5 ms·

That's a lot of unsubstantiated assumptions. It's also explicitly denied by both Amazon: >It’s untrue that AWS knew about a supply chain compromise and Apple:

• hendzen 8y ago
  Those employees wouldn't be authorized to talk about the information to anyone not cleared. Which includes the PR department or anyone tasked with crafting a statement.
• dannyw 8y ago
  Any TS/SCI cleared employees must deny the existence, even to their manager or even the CEO, unless they are also TS/SCI cleared.
  • ceejayoz 8y ago
    It'd be interesting to know how that interweaves with things like SEC requirements to disclose material information.
    • dannyw 8y ago
      Generally (and unfortunately) "national security" tends to override everything else.
      • astrange 8y ago
        Where did you get that from? This is well known to not be true in the US, the government can't even stop you from publishing nuclear secrets or the Pentagon Papers. See New York Times v. United States (1971) and United States of America v. Progressive, Inc.
  • drawnwren 8y ago
    That's not how TS/SCI works. You've been watching too many movies. Source: was TS/SCI cleared for 15 years. Information being classified just means you can't divulge the information, not that you can't divulge the existence of the info.
    • jnbiche 8y ago
      That's a bit misleading. There are code word programs and classified investigations where just revealing the existence of the info would be a serious violation. In this case, if a cleared employee is asked: is this information true, is there such an investigation? Then simply by saying they can't comment on the question, they reveal the info to be true. I think most people with high-level clearances would play it safe in such situations and just deny any knowledge of the situation.
      • drawnwren 8y ago
        I can't comment is exactly what they can and do say very frequently. Apple could have not commented on any investigation or not responded to a request for comment. This would have been completely normal. "That's not something I can talk about" is a very common phrase.
      • addicted 8y ago
        Frequently is not the same as always. And, if true, this situation would almost certainly fall outside the common scenario.
        • drawnwren 8y ago
          Absolutely correct, but extraordinary claims require proof. I'm certainly willing to be proven wrong, and of course I could be, but there is no indication that this is anything other than Bloomberg being misled at this point. Location of clearly exploited hardware, acknowledgement by anyone involved, or analysis of traffic from one of these boards would all corroborate the story.
    • grecy 8y ago
• phkahler 8y ago
  >> >It’s untrue that AWS knew about a supply chain compromise Funny they didn't deny that it happened, just said AWS didn't know about it.
  • datavirtue 8y ago
    Exactly, this type of weasle word shit is littered throughout all of the statements.
  • unit91 8y ago
    Same paragraph, they state: > We’ve found no evidence to support claims of malicious chips or hardware modifications. That's about as good a denial as you'll get from somebody with a lawyer.
    • kps 8y ago
      “We’ve found no evidence” ⇒ Somebody else found the evidence. This is fun.
      • astrange 8y ago
        You can read any sentence to mean anything else if you want, but all you'll get is a degree in literature.
  • kps 8y ago
    “AWS didn't know about it” ⇒ The relevant part of Amazon is not in the AWS organization.
  • IshKebab 8y ago
    I mean... yeah of course. There's always a chance that something happens and you don't know about it.
• imglorp 8y ago
  I found this wording interesting: > We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures. Does that mean they did uncover some "usual" vulnerabilities?
  • deleted 8y ago
    [deleted]
  • resonanttoe 8y ago
    Typically yes. This is base hardening. The usual vulnerabilities can be just default configuration options or unwanted firmware/software features. Similarly no security team is going to say "There are no vulnerabilities in the servers we purchased." It's just not true, they're always there and expected.
  • pdpi 8y ago
    There's enough "usual" vulnerabilities that the practice of fixing them has a name: hardening. For supermicro motherboards specifically, "open services with really shitty default credentials" is apparently one of them — definitely one that is common in a lot of other contexts. In this context, "unusual" vulnerabilities would be evidence of a deliberate attack, rather than just common security mistakes.
  • runlevel1 8y ago
    Most of the out-of-band management systems (aka IPMI/DRAC/LOM) that server vendors use are built by the same 2-3 companies and rebranded. These companies churn out some truly horrible software with little consideration for security. It's often difficult to automate firmware updates, so they tend to stay vulnerable. It's a similar situation to webcams: https://youtu.be/B8DjTcANBx0 https://youtu.be/B8DjTcANBx0
  • yread 8y ago
    or they uncovered it using non-standard procedures?
• jack6e 8y ago
  > Or at least have testimonies by employees in these company The original article directly addressed this: "The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information." It is entirely likely that the companies affected were directed by the IC agencies working on this not to discuss or reveal their knowledge of the hack. Often in intelligence operations it is important and useful to not alert your adversary that you are aware of their intrusions until you are fully ready to take action against them, or have fully removed the danger. I don't see any reason to take the companies' categorical denials as evidence that this did not happen or that they were not targeted. Those statements are what one would expect in a national security incident and investigation of this magnitude, with such serious implications.
• toyg 8y ago
  > this means that they are lying in these statements. Cyberwar with China is the current equivalent of the old Cold War scuffles with the USSR in third countries. How many lies were told back then, to cover up the worst mishaps? And then they were "uncovered" when it was safer or more convenient to do so.
  • simias 8y ago
    I can totally believe that there are tons of actual conspiracies regarding the tumultuous relationships between China and the USA but in what configuration does this particular one make sense? As far as I can tell the only people who come out badly out of this are the Chinese intelligence agencies and the complicit Chinese manufacturers. Why would the Apple and Amazon go out of their way to protect them? I can imagine that the US government could coerce them into doing that but to what end? If these companies are caught red handed lying on behalf of the Chinese or US governments it would set an absolutely terrible precedent, I don't see why they would risk it when they have so little to gain.
    • toyg 8y ago
      > As far as I can tell the only people who come out badly out of this are the Chinese intelligence agencies The richest and most powerful American companies, some of whom are critical to national security and/or make their operational security as a critical selling point (the CIA among others), would be found not to be in fundamental control of the essential infrastructure powering their core business. It would trigger expensive large-scale review of every server in the world, and investors would run for the hills. This would be massive, and have heavy repercussions in the markets. FAANG are not protecting the Chinese, they are protecting their own finances - and the authorities will let them get away with it because the alternative is unpalatable. If you keep it as a denied rumour, there is an official excuse for people to just get on with business as usual - nobody wants to deal with a market crash, not even most traders, and after all newspapers say many things, not all of them true. Maybe Supermicro is compromised, and maybe if you really care about hardware security you should buy elsewhere <wink-wink>; but it's not official, so most people can just pretend nothing is happening and go about their day, until a solution can be found. > I don't see why they would risk it when they have so little to gain. They have everything to lose, though.
• deleted 8y ago
  [deleted]
• datavirtue 8y ago
  The language is not very explicit. They allow the reader to interpret thier statement through an implied explicit denial. Great liars if not just plainly unclear. This whole thing wreaks. Is it fake news? Are the statements from Amazon and Apple expertly crafted to fool people who aren't very good at reading comprehension (most people)?
  • datavirtue 8y ago
    See, this is how FUD works. It works.
  • simias 8y ago
    An "implied explicit denial"? How does that work? Can you point out how these statements leave open the possibility that they know about this attack?
• jerf 8y ago
  There is a lot of information in the Bloomberg story, which I mean in the information-theoretic sense, and not in the sense that it must be "true" information for any definition of "true". A lot of very specific claims. Those claims did not come from the reporter writing the story, which is about 99.9999% likely to be incapable of making up such a plausible story with such details. So one must think about "Where did this information come from?" It is at least a plausible theory that the story is largely true (though as I posted in another thread, I'd bet money it's not all entirely true), and that the denials are either made by people who are unaware of the truth, or are being made deliberately. (Actually, the people who literally prepared those statements almost certainly believe the truth of the statements. One of the most plausible ways for a group of people to lie is for all communication to come from individuals who genuinely believe the lies; no body language tells or any other such leakage about it not being true.) It is also plausible that the denials are in fact true, in which case one is left with the very interesting question of "Where did all that information come from and why is it wrong?" As a couple of people have also said, there's also the option that the story is largely true, and the denials are true if you parse and read them like a lawyer, but meant to mislead anybody who doesn't. I can't say I've examined them for that, but it's definitely a possibility to consider. I'd actually suggest "propaganda" isn't a great explanation; propaganda does not generally depend on making lots of specific, refutable claims, and certainly not followed up by refutations immediately. It is usually designed to speak directly to people's emotions and fan pre-existing flames in ways specifically designed to not be refutable. If this really was government propaganda (note how that is more specific than my previous unqualified "propaganda", because anybody can propagandize, not just governments), I would expect the American companies would be strong-armed into agreeing with the story for the propaganda's purposes, or that the story would never run at all if they couldn't be sure the companies weren't going to back them. An alternate theory that might fit all the facts is industrial espionage. Let's say the story is completely untrue, the denials completely true. What is the result of this story? Supermicro in particular stands to lose some business. Perhaps someone who benefits from that planted this story. Another alternative is stock market shenanigans. As I write this, the delayed feeds aren't showing it yet, but Supermicro stock (SMCI) just took a 31% bath overnight. Who benefits? Short sellers, put option traders. I have no idea myself. "Unknown unknown" is still a pretty large chunk of my personal probability estimates.