11 ms·
There's denial and there's vehement to the point complete denial from multiple different companies. It's either a giant conspiracy by the FBI and multiple mega
by Illniyar 8y ago
There's denial and there's vehement to the point complete denial from multiple different companies.
It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter that if happened would most likely come up in the future again.
Furthermore if apple and amazon were both notified for comments, there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons, especially so if they made apple and amazon lie about it.
Or ... Bloomberg didn't do their due diligence and were too eager to be duped by agents who wanted to push an agenda to move manufacturing away from china or something similar.
- toyg 8y agoThey throw out some massive numbers though. You can kinda discount 6 "apparatus" sources (but usually for stuff like this it's just one or two, so it's already unusual), but they also mention several people at Apple, Amazon and the FBI, plus someone else in the "discouragement" meeting. That's a lot of agents. If it's made up, it's more realistic to believe the publication is complicit in the fabrication.
- Illniyar 8y agoThat's a good point. It makes things murky, which I suspect the massive amount of collaboration is the only reason Bloomberg published the article. Could it be a conspiracy to deceive Bloomberg? From all the conspiracies, that seems the most likely to me.
- pbalau 8y agoThe original article contains exactly 0 real technical information and reads like a spy story beginning.
- delroth 8y agoIt does, and all the technical details mostly match up. From the plausible attack vector (targetting the BMC with an implant) to CG animations of a compromised motherboard showing the implant at the exact spot between the BMC and its firmware chip (which makes perfect sense if it's some kind of SPI interposer).
- sschueller 8y agoYes, they need to provide more details on how its supposed to even work. We can come up with all kinds of theories but proof is needed that this device is even a chip. I want layer photographs of that thing.
- kazagistar 8y agoIt lines up with a description of an attack from a security conference a few years back.
- bparsons 8y agoIt is possible that because of the nature of counterintelligence investigations, the individual companies agreed to gag orders while law enforcement does its work. Also, these companies want to continue to do business in China, and likely do not want to be on the record accusing the government of a massive criminal conspiracy.
- okket 8y agoHow can gag orders force companies to write such press statements? Outright lying is financial suicide. Shareholders can and will sue the company.
- unit91 8y agoAgreed. Also lying to your shareholders is illegal, providing additional incentive not to write the press release.
- ethbro 8y agoOn the other hand, with this splashed across the front page of most news sites, they couldn't really stay silent.
- qaq 8y agoStatements are very specific so it's easy to craft them in such a way that it basically respects the gag order and does not actually contain any untrue statement. Even " Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server." Would this statement hold true if it was found not by Apple? "Apple never had any contact with the FBI or any other agency about such an incident." If Incident was being handled by 3d party private entity which was in contact with some gov entity this would hold true. "We are not aware of any investigation by the FBI, nor are our contacts in law enforcement." If it was contacted by entity other than FBI this would hold true.
- wstuartcl 8y ago
- setquk 8y agoTinfoil hat time. Based on my assertions elsewhere I suspect this is posturing plausible deniability for a more local actor being responsible for implants that may or may not be discovered already. The vigorous denials from Apple and Amazon are suspiciously against the grain in these situations.
- kerng 8y agoLook at the stock of supermicro, since 2015 (the year of revelation) it's been going down for them - reason might be because none of the companies bought new hardware from them.
- 394549 8y ago> Look at the stock of supermicro, since 2015 (the year of revelation) it's been going down for them - reason might be because none of the companies bought new hardware from them. They've also had accounting irregularities that caused their stock to be delisted from NASDAQ: https://www.theregister.co.uk/2018/08/22/supermicro_facing_nasdaq_delisting/ https://www.theregister.co.uk/2018/08/22/supermicro_facing_n... > "The delay primarily relates to the magnitude of work that the company must still perform in order to review the company's accounting judgements, estimates and records for transactions that occurred during fiscal year 2015 through 2017, as well as the assessments and conclusions on the effectiveness of its internal control over financial reporting." It's interesting that the irregularities started in 2015.
- smsm42 8y ago> It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter Like, say, the matter of secret surveillance on the mass scale? I mean, the track record here is not exactly pristine. > Bloomberg didn't do their due diligence and were too eager That is a distinct possibility too. But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it.
- balabaster 8y agoI think the matter of distinction of your second point isn't that they would or could, it's that we have evidence that in the past, they have already done this.
- ethbro 8y ago> Bloomberg didn't do their due diligence and were too eager Furthermore, the argument against this would be that (from the denials PRs) Bloomberg has been approaching the involved parties for "several years." Why would they decide to pull the trigger now simply from haste?
- Illniyar 8y agoCorrect me if I'm wrong but if you are referring to in PRISM the denials were quite vague. Both facebook and google said they never heard of a program called Prism but never denied being part of one. And facebook denied "direct access". Even when those responses came out there was confusion about what they meant in the statements. There doesn't seem to be any confusion here.
- astrange 8y agoIt's easy to pretend to be confused about a denial. Most people here do it so they can have something to post about. The PRISM denials were not vague and were perfectly true. PRISM was a system for handling subpoenas, and nobody denies getting subpoenas. If you ask e.g. Facebook they also won't deny proactively reporting child abuse to the FBI, which is another real US legal requirement.
- xevb3k 8y agoI also feel that the hack described is only borderline technically feasible. They describe a microcontroller the size of a decoupling capacitor that is installed between the main CPU and main memory (as far as I can tell from the vague description). I assume this would have to be done without layout changes. On a part of the board that is quite sensitive to layout changes. It just doesn’t seem likely that you’d do a hack like this. You’d need a micro controller or ASIC that was running as fast as main memory. You’d need to make it cope with different kernels... and edit memory such that remote servers could reliablely be contacted. Why not just swap out some other part? Like the IPMI controller? Or the Ethernet controller? Something that has access to main memory, that would hide the functionality even better, and that would give the attacker more space to work with? I don’t get it.
- DenisM 8y agoMaybe it’s just a very simple mod that slightly delays the signal based on the content - just enough to be another rowhammer.
- mrb 8y agoExcept... a key word in the article makes the hack perfectly believable and feasible: "baseboard management controller". If the chip is inserted on the serial data line between the SPI flash memory and the BMC CPU, then, as an ex-InfoSec engineer, the whole thing sounds very plausible and even easy IMHO... You have to expect that any article about intricate tech details written for a general audience will get parts of their descriptions wrong. Like you I was raising my eyebrows when I started reading. But when they mentioned the BMC, I believed. The author did not make a vague mistake when mentioning this very specific technical term. In fact, the BMC is the perfect target for such a hardware hack: low-speed SPI flash memory interface easy to man-in-the-middle, BMC more privileged than the OS (can virtualize storage, keyboard, etc), BMC code independent of the OS (infect both Linux and Windows at once), BMC code changes so rarely that a backdoor making assumptions about the code layout and content would still work after many years of updates, etc. Edit: I checked Supermicro servers from the 2015 era. Most used the AST2400 BMC. It boots from SPI flash so this backdoor chip only has to intercept and modify bytes on the data out (DO) line to inject malicious code.
- xoa 8y ago>there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons The rest of your post aside, the FBI cannot do that. It wouldn't matter if it was secret. It's not even a close call, it's been explicitly and repeatedly slammed down by courts even in extreme cases like classified information being illegitimately leaked, for example with the Pentagon Papers (SCOTUS ruling [1] against prior restraint). It just came up again a few months ago when a federal judge tried to use prior restraint and depublishing against the LA Times over their publication of information about a confidential informant and bargain that was accidentally published in full on PACER. A rung bell cannot be unrung. Now, if the FBI could find a leaker who had signed an agreement with the Federal government they could go after them in person. If a newspaper broke the law to obtain a story then that separate violation could independently be prosecutable (in public). But none of that means the publicly released information can then be taken back. And even if some random blogger might be intimidated illegally and not find the resources to fight back, that wouldn't be an issue for a major publication. I don't take issue with your skepticism in general but it's not helpful to ascribe special powers to government that it doesn't actually have either. ----- 1: https://www.law.cornell.edu/supremecourt/text/403/713#writing-USSC_CR_0403_0713_ZO https://www.law.cornell.edu/supremecourt/text/403/713#writin...
- kazagistar 8y agoThe FBI is not the only jurisdiction these companies have to follow, if they want to continue to operate internationally. Couldn't such silencing orders come from China or something?
- saudioger 8y agoCould these companies to anything _but_ outright deny it? Silence would be perceived as confirmation, and claiming to not know would be terrifying to their customers. Confirming it would risk their entire supply chain. Sure, maybe it's not true... but the only move here is to deny it even if it were true. The corporations involved have a massive amount to lose here.
- e40 8y agoI heard on NPR this morning there were 17 sources for the article. That seems like a lot, if this is wrong.
- onetimemanytime 8y agoThem being public companies and all, can they lie to stockholders and prospective shareholders? If China did this, kudos to them, in the sense that that's their job. Just like it is NSA's to do the same to them. Apple, Google, Microsoft, Intel, FB and a few other companies can probably match China's expertise and expenditure. What about the rest?