Re: [PLUG] The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

[prushik@gmail.com]

The article says it has memory and some kind of processing power. No way that's possible on a chip that small. Memory takes up too much space. Even Intel's ME doesn't have it's own memory.
It would also be likely to be detected while communicating over the network, even if it's traffic was well encrypted, it would still look odd to anyone monitoring the network.

This kind of attack would be possible, especially for devices made in China, but a separate chip is not going to work, it would have to be modified silicon. That would make it very difficult to detect as long as it didn't start establishing outbound connections unprovoked.

On October 4, 2018 2:35:20 PM EDT, Tom Diehl <tdiehl@rogueind.com> wrote:

On Thu, 4 Oct 2018, Lee H. Marzke wrote:

The report says the chip talks to the baseband controller, which has privileged to do remote Bios / firmware patching.

And the of course there is this:

https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/

So who do you believe?

Regards,

-- Philip
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug