H0LT

Last October, Bloomberg published a blockbuster story claiming that some of the largest tech companies in the world, as well as sensitive US government and military systems, had been attacked through minute hardware implants that had been inserted at a subcontractor facility during the manufacture of servers from the world’s leading server company, Supermicro.

The story immediately drew forceful – and unprecedentedly detailed rebuttals – from many of the companies involved, creating a mystery that is still being debated: if Bloomberg sourced its story as carefully as it claimed, then how to explain all these detailed rebuttals? And if the rebuttals are to believed, then how to explain the dozens of people from different companies and agencies who would have had to collude to trick Bloomberg’s reporters into publishing the story?

Enter Andrew “bunnie” Huang (previously), one of our era’s greatest hardware hackers (his book on hardware hacking is one of the best technical books I’ve ever read, period).

Bunnie presented a 45 minute talk on supply-chain attacks earlier this month at Microsoft’s Blue Hat conference in Tel Aviv (he pitched the talk before the Bloomberg story broke, but the timing was indeed fortuitous).

I appreciate that 45-minute blocks of time are few and far between for most of us, but this is 45 minutes well spent. Huang walks through several techniques for sabotaging and compromising hardware, and uses his deep expertise in arranging and overseeing electronics manufacture to describe how you could pull these off in the real world, and what difficulties you’d encounter. In all the discussions of the supply chain hack story, I have never seen anything this comprehensive and nuts-and-bolts about what a supply chain hack actually looks like.

It’s a fascinating ride: part spycraft, part chewy logistics, part infosec, and Huang has plenty of “ooh” moments, to say nothing of laugh-lines.

In the end, Huang pronounces judgment on the Bloomberg story, declaring that it fails to pass Occam’s Razor for several reasons – not least that Bloomberg describes these cunning and fiendish implants that are still recognizable as implants, and as Huang demonstrates, there’s no reason for implants to be distinguishable from normal electronic component.

Having set out many ways in which hardware can be compromised (and usually not for spying, but for economic gain – that is, to slide counterfeit or recycled parts into the supply-chain), Huang does not describe what kinds of countermeasures might reliably detect these shenanigans – but he does dangle the possibility that he’ll address this in future talks or writing.

I was folding away some laundry the other day when I noticed a hole in my J. Crew sweatshirt. It’s about the size of my pinky nail, but threatens to get bigger, and it’s located in the very inconvenient place of my sweatshirt’s collar band. “I should mend that,” I thought, until I realized I don’t know how to mend anything at all. 

The idea of mending today feels more like a promise than a reality. Alden Wicker touched on this last month in her Vox article about how the spare button represents all the ways we fail to be good consumers. Everyone has a stash of spare buttons rattling around in some drawer, with each button still neatly tucked inside its original packaging until we gather the will to throw it away. We buy things because they’re supposedly “investment pieces” and “classics,” but when it comes time to actually take care of our clothes, we don’t actually know how – or, more often, can’t be bothered. 

“Really, the button fix is the easiest sewing project you could possibly do,” Wicker wrote. “There’s evidence of where the old button was located, and the holes of the new button guide your needle, while the button itself hides any sloppy work or loose threads. As long as you pick a pattern — crisscross or parallel stitches — and pull the thread tight, you literally cannot mess this up. And yet even this home ec 101 activity seems too much to ask of me and many people my age. […] Maybe spare buttons are just aspirational, designed to make us believe something about ourselves that’s not really true anymore. That we can have a fulfilling job and do crafty things in our spare time. That we could be satisfied with a capsule wardrobe of 30 items, which would free up so much time and psychic space that we would finally write that novel. That we could go plastic-free if we just put in a little more effort.”

bwonsamdi watching from across the sea:

awaken whenever im want

stretch

screme if necessary

We moved the ponies into the big field over Christmas and it’s safe to say they were happy about it ~