The vast majority of data breaches are digital, meaning the hacker gains access to information via coded scripts, backdoor trojan viruses, or cracking passwords. Surprisingly, this kind of breach is also the easiest to detect and prevent. When hackers manage to sneak physical hardware into systems, especially during the manufacturing process, it is often much harder to detect.
• A recent Bloomberg report outlines one unfolding incident involving hardware-provided access. Frighteningly, it affects not only America’s largest companies, but also our own government.
• The breach detailed in the report is multilayered, but it starts with a Chinese motherboard manufacturer by the name of Supermicro. Supermicro is one of the largest providers of enterprise-level server mainboards selling on the U.S. market, and has a lengthy relationship with the government, Apple, Amazon, and several other large-scale companies.
• Unfortunately, that’s probably exactly why their products were targeted for hardware intrusion attempts. Bloomberg’s report claims that a splinter group within the Chinese People’s Liberation Army (PLA) successfully infiltrated the company’s manufacturing process, installing tiny clandestine chips no bigger than a grain of on the underside.
• It isn’t entirely clear whether the remote access chips were installed during the manufacturing process, after the parts left the plant to be shipped to the United States, or even on U.S. soil. What we do know is that the CIA was one of the first organizations to be affected and to identify the problem
• After initiating a partnership with Amazon AWS to develop secure cloud storage services, Amazon requested the right to partner with a third company by the name of Elemental for hardware provisioning. But the CIA’s initial security investigations raised suspicions about Elemental’s intentions, and when Amazon sent the company’s equipment out for investigation, technicians found the chip installed on nearly every motherboard sent out.
• This led to a much deeper, more extensive investigation of Elemental’s extensive U.S. client list. Amazon was really just small potatoes; they were also sending equipment to Apple, the Department of Defense, the U.S. Navy, and other intelligence organizations. Even the CIA’s investigative drones were relying on hardware sourced through elemental containing the chip.
• The top-secret investigation also revealed that the clandestine chip grants an terrific amount of access that goes far beyond even the computer containing the motherboard itself. In fact, the chip permits attackers to create an open backdoor portal into an organization’s entire network, giving them access to the jeopardized computer and any other computer connected to it on the same network.
• The sheer magnitude of this kind of hardware hack is incredible. China is a world leader in tech. Not only do they produce around 90 percent of the world’s computer parts, but they also manufacture about 75 percent of all smartphones, too. That’s an unfathomable amount of potential access.
• U.S. intelligence officials continue to investigate just how extensive the infiltration really was, but few companies have admitted the oversight. It also isn’t yet clear exactly what the splinter group was after when they attempted to compromise our technology supply chain.
• Bloomberg claims at least one unidentified, high-ranking official believes it was a targeted attempt to gain long-term access to “high-value corporate secrets and sensitive government networks” – but for what purpose?
• Could your information be at risk as a result of this discovery? It’s difficult to say, at least at this point in time. Given that the CIA identified at least one major bank who was working with Elemental, it’s possible. But the investigation is far from concluded and there just isn’t enough information available yet to make that kind of judgement call.
• Even more terrifyingly, experts haven’t yet developed a good method for identifying this kind of intrusion. Any proposed fixes would dramatically slow down the supply chain with significant negative consequences – something neither consumers nor corporations have readily accepted.
• Bloomberg’s unidentified informant summed it up best. “You end up with a classic Satan’s bargain,” he explained. “You can have less supply than you want and guarantee it’s secure, or you can have the supply you need, but there will be risk. Every organization has accepted the second proposition.”
• But just ignoring the problem isn’t an option, either – especially if it stands to impact consumer privacy or national security on home soil. Experts all across the country continue to research new ways to identify hardware intrusion without destroying the delicately balanced flow of parts into the United States. One option is to drive manufacturing back home, into the U.S.