unit designed and manufactured microchips as
small as a sharpened pencil tip. Some of the chips were built to look
like signal conditioning couplers, and they incorporated memory,
networking capability, and sufficient processing power for an attack.

2. The microchips were inserted at Chinese factories that supplied
Supermicro, one of the world’s biggest sellers of server motherboards.

3. The compromised motherboards were built into servers assembled by
Supermicro.

4. The sabotaged servers made their way inside data centers operated by
dozens of companies.

5. When a server was installed and switched on, the microchip altered
the operating system’s core so it could accept modifications. The chip
could also contact computers controlled by the attackers in search of
further instructions and code.

Link to article

https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug