35C3 - Modchips of the State

What Hacker News said

Recommends shasheene · 2019-06 · on “Magic Leap Says Ex-Engineer Copied Headset for China”

You may not be aware of the great talk titled "Modchips of the State" [1] (presented at 35C3 in Dec 2018). The speaker managed to reproduce the exact single-chip hardware implant attack suggested in the Oct 2018 Bloomberg Businessweek story [2] [3], which claimed Amazon and Apple found malicious hardware implants in Supermicro motherboards while conducting detailed inspections. While Bloomberg has never retracted the story, there's an argument that the sources have vested interests in lying to Bloomberg suggesting that attacks developed in lab-conditions actually occurred in the real-world, in order to raise awareness of supply-chain risks (something the current US administration has been at

Cites nkurz · 2019-01 · on “Modchips of the State”

I think his demo POC had outside power and ground. I would hope this is not the case. If it was, I don't see how it can be legitimately called a hardware proof-of-concept. I agree, though, that the lack of outside power and ground doesn't seem to be explicitly stated in the writeup. The video comes a little closer, with one of the questions after the talk asking whether using more pins would make things easier: (from the automatic transcript of [this video] , punctuation added and some typos corrected): "But do you see a way to actually get more power into your setup, maybe using other power sources other than the two pins?" "So the question is about would there be some way to do more arbitrary c

Cites wahern · 2019-03 · on “Ask HN: What's the latest on that “Big Hack” story by Bloomberg?”

If you look at the Huawei controversy the intelligence community appears utterly convinced that these hacks are occurring. But the current trade war with China makes one wonder whether the threats are exaggerated or outright fabricated. OTOH, the negotiations also mean the U.S. has an interest in not disclosing details of actual incidents, to help China save face and also to preserve U.S. domestic markets as gambling chips--i.e. if it disclosed serious and pervasive attacks then nobody would buy Huawei, so China would have less of an interest in making concessions so sellers like Huawei can grow in the U.S. market. (Similarly, SuperMicro, Apple, and Amazon are American companies so U.S. offi

Cites wahern · 2019-10 · on “Today is the one year anniversary of The Big Hack”

Several months after the story was published someone actually presented a proof of concept demonstrating the practical feasibility of the claimed hack[1]. See presentation at [LINK] ( [this video] ), and project website at [LINK] There's irony in how people repeat and share the technical rebuttals long after those rebuttals have been conclusively rebutted themselves. That in no way absolves Bloomberg, but the indignation of their critics is tiresome. [1] Of course the specific details of the claimed hack were never reported, but the proof-of-concept fits the claims, and in any event is more than sufficient to rebut the rebuttals.