12 ms·

Bloomberg’s ‘The Big Hack’

281 points by okket 8y ago

notatoad 8y ago
Can National Security Letters can be used to require companies to issue outright lies to the public? The bloomberg article indicates that the investigation is not complete, so that could be on explanation for the apparent disconnect between a seemingly well-reported story and the unsually forceful denials.
- close04 8y ago
  I would say not. If the outcome of the investigation is that they were hacked and knew they open themselves up to all sorts of litigation. What's stopping someone to sue after buying stock under the assumption that the companies are sound? I assume they have a duty to the shareholders.
- burlesona 8y ago
  That's what I was wondering too.
- ProAm 8y ago
  No but the gov might be unhappy that the secret is out while they were trying to use the chips to infiltrate/reverse engineer wherever the chips were reporting to? Amazon has gov contracts it wants to protect so Im not surprised they would deny this at the govs request, and Apple's #1 product is privacy so having something like this show up on their servers would undermine that product strategy so I can understand their denial too (homegrown or at the govs request)
  - thebooglebooski 8y ago
    This seems like the most likely reason for domestic companies to deny everything, and for their supply chain distributors to play along. 1) Big company partners with distributor. 2) Distributor has security issues. 3) Gov is already aware of security issues, says nothing. 4) Big company becomes aware of issues. 5)Gov steps in and pitches a deal: i)Both big company and distributor must deny. ii)In return, gov gets to: iii)Preserve any existing contracts iv)Protect the big company and distributor, with any legal, trade, or commercial benefits
  - drawkbox 8y ago
    > Amazon has gov contracts it wants to protect so Im not surprised they would deny this at the govs request, and Apple's #1 product is privacy so having something like this show up on their servers would undermine that product strategy so I can understand their denial too Additionally, Amazon and Apple are two of the still allowed to compete western companies in China that they haven't booted out of their markets, it could be that Amazon and Apple also want to retain the Chinese market and don't want to appear like they are helping while they have the cover of the NSL. Amazon and Apple are caught in a tough spot and the hardware issue/espionage device is definitely true. It is probably just that the people that know in the company aren't allowed to say and the PR team is not part of that 'need to know' group. Either way, trust of Chinese manufacturing is over, which hits Apple very hard in both market and domestic trust.
- paulgb 8y ago
  Today's Money Stuff ponders another angle of this: whether those companies would be committed securities fraud by abiding by such a request: > I do not think that the securities laws explicitly allow companies to make false statements of material fact if required for national security, but you could see giving them a pass here. https://www.bloomberg.com/view/articles/2018-10-04/computer-spies-hacked-reality https://www.bloomberg.com/view/articles/2018-10-04/computer-...
  - adventured 8y ago
    What if the story is bigger than Bloomberg or anyone else publicly knows at this point? That is, if the government turned over this rock and found something worse. The US Government could easily find it in its self-interest to make a deal, involving the SEC, on a national security basis, to allow Amazon and Apple to go the denial route with the US Government giving them guarantees regarding fallout. If it's worse than Bloomberg has reported, it would be highly desirable by the US Government to keep the rest as quiet as possible for as long as possible, to get at as much of what China is doing as possible. They might be running a counter intel program by now that relies on something China was doing.
    - fermienrico 8y ago
      What you're talking about is fantasy. "The US Government could easily find it in its self-interest to make a deal, involving the SEC, on a national security basis, to allow Amazon and Apple to go the denial route with the US Government giving them guarantees regarding fallout." Can you point out a legal mechanism for this to be possible?
      - Varcht 8y ago
        Unofficially, the policy is called "Too Big to Fail".
- heartbreak 8y ago
  > But in my experience, Apple PR does not lie. Do they spin the truth in ways that favor the company? Of course. That’s their job. But they don’t lie, because they understand that one of Apple’s key assets is its credibility. They’d say nothing before they’d lie.
  - microtherion 8y ago
    "Saying nothing" is indeed an extremely common move for Apple PR. "An Apple spokesperson declined to comment" is such a proverbial reaction that it would be considered completely standard operating practice here.
- Gokenstein 8y ago
  What's more likely is someone on the inside of one of these companies was privy to the discovery, but not the follow up. I've been in such a situation myself where I was in the room during what LOOKED like a DDOS by Akamai 10 minutes after we got off the phone with them to turn down their CDN services. In much the same way as Apple is refuting this claim, after a few weeks of internal debate above our pay grade we decided we didn't see it and it didn't exist and therefore it didn't.
- moduspol 8y ago
  Perhaps these things aren't handled at the level of "company"? For a national security-related issue, you might just include the minimum number of people that need to know, which would naturally not include your PR team. Then when an article like this comes out, the PR team responds in exactly the way they would if it were an outright fabrication, which is what the goal would be.
  - dguaraglia 8y ago
    Even though this could be the case (that the security team is under a gag order and the marketing/PR team don't know about it), I'm pretty sure a "no comment" response from security would signal the PR team to maybe downplay the whole thing. The active refusal is a bit too strong for just being a miscommunication.
    - minxomat 8y ago
      NSL-type deals are explicitly denied. E.g. Apple wrote: > Finally, in response to questions we have received from other news organizations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.
- wyldfire 8y ago
  If the US files injunctions for relief, federal court (FISA) justices can probably compel you to do just about anything. Presumably the Bill of Rights still pertains and takes precedent. But it's not ludicrous to think that you could be compelled to issue a denial or not issue an affirmation of the public claims.
  - notatoad 8y ago
    I'm pretty sure FISA has no relation to any of this.
peignoir 8y ago
A lot more coming from this news for sure, but kudos to whoever found these, that's solid tech due diligence!
- Taniwha 8y ago
  I'm still waiting for technically literate description - as an electrical engineer I don't know what a "signal conditioning coupler" is - searching DigiKey doesn't find anything under that name - it's not a "common" part, at least in my experience. The part looks like an RF filter look-alike of some sort. But that would normally be hooked into a power rail (and ground) - kind of hard to insert signals into a data line unless it was wired strangely So tell us what the part is pretending to be and how exactly it it was wired (and what it was connected to - is this another Intel ME backdoor?)
  - deleted 8y ago
    [deleted]
40acres 8y ago
This back and forth between Bloomberg and Amazon/Apple reminds me of the recent allegations against Supreme Court nominee Kavanaugh. In both situations it's difficult to identify who is telling the truth and is probably impossible to know the truth from the outside looking in. In both cases I've taken a "who has incentive to lie?" view on the allegations and denials, now this does not mean my hunch is correct at all, but it seems way more likely to me that it's in the best interest of Apple and Amazon to deny this story strongly as it makes both parties look bad and the investigation may be ongoing. I don't believe that Bloomberg made this story up but its understandable to question that maybe their sourcing was iffy, based on Bloomberg's history and the level of sourcing that they have cited I'm leaning towards believing the story as accurate.
- ProAm 8y ago
  Didnt all the companies lie about working with the NSA before the Snowden revelations?
  - lern_too_spel 8y ago
    No. Snowden's documents show they worked with the FBI, which we already knew and the companies have always admitted to.
    - ProAm 8y ago
      This article shows different: "Blanket denials from Microsoft, Google, and Facebook -- and efforts to clear their names -- are the opposite of what AT&T and Verizon did in response to reports saying they opened their systems to the National Security Agency. " [1] [1] https://www.cnet.com/news/nsa-surveillance-retrospective-at-t-verizon-never-denied-it/ https://www.cnet.com/news/nsa-surveillance-retrospective-at-...
      - lern_too_spel 8y ago
        As I said in my earlier post, those denials are accurate according to Snowden's documents. They integrated with the FBI to process court ordered user data requests. They obviously would have no knowledge of a downstream NSA data processing system or its code name. Your article itself says that the initial reporting was incorrect and links to https://www.cnet.com/news/no-evidence-of-nsas-direct-access-to-tech-companies/ https://www.cnet.com/news/no-evidence-of-nsas-direct-access-... which correctly explains how PRISM is an NSA system that processes court ordered electronic wiretaps obtained by the FBI.
_trampeltier 8y ago
Still no statement from supermicro. Nothing on Twitter. Nothing on the website. That's a kind of strange after the stock price droped so much.
- excalibur 8y ago
  Yeah there is: https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
  - _trampeltier 8y ago
    True, but still, I would like to see a statement on the website or on twitter.
- jedberg 8y ago
  Supermicro While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard. We are not aware of any customer dropping Supermicro as a supplier for this type of issue. Every major corporation in today’s security climate is constantly responding to threats and evolving their security posture. As part of that effort we are in regular contact with a variety of vendors, industry partners and government agencies sharing information on threats, best practices and new tools. This is standard practice in the industry today. However, we have not been in contact with any government agency regarding the issues you raised. Furthermore, Supermicro doesn’t design or manufacture networking chips or the associated firmware and we, as well as other leading server/storage companies, procure them from the same leading networking companies.
- fuddle 8y ago
  supermicro.com is down for me: "This site can’t be reached"
  - pixl97 8y ago
    Try www.supermicro.com. With the www it didn't work for me.
neom 8y ago
As someone on a slack server I use pointed out: a server wouldn't need to phone home, could have a planned failure and request an RMA, even if the system was wiped when it came back, it could have data stored somewhere secretly, and why you may not find anything in an audit.
- reitanqild 8y ago
  AFAIK that wouldn't work against Amazon as IIRC hardware doesn't leave their datacenters without being shredded first.
  - NullPrefix 8y ago
    So no hardware warranty repairs?
    - reitanqild 8y ago
      AFAIK, no. It was presented as one of many things Amazon does to keep AWS safe at an AWS day I attended or something.
whydoineedthis 8y ago
Bloomberg reported that the startup I worked for was for sale and the founders were pitching it to potential buyers. Internally, they vehemently denied the report and said Bloomberg completely made it up. Bloomberg was dead on the money. That's not to say every journalist/article they publish is going to be spot on, but I definitely give them enough credit that I will believe this report until proven unequivocally not true by the accused. edit: spelling.
- Jackim 8y ago
  I think you might mean "unequivocally"
  - whydoineedthis 8y ago
    Thank you. Spell check didn't give it to me and I was too lazy to Google it.
- berberous 8y ago
  A CEO shopping a private startup has every incentive to lie to his employees in that scenario and little reason not to. On the other hand, Apple and Amazon have huge reasons not to blatantly lie about this. The plaintiffs bar would be all over both companies for material false and misleading statements if this turned out to be true (see also Elon's recent experiences with the SEC). Apple and Amazon are certainly incentivized to not admit bad facts, to spin facts, to issue misleading unclear statements that read as a denial but are not, etc. But I really don't think the legal teams at either company would let executives get away with issuing such full-throated and clear denials if they were untrue.
  - whydoineedthis 8y ago
    yeeaaah...on the other hand, they could be pulling a hat trick from the FCC playbook. "I had no idea it was legitimate users leaving feedback and the guy I trusted to inform me no longer works here. I was told everything was fine!" Plausible deniability goes a long way when you have enough money/political support or are "too big to fail". It happens. Often.
throwaway5752 8y ago
Certainly not saying this didn't happen, or creating a false dichotomy that a nation-state has to be a friend or foe.. but evaluate this in the context of: https://talkingpointsmemo.com/edblog/white-house-begins-the-china-counter-narrative https://talkingpointsmemo.com/edblog/white-house-begins-the-... (in case people get the feeling that this story is being pushed, or feel like it's coming out of nowhere suspiciously close to an election)
- rwc 8y ago
  Stories like this take many, many months of research -- particularly a story as detailed as the Bloomberg. I don't think it's fair to the journalists to simply explain the story away as a government-led conspiracy to mislead voters in the midterm elections.
- calyth2018 8y ago
  The US has placed camera in Xerox copy machines that were used in the USSR embassy before, so it's not surprising at all for hardware hacks. w The difference in this case is definitely scale.
mnglkhn2 8y ago
But I thought that the "current" economic thinking states that production should move wherever the work is cheaper?! /s
sgwealti 8y ago
What if Apple or Amazon didn't find the chips but other investigators found them in Apple/Amazon servers. That would make their denial wording technically true. They didn't say no chips were found, they just said they didn't find any.
lacker 8y ago
It does not seem like this story is true. If it's true, it makes absolutely no sense for Apple and Amazon to attack Bloomberg. Sure, a national security letter could force them to stay quiet, or maybe even to lie to the public and say it didn't happen, but it can't make them criticize Bloomberg. Attacking Bloomberg if the story is true is only going to convince Bloomberg to dig deeper. And the story isn't even that bad for Amazon or Apple - it's much worse for US-China relations than it is for either of those companies. The key technical detail of what these chips are allegedly doing also does not make sense. From the article: the chips allowed the attackers to create a stealth doorway into any network that included the altered machines How can you get around a firewall by using a compromised machine that's part of the internal network? I don't think Bloomberg reporters are just making stuff up. But the technical confusion here makes me suspect that the government officials who leaked this story just didn't understand the details of a real incident that happened, and in the leaking the story got mangled into inaccuracy.
- bubblethink 8y ago
  I find the lack of real technical information quite surprising, not just on bloomberg, but here as well. The previous big thread that you can scroll endlessly has anecdotes and chit-chat but nothing on the actual technical details.
- QuinnyPig 8y ago
  It goes beyond that. If this story were in fact true, what we're witnessing is large companies whose entire business is built upon user trust setting fire to themselves. Who'd ever trust AWS again with anything of consequence if it turns out the denial is false? I don't buy it as written. There's something else here.
  - deleted 8y ago
    [deleted]
  - addicted 8y ago
    What would lead to more of a loss of trust? Revealing to your customers that you hid a massive hack for a few years (even if the government required you to) or insisting that Bloomberg is lying, when you know all the other relevant players will also insist on the same.
la6470 8y ago
https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/ https://aws.amazon.com/blogs/security/setting-the-record-str...
propman 8y ago
For major major reports like this, reputed newspapers are rarely wrong. See WSJ John Crareyou of Theranos. Theranos vehemently denied it, MSM was with Theranos and at least they weren’t outright against them. Then they did more digging etc. The Washpo digging on Roy Moore, the NYT digging on Clinton Foundation, etc. these are experienced reporters having 15-30 credible sources, evidence etc. every time this happens, everyone denies and slowly little by little the story finds more evidence and facts and it becomes true. This is why a free press is soooo important Why would Apple disclose that millions of their products could be hacked and you’ve lost all your privacy. Who would trust them? They’d lose billions, regulations would come etc. it’s in the best interest for every party to deny.
- stochastic_monk 8y ago
  How much of an individual user’s data has been compromised? As far as I understand, as long as you’re not using iCloud, you’re pretty well-protected. Is that inaccurate?
- 40acres 8y ago
  Agreed, I think you've stated your point better than I have further down in the thread based on my down votes. The American press is not perfect, but over the years I've been really impressed with the journalistic skill of our major publishers. Just this week the New York Times had an extensive story regarding the president's tax returns, they claim to have access to hundreds of thousands of documents and spoke to dozens of sources. I'm more inclined to believe Bloomberg's journalistic integrity than the denials of Apple, Amazon and China.
  - JumpCrisscross 8y ago
    Didn't Apple and/or Amazon (EDIT: not Amazon) categorically deny being involved in PRISM until Snowden's slides showed that to be false?
    - shshhdhs 8y ago
      Apple was listed on the PRISM slides but not Amazon. https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)#/media/File%3APrism_slide_5.jpg https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)...
tristanj 8y ago
Regarding Apple's denial, there are other publications that corroborate the Bloomberg story. Previously, Apple has denied security incidents even when multiple outlets report it. For example, last year, The Information reported Apple discovered malware on Super Micro servers in their development and production environments [1]. As a result, the Information claimed that Apple ended up terminating its relationship with Super Micro. In response to the report, an Apple spokesperson denied there was a security incident, stating: "We’re not aware of any data being transmitted to an unauthorized party nor was any infected firmware found on the servers purchased from this vendor." However, based on sources from within Apple, Ars Technica claimed Apple employees did find compromised firmware in Apple's design lab. Super Micro SVP of Technology also reported Apple terminated its relationship with them. I believe we are seeing the same situation here. [1] https://arstechnica.com/information-technology/2017/02/apple-axed-supermicro-servers-from-datacenters-because-of-bad-firmware-update/ https://arstechnica.com/information-technology/2017/02/apple...
- IBM 8y ago
  Apple's denial references that report.
  - tristanj 8y ago
    Which makes it more curious. Last year, Apple PR denied existence of the security incident, but today they admitted it actually happened. That is a contradiction.
    - ralfd 8y ago
      No contradiction. Read it closely: The old statement said that no infected firmware was found on servers purchased from supermicro, meaning freshly purchased servers delivered from supermicro were clean. The ArsTechnica clarifies in an update to the article that the infected driver was installed later. The new statement says: "That one-time event was determined to be accidental and not a targeted attack against Apple."
  - loufe 8y ago
space00 8y ago
It remind me another security risk "Google's new hardware security key was made by a Chinese company" https://www.cnbc.com/2018/08/30/google-titan-made-by-chinese-company-feitian.html https://www.cnbc.com/2018/08/30/google-titan-made-by-chinese...
edoo 8y ago
This is this is similar to all the backdoored Cisco devices the FBI found all over the government. If they are doing it at all they would have a complex plan and this would be one of the many approaches. Even scarier IMHO are the CPU fabrication hacks that add in an imperceptible backdoor directly in the chip logic. A recent report showed how CPUs can be backdoored at critical points in the fabrication process by a single operator that would be incredibly hard to detect. We are talking instruction patterns that charge capacitor buffers that allow privileged access once a threshold is reached. Amazing really.
deleted 8y ago
[deleted]
wgerard 8y ago
"But in my experience, Apple PR does not lie. Do they spin the truth in ways that favor the company? Of course. That’s their job. But they don’t lie, because they understand that one of Apple’s key assets is its credibility. They’d say nothing before they’d lie." As a few people pointed out in the other thread, didn't they pretty explicitly deny they were involved with PRISM?
- mercutio2 8y ago
  PRISM was an NSA-internal codename for a really innocuous automation of servicing legal warrants. Apple knew nothing about anything they were told was called PRISM, and they happily acknowledged the existence of APIs to service warrants.
- astrange 8y ago
  PRISM was an internal service for saving responses to subpoenas. Subpoenas do actually exist and everyone is happy to admit to them. They even publish reports about it.
baq 8y ago
there's a comment on r/sysadmin that's quite chilling, implying that the state of affairs is far worse than what the report describes: https://www.reddit.com/r/sysadmin/comments/9layb7/from_bloomberg_how_china_used_a_tiny_chip_to/e75rwc8 https://www.reddit.com/r/sysadmin/comments/9layb7/from_bloom... I did a penetration test and security assessment for a major electronics manufacturer whose parts are likely in every smartphone and laptop. I identified almost certain compromise by the Chinese government with full access to modify the manufacturing specs using the access paths I identified. They chose to bury my findings as it would cause a huge stock hit. Sadly, NDA. I'm not surprised in the slightest.
- wyldfire 8y ago
  Hard to give an anonymous comment any weight without the slightest verification. Since we know that adversaries of freedom use social media as a disinformation vector, the only thing you can do is ignore them or encourage them to find a way to legitimately disclose the information protected under NDA -- perhaps to the press or a legislator who could help make it possible to invalidate NDAs that keep secrets that make us vulnerable.
  - baq 8y ago
    I agree that panic is ill advised and trust should be given carefully, but if Bloomberg is to be believed, then it happened at least once - and if it did happen once, it's very likely that it happened more than once, because why not? Most organizations don't have resources to find a backdoor like that, nor they have a reason to search for one (had no reason until today I should say) and in this case we only heard about it because of multiple leaks to the press from government officials.
rajekas 8y ago
Amazon bids for CIA contracts; Elemental bids for Amazon's contracts; Super Micro bids for Elemental's contracts and the PLA "bids" for Super Micro's contracts. Looks like Ouroboros, the global supply chain episode.
swsieber 8y ago
This reaction from Amazon / Apple is reasonable if Bloomberg is lying. This reaction also seems reasonable if Bloomberg was telling the true.
wyldfire 8y ago
> not much bigger than a grain of rice, that wasn’t part of the boards’ original design. 'original design' is hard to verify without help from SuperMicro. > Amazon reported the discovery to U.S. authorities, sending a shudder through the intelligence community. ... especially for Amazon. Unless Bloomberg claims here that Amazon got parts of this SKU and compared them to newer parts of the SKU and found differences? Is it legit to revise your design in terms of changes to passives without rev'ing the part and notifying downstream supply chain. Could the grain-of-rice 'microchip' be a different or new resistor/cap? Could it be logic masquerading as a passive? > In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. Like a passive in a blind/buried via? Anyways, for everyone who claims "it can't be done", "this is implausible" -- you're probably being a little naive. US intelligence agencies do shipment interdiction and adulterate products for this purpose, [1] why couldn't/shouldn't China do the same? [1] https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal...
AJRF 8y ago
Gruber is like that kid that defends his older brother and it comes across as pathetic and needy
Animats 8y ago
OK. So what's the minimum remote system management capability needed in a modern data center? The major cloud sysadmin people should figure this out, write a spec, and insist that's all that goes in. If Amazon AWS and Google wrote a spec for this, the manufacturers would fall into line. Boards are shipping with way too much remote access capability. It's not like you need to look at system busses via the network. You're not going to debug a broken board remotely, you're going to turn it off and replace it. Now that this is an identified problem, it's time to put IPMI and its ilk back in its cage.
xte 8y ago
For me it's IRRELEVANT in the report is true or not, the very relevant part is that today's hw is complex enough to be a black box for 99% of buyers so it pose a super-serious security risk. Strong article from publicly known sources are a way to shed the light on such ignored enormous security threat. The sole solution IMVHO is IMPOSE open hardware and free software by law. We simply can't have our society "nervous system" run on black boxes. It doesn't matter if the rouge in charge is China, USA, a specific vendor or someone else. Our banks, our states, our hospitals, ... relay on such connected black boxes. We also need to re-transfer knowledge from big corporate to PUBLIC, well founded, universities to AVOID dangerous evolution paths like actual IT evolution.
- dvfjsdhgfv 8y ago
  The problem is, the only ones who care about such a solution are (some of) end users, like us. All the rest, including big money, including governments, seems to prefer black boxes.
- CSEThrowaway 8y ago
  You are welcome to write the software for systems you describe and release it for free. Unfortunately, the economic model of the real world is a little more complicated than you seem to realize.
  - tobltobs 8y ago
    Tell this Linus.
    - CSEThrowaway 8y ago
      I love open source software and use it every day. I also donate to organizations who contribute to that community. My issue with OP's proposal, rather, was that those who create software and hardware should be forced to release it for free.
      - bubblethink 8y ago
jaclaz 8y ago
As a side note/question. I have no idea how things actually work in companies like Apple or Amazon, but would it be "normal" (at their size/scale and given their surely advanced knowledge in technology) to have inspections on the hardware they use (inspections at hardware level of the kind capable of showing these modifications)? I mean do they routinely do these checks?
- laurentl 8y ago
  I had the same question when I read the article. It sure was lucky that both Apple and Amazon checked the hardware and found the impossible to find chip. Or, assuming the rest of the article is true, someone somewhere found out about the chip and had a quiet word with a few select customers of Supermicro (but decided to otherwise keep mum about the whole thing). Which would go some way to explain the company denials, because the truth might be a bit embarrassing —or gagged by a three-letter agency.
saudioger 8y ago
>But they don’t lie, because they understand that one of Apple’s key assets is its credibility. They’d say nothing before they’d lie. This is so typical of Gruber as an evangelist. There's no way that Apple would remain silent on this even if they KNEW it were true. The only possible move is denial. Silence is validation or uncertainty, a statement of ambiguity will tank the stock and reputation as experts, recognition of even partial truth could possibly destroy their supply lines overnight. I honestly think the corporate denials here need to be outright ignored because they have so much to lose. A story of this magnitude is basically like pointing a gun to someone's head and asking them for permission to pull the trigger.
- fermienrico 8y ago
  I see Apple and Amazon has a tremendous incentive to lie. What incentive do you see for Bloomberg to report a major story and lie!? Why would they do that?
  - saudioger 8y ago
    You can theorize all sorts of conspiracies, like the government planting the story to distance China... so it's possible Bloomberg was mislead. I think at this point it's more believable the story is true, because Bloomberg is the most credible participant at this point... they're anonymous sources, but as long as Bloomberg did their due diligence as journalists, they've validated their (numerous) sources as credible. ...and like you said, all these corporations have MASSIVE amounts to lose. Just check out what Trend Micro's stock is doing today.
    - fermienrico 8y ago
      That's exactly my point. They have MASSIVE amounts to lose - that's why they don't want to admit that their datacenters are compromised. Super Micro's stock is down -41%.
  - jrnichols 8y ago
    > What incentive do you see for Bloomberg to report a major story and lie!? Why would they do that? just like all of their other stories on Apple products/etc that have been wrong - page clicks and ad revenue. Writing about Apple gets you both. the WSJ is in the same boat. Quoting vague "sources briefed on the matter" is just mysterious enough to keep the reader on the hook for more. I haven't trusted Bloomberg to report anything accurate about Apple for years now.
vthallam 8y ago
> The White House requested periodic updates as information came in, the person familiar with the discussions says. You can't make this up, at least not in Bloomberg, that too in a front page or cover page write up. Truth could be somewhere in between and I am sure we will have more information in the coming weeks.
getcollc 8y ago
Is this the tiny chip bloomberg is refering to? Maybe they shorted a bunch of aapl and amzn, I'd suggest SEC to investigate the editor who wrote up this crap https://www.digikey.jp/product-detail/en/tdk-corporation/HHM1522B1/445-3987-1-ND/1955584?cur=JPY&lang=en https://www.digikey.jp/product-detail/en/tdk-corporation/HHM...
morpheuskafka 8y ago
The US needs to make electronics supply chain sovereignty the number one priority of the federal defense budget. Why are we fighting useless drone wars when our country is being attacked on a daily basis in the cyber realm? If this story is true, it will be an escalation clearly and willfully by the PRC from mere state-sanctioned economic espionage to an act of war against the US.
an0n404 8y ago
A little suspect when they say " giving them access to the most sensitive code even on machines that have crashed or are turned off." When it is turned off? A magical chip that works without electricity is much more valuable than any data which could be exfiltrated from servers. A chip that works without power changes the world more than the iPhone... in the iPhone Age
getcollc 8y ago
https://www.reuters.com/article/us-china-cyber-dhs-idUSKCN1MH00Y https://www.reuters.com/article/us-china-cyber-dhs-idUSKCN1M... So what happens to the reporter then?
directtt 8y ago
Now with the annoucement from the Homeland Security Department of the US, it's very clear, even to a kid, that Bloomberg is lying. The question is should the authors, Jordan Robertson and Michael Riley, get punishment for creating this fake story? They have already created damages. And they may also have some, let's try some conspiracy, motivation in favor of the Trump's gov... since the report is "very conveniently" appeared on the same day of Pence's speech.

281 points by okket 8y ago

Can National Security Letters can be used to require companies to issue outright lies to the public? The bloomberg article indicates that the investigation is not complete, so that could be on explanation for the apparent disconnect between a seemingly well-reported story and the unsually forceful denials.

close04 8y ago
I would say not. If the outcome of the investigation is that they were hacked and knew they open themselves up to all sorts of litigation. What's stopping someone to sue after buying stock under the assumption that the companies are sound? I assume they have a duty to the shareholders.
burlesona 8y ago
That's what I was wondering too.
ProAm 8y ago
No but the gov might be unhappy that the secret is out while they were trying to use the chips to infiltrate/reverse engineer wherever the chips were reporting to? Amazon has gov contracts it wants to protect so Im not surprised they would deny this at the govs request, and Apple's #1 product is privacy so having something like this show up on their servers would undermine that product strategy so I can understand their denial too (homegrown or at the govs request)
- thebooglebooski 8y ago
  This seems like the most likely reason for domestic companies to deny everything, and for their supply chain distributors to play along. 1) Big company partners with distributor. 2) Distributor has security issues. 3) Gov is already aware of security issues, says nothing. 4) Big company becomes aware of issues. 5)Gov steps in and pitches a deal: i)Both big company and distributor must deny. ii)In return, gov gets to: iii)Preserve any existing contracts iv)Protect the big company and distributor, with any legal, trade, or commercial benefits
- drawkbox 8y ago
  > Amazon has gov contracts it wants to protect so Im not surprised they would deny this at the govs request, and Apple's #1 product is privacy so having something like this show up on their servers would undermine that product strategy so I can understand their denial too Additionally, Amazon and Apple are two of the still allowed to compete western companies in China that they haven't booted out of their markets, it could be that Amazon and Apple also want to retain the Chinese market and don't want to appear like they are helping while they have the cover of the NSL. Amazon and Apple are caught in a tough spot and the hardware issue/espionage device is definitely true. It is probably just that the people that know in the company aren't allowed to say and the PR team is not part of that 'need to know' group. Either way, trust of Chinese manufacturing is over, which hits Apple very hard in both market and domestic trust.
paulgb 8y ago
Today's Money Stuff ponders another angle of this: whether those companies would be committed securities fraud by abiding by such a request: > I do not think that the securities laws explicitly allow companies to make false statements of material fact if required for national security, but you could see giving them a pass here. https://www.bloomberg.com/view/articles/2018-10-04/computer-spies-hacked-reality https://www.bloomberg.com/view/articles/2018-10-04/computer-...
- adventured 8y ago
  What if the story is bigger than Bloomberg or anyone else publicly knows at this point? That is, if the government turned over this rock and found something worse. The US Government could easily find it in its self-interest to make a deal, involving the SEC, on a national security basis, to allow Amazon and Apple to go the denial route with the US Government giving them guarantees regarding fallout. If it's worse than Bloomberg has reported, it would be highly desirable by the US Government to keep the rest as quiet as possible for as long as possible, to get at as much of what China is doing as possible. They might be running a counter intel program by now that relies on something China was doing.
  - fermienrico 8y ago
    What you're talking about is fantasy. "The US Government could easily find it in its self-interest to make a deal, involving the SEC, on a national security basis, to allow Amazon and Apple to go the denial route with the US Government giving them guarantees regarding fallout." Can you point out a legal mechanism for this to be possible?
    - Varcht 8y ago
      Unofficially, the policy is called "Too Big to Fail".
heartbreak 8y ago
> But in my experience, Apple PR does not lie. Do they spin the truth in ways that favor the company? Of course. That’s their job. But they don’t lie, because they understand that one of Apple’s key assets is its credibility. They’d say nothing before they’d lie.
- microtherion 8y ago
  "Saying nothing" is indeed an extremely common move for Apple PR. "An Apple spokesperson declined to comment" is such a proverbial reaction that it would be considered completely standard operating practice here.
Gokenstein 8y ago
What's more likely is someone on the inside of one of these companies was privy to the discovery, but not the follow up. I've been in such a situation myself where I was in the room during what LOOKED like a DDOS by Akamai 10 minutes after we got off the phone with them to turn down their CDN services. In much the same way as Apple is refuting this claim, after a few weeks of internal debate above our pay grade we decided we didn't see it and it didn't exist and therefore it didn't.
moduspol 8y ago
Perhaps these things aren't handled at the level of "company"? For a national security-related issue, you might just include the minimum number of people that need to know, which would naturally not include your PR team. Then when an article like this comes out, the PR team responds in exactly the way they would if it were an outright fabrication, which is what the goal would be.
- dguaraglia 8y ago
  Even though this could be the case (that the security team is under a gag order and the marketing/PR team don't know about it), I'm pretty sure a "no comment" response from security would signal the PR team to maybe downplay the whole thing. The active refusal is a bit too strong for just being a miscommunication.
  - minxomat 8y ago
    NSL-type deals are explicitly denied. E.g. Apple wrote: > Finally, in response to questions we have received from other news organizations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.
wyldfire 8y ago
If the US files injunctions for relief, federal court (FISA) justices can probably compel you to do just about anything. Presumably the Bill of Rights still pertains and takes precedent. But it's not ludicrous to think that you could be compelled to issue a denial or not issue an affirmation of the public claims.
- notatoad 8y ago
  I'm pretty sure FISA has no relation to any of this.

peignoir 8y ago

A lot more coming from this news for sure, but kudos to whoever found these, that's solid tech due diligence!

Taniwha 8y ago
I'm still waiting for technically literate description - as an electrical engineer I don't know what a "signal conditioning coupler" is - searching DigiKey doesn't find anything under that name - it's not a "common" part, at least in my experience. The part looks like an RF filter look-alike of some sort. But that would normally be hooked into a power rail (and ground) - kind of hard to insert signals into a data line unless it was wired strangely So tell us what the part is pretending to be and how exactly it it was wired (and what it was connected to - is this another Intel ME backdoor?)
- deleted 8y ago
  [deleted]

40acres 8y ago

This back and forth between Bloomberg and Amazon/Apple reminds me of the recent allegations against Supreme Court nominee Kavanaugh. In both situations it's difficult to identify who is telling the truth and is probably impossible to know the truth from the outside looking in. In both cases I've taken a "who has incentive to lie?" view on the allegations and denials, now this does not mean my hunch is correct at all, but it seems way more likely to me that it's in the best interest of Apple and Amazon to deny this story strongly as it makes both parties look bad and the investigation may be ongoing. I don't believe that Bloomberg made this story up but its understandable to question that maybe their sourcing was iffy, based on Bloomberg's history and the level of sourcing that they have cited I'm leaning towards believing the story as accurate.

ProAm 8y ago
Didnt all the companies lie about working with the NSA before the Snowden revelations?
- lern_too_spel 8y ago
  No. Snowden's documents show they worked with the FBI, which we already knew and the companies have always admitted to.
  - ProAm 8y ago
    This article shows different: "Blanket denials from Microsoft, Google, and Facebook -- and efforts to clear their names -- are the opposite of what AT&T and Verizon did in response to reports saying they opened their systems to the National Security Agency. " [1] [1] https://www.cnet.com/news/nsa-surveillance-retrospective-at-t-verizon-never-denied-it/ https://www.cnet.com/news/nsa-surveillance-retrospective-at-...
    - lern_too_spel 8y ago
      As I said in my earlier post, those denials are accurate according to Snowden's documents. They integrated with the FBI to process court ordered user data requests. They obviously would have no knowledge of a downstream NSA data processing system or its code name. Your article itself says that the initial reporting was incorrect and links to https://www.cnet.com/news/no-evidence-of-nsas-direct-access-to-tech-companies/ https://www.cnet.com/news/no-evidence-of-nsas-direct-access-... which correctly explains how PRISM is an NSA system that processes court ordered electronic wiretaps obtained by the FBI.

_trampeltier 8y ago

Still no statement from supermicro. Nothing on Twitter. Nothing on the website. That's a kind of strange after the stock price droped so much.

excalibur 8y ago
Yeah there is: https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
- _trampeltier 8y ago
  True, but still, I would like to see a statement on the website or on twitter.
jedberg 8y ago
Supermicro While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard. We are not aware of any customer dropping Supermicro as a supplier for this type of issue. Every major corporation in today’s security climate is constantly responding to threats and evolving their security posture. As part of that effort we are in regular contact with a variety of vendors, industry partners and government agencies sharing information on threats, best practices and new tools. This is standard practice in the industry today. However, we have not been in contact with any government agency regarding the issues you raised. Furthermore, Supermicro doesn’t design or manufacture networking chips or the associated firmware and we, as well as other leading server/storage companies, procure them from the same leading networking companies.
fuddle 8y ago
supermicro.com is down for me: "This site can’t be reached"
- pixl97 8y ago
  Try www.supermicro.com. With the www it didn't work for me.

neom 8y ago

As someone on a slack server I use pointed out: a server wouldn't need to phone home, could have a planned failure and request an RMA, even if the system was wiped when it came back, it could have data stored somewhere secretly, and why you may not find anything in an audit.

reitanqild 8y ago
AFAIK that wouldn't work against Amazon as IIRC hardware doesn't leave their datacenters without being shredded first.
- NullPrefix 8y ago
  So no hardware warranty repairs?
  - reitanqild 8y ago
    AFAIK, no. It was presented as one of many things Amazon does to keep AWS safe at an AWS day I attended or something.

whydoineedthis 8y ago

Bloomberg reported that the startup I worked for was for sale and the founders were pitching it to potential buyers. Internally, they vehemently denied the report and said Bloomberg completely made it up. Bloomberg was dead on the money. That's not to say every journalist/article they publish is going to be spot on, but I definitely give them enough credit that I will believe this report until proven unequivocally not true by the accused. edit: spelling.

Jackim 8y ago
I think you might mean "unequivocally"
- whydoineedthis 8y ago
  Thank you. Spell check didn't give it to me and I was too lazy to Google it.
berberous 8y ago
A CEO shopping a private startup has every incentive to lie to his employees in that scenario and little reason not to. On the other hand, Apple and Amazon have huge reasons not to blatantly lie about this. The plaintiffs bar would be all over both companies for material false and misleading statements if this turned out to be true (see also Elon's recent experiences with the SEC). Apple and Amazon are certainly incentivized to not admit bad facts, to spin facts, to issue misleading unclear statements that read as a denial but are not, etc. But I really don't think the legal teams at either company would let executives get away with issuing such full-throated and clear denials if they were untrue.
- whydoineedthis 8y ago
  yeeaaah...on the other hand, they could be pulling a hat trick from the FCC playbook. "I had no idea it was legitimate users leaving feedback and the guy I trusted to inform me no longer works here. I was told everything was fine!" Plausible deniability goes a long way when you have enough money/political support or are "too big to fail". It happens. Often.

throwaway5752 8y ago

Certainly not saying this didn't happen, or creating a false dichotomy that a nation-state has to be a friend or foe.. but evaluate this in the context of: https://talkingpointsmemo.com/edblog/white-house-begins-the-china-counter-narrative https://talkingpointsmemo.com/edblog/white-house-begins-the-... (in case people get the feeling that this story is being pushed, or feel like it's coming out of nowhere suspiciously close to an election)

rwc 8y ago
Stories like this take many, many months of research -- particularly a story as detailed as the Bloomberg. I don't think it's fair to the journalists to simply explain the story away as a government-led conspiracy to mislead voters in the midterm elections.
calyth2018 8y ago
The US has placed camera in Xerox copy machines that were used in the USSR embassy before, so it's not surprising at all for hardware hacks. w The difference in this case is definitely scale.

mnglkhn2 8y ago

But I thought that the "current" economic thinking states that production should move wherever the work is cheaper?! /s

sgwealti 8y ago

What if Apple or Amazon didn't find the chips but other investigators found them in Apple/Amazon servers. That would make their denial wording technically true. They didn't say no chips were found, they just said they didn't find any.

lacker 8y ago

It does not seem like this story is true. If it's true, it makes absolutely no sense for Apple and Amazon to attack Bloomberg. Sure, a national security letter could force them to stay quiet, or maybe even to lie to the public and say it didn't happen, but it can't make them criticize Bloomberg. Attacking Bloomberg if the story is true is only going to convince Bloomberg to dig deeper. And the story isn't even that bad for Amazon or Apple - it's much worse for US-China relations than it is for either of those companies. The key technical detail of what these chips are allegedly doing also does not make sense. From the article: the chips allowed the attackers to create a stealth doorway into any network that included the altered machines How can you get around a firewall by using a compromised machine that's part of the internal network? I don't think Bloomberg reporters are just making stuff up. But the technical confusion here makes me suspect that the government officials who leaked this story just didn't understand the details of a real incident that happened, and in the leaking the story got mangled into inaccuracy.

bubblethink 8y ago
I find the lack of real technical information quite surprising, not just on bloomberg, but here as well. The previous big thread that you can scroll endlessly has anecdotes and chit-chat but nothing on the actual technical details.
QuinnyPig 8y ago
It goes beyond that. If this story were in fact true, what we're witnessing is large companies whose entire business is built upon user trust setting fire to themselves. Who'd ever trust AWS again with anything of consequence if it turns out the denial is false? I don't buy it as written. There's something else here.
- deleted 8y ago
  [deleted]
- addicted 8y ago
  What would lead to more of a loss of trust? Revealing to your customers that you hid a massive hack for a few years (even if the government required you to) or insisting that Bloomberg is lying, when you know all the other relevant players will also insist on the same.

la6470 8y ago

https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/ https://aws.amazon.com/blogs/security/setting-the-record-str...

propman 8y ago

For major major reports like this, reputed newspapers are rarely wrong. See WSJ John Crareyou of Theranos. Theranos vehemently denied it, MSM was with Theranos and at least they weren’t outright against them. Then they did more digging etc. The Washpo digging on Roy Moore, the NYT digging on Clinton Foundation, etc. these are experienced reporters having 15-30 credible sources, evidence etc. every time this happens, everyone denies and slowly little by little the story finds more evidence and facts and it becomes true. This is why a free press is soooo important Why would Apple disclose that millions of their products could be hacked and you’ve lost all your privacy. Who would trust them? They’d lose billions, regulations would come etc. it’s in the best interest for every party to deny.

stochastic_monk 8y ago
How much of an individual user’s data has been compromised? As far as I understand, as long as you’re not using iCloud, you’re pretty well-protected. Is that inaccurate?
40acres 8y ago
Agreed, I think you've stated your point better than I have further down in the thread based on my down votes. The American press is not perfect, but over the years I've been really impressed with the journalistic skill of our major publishers. Just this week the New York Times had an extensive story regarding the president's tax returns, they claim to have access to hundreds of thousands of documents and spoke to dozens of sources. I'm more inclined to believe Bloomberg's journalistic integrity than the denials of Apple, Amazon and China.
- JumpCrisscross 8y ago
  Didn't Apple and/or Amazon (EDIT: not Amazon) categorically deny being involved in PRISM until Snowden's slides showed that to be false?
  - shshhdhs 8y ago
    Apple was listed on the PRISM slides but not Amazon. https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)#/media/File%3APrism_slide_5.jpg https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)...

tristanj 8y ago

Regarding Apple's denial, there are other publications that corroborate the Bloomberg story. Previously, Apple has denied security incidents even when multiple outlets report it. For example, last year, The Information reported Apple discovered malware on Super Micro servers in their development and production environments [1]. As a result, the Information claimed that Apple ended up terminating its relationship with Super Micro. In response to the report, an Apple spokesperson denied there was a security incident, stating: "We’re not aware of any data being transmitted to an unauthorized party nor was any infected firmware found on the servers purchased from this vendor." However, based on sources from within Apple, Ars Technica claimed Apple employees did find compromised firmware in Apple's design lab. Super Micro SVP of Technology also reported Apple terminated its relationship with them. I believe we are seeing the same situation here. [1] https://arstechnica.com/information-technology/2017/02/apple-axed-supermicro-servers-from-datacenters-because-of-bad-firmware-update/ https://arstechnica.com/information-technology/2017/02/apple...

IBM 8y ago
Apple's denial references that report.
- tristanj 8y ago
  Which makes it more curious. Last year, Apple PR denied existence of the security incident, but today they admitted it actually happened. That is a contradiction.
  - ralfd 8y ago
    No contradiction. Read it closely: The old statement said that no infected firmware was found on servers purchased from supermicro, meaning freshly purchased servers delivered from supermicro were clean. The ArsTechnica clarifies in an update to the article that the infected driver was installed later. The new statement says: "That one-time event was determined to be accidental and not a targeted attack against Apple."
- loufe 8y ago

space00 8y ago

It remind me another security risk "Google's new hardware security key was made by a Chinese company" https://www.cnbc.com/2018/08/30/google-titan-made-by-chinese-company-feitian.html https://www.cnbc.com/2018/08/30/google-titan-made-by-chinese...

edoo 8y ago

This is this is similar to all the backdoored Cisco devices the FBI found all over the government. If they are doing it at all they would have a complex plan and this would be one of the many approaches. Even scarier IMHO are the CPU fabrication hacks that add in an imperceptible backdoor directly in the chip logic. A recent report showed how CPUs can be backdoored at critical points in the fabrication process by a single operator that would be incredibly hard to detect. We are talking instruction patterns that charge capacitor buffers that allow privileged access once a threshold is reached. Amazing really.

deleted 8y ago

[deleted]

wgerard 8y ago

"But in my experience, Apple PR does not lie. Do they spin the truth in ways that favor the company? Of course. That’s their job. But they don’t lie, because they understand that one of Apple’s key assets is its credibility. They’d say nothing before they’d lie." As a few people pointed out in the other thread, didn't they pretty explicitly deny they were involved with PRISM?

mercutio2 8y ago
PRISM was an NSA-internal codename for a really innocuous automation of servicing legal warrants. Apple knew nothing about anything they were told was called PRISM, and they happily acknowledged the existence of APIs to service warrants.
astrange 8y ago
PRISM was an internal service for saving responses to subpoenas. Subpoenas do actually exist and everyone is happy to admit to them. They even publish reports about it.

baq 8y ago

there's a comment on r/sysadmin that's quite chilling, implying that the state of affairs is far worse than what the report describes: https://www.reddit.com/r/sysadmin/comments/9layb7/from_bloomberg_how_china_used_a_tiny_chip_to/e75rwc8 https://www.reddit.com/r/sysadmin/comments/9layb7/from_bloom... I did a penetration test and security assessment for a major electronics manufacturer whose parts are likely in every smartphone and laptop. I identified almost certain compromise by the Chinese government with full access to modify the manufacturing specs using the access paths I identified. They chose to bury my findings as it would cause a huge stock hit. Sadly, NDA. I'm not surprised in the slightest.

wyldfire 8y ago
Hard to give an anonymous comment any weight without the slightest verification. Since we know that adversaries of freedom use social media as a disinformation vector, the only thing you can do is ignore them or encourage them to find a way to legitimately disclose the information protected under NDA -- perhaps to the press or a legislator who could help make it possible to invalidate NDAs that keep secrets that make us vulnerable.
- baq 8y ago
  I agree that panic is ill advised and trust should be given carefully, but if Bloomberg is to be believed, then it happened at least once - and if it did happen once, it's very likely that it happened more than once, because why not? Most organizations don't have resources to find a backdoor like that, nor they have a reason to search for one (had no reason until today I should say) and in this case we only heard about it because of multiple leaks to the press from government officials.

rajekas 8y ago

Amazon bids for CIA contracts; Elemental bids for Amazon's contracts; Super Micro bids for Elemental's contracts and the PLA "bids" for Super Micro's contracts. Looks like Ouroboros, the global supply chain episode.

swsieber 8y ago

This reaction from Amazon / Apple is reasonable if Bloomberg is lying. This reaction also seems reasonable if Bloomberg was telling the true.

wyldfire 8y ago

> not much bigger than a grain of rice, that wasn’t part of the boards’ original design. 'original design' is hard to verify without help from SuperMicro. > Amazon reported the discovery to U.S. authorities, sending a shudder through the intelligence community. ... especially for Amazon. Unless Bloomberg claims here that Amazon got parts of this SKU and compared them to newer parts of the SKU and found differences? Is it legit to revise your design in terms of changes to passives without rev'ing the part and notifying downstream supply chain. Could the grain-of-rice 'microchip' be a different or new resistor/cap? Could it be logic masquerading as a passive? > In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. Like a passive in a blind/buried via? Anyways, for everyone who claims "it can't be done", "this is implausible" -- you're probably being a little naive. US intelligence agencies do shipment interdiction and adulterate products for this purpose, [1] why couldn't/shouldn't China do the same? [1] https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal...

AJRF 8y ago

Gruber is like that kid that defends his older brother and it comes across as pathetic and needy

Animats 8y ago

OK. So what's the minimum remote system management capability needed in a modern data center? The major cloud sysadmin people should figure this out, write a spec, and insist that's all that goes in. If Amazon AWS and Google wrote a spec for this, the manufacturers would fall into line. Boards are shipping with way too much remote access capability. It's not like you need to look at system busses via the network. You're not going to debug a broken board remotely, you're going to turn it off and replace it. Now that this is an identified problem, it's time to put IPMI and its ilk back in its cage.

xte 8y ago

For me it's IRRELEVANT in the report is true or not, the very relevant part is that today's hw is complex enough to be a black box for 99% of buyers so it pose a super-serious security risk. Strong article from publicly known sources are a way to shed the light on such ignored enormous security threat. The sole solution IMVHO is IMPOSE open hardware and free software by law. We simply can't have our society "nervous system" run on black boxes. It doesn't matter if the rouge in charge is China, USA, a specific vendor or someone else. Our banks, our states, our hospitals, ... relay on such connected black boxes. We also need to re-transfer knowledge from big corporate to PUBLIC, well founded, universities to AVOID dangerous evolution paths like actual IT evolution.

dvfjsdhgfv 8y ago
The problem is, the only ones who care about such a solution are (some of) end users, like us. All the rest, including big money, including governments, seems to prefer black boxes.
CSEThrowaway 8y ago
You are welcome to write the software for systems you describe and release it for free. Unfortunately, the economic model of the real world is a little more complicated than you seem to realize.
- tobltobs 8y ago
  Tell this Linus.
  - CSEThrowaway 8y ago
    I love open source software and use it every day. I also donate to organizations who contribute to that community. My issue with OP's proposal, rather, was that those who create software and hardware should be forced to release it for free.
    - bubblethink 8y ago

jaclaz 8y ago

As a side note/question. I have no idea how things actually work in companies like Apple or Amazon, but would it be "normal" (at their size/scale and given their surely advanced knowledge in technology) to have inspections on the hardware they use (inspections at hardware level of the kind capable of showing these modifications)? I mean do they routinely do these checks?

laurentl 8y ago
I had the same question when I read the article. It sure was lucky that both Apple and Amazon checked the hardware and found the impossible to find chip. Or, assuming the rest of the article is true, someone somewhere found out about the chip and had a quiet word with a few select customers of Supermicro (but decided to otherwise keep mum about the whole thing). Which would go some way to explain the company denials, because the truth might be a bit embarrassing —or gagged by a three-letter agency.

saudioger 8y ago

>But they don’t lie, because they understand that one of Apple’s key assets is its credibility. They’d say nothing before they’d lie. This is so typical of Gruber as an evangelist. There's no way that Apple would remain silent on this even if they KNEW it were true. The only possible move is denial. Silence is validation or uncertainty, a statement of ambiguity will tank the stock and reputation as experts, recognition of even partial truth could possibly destroy their supply lines overnight. I honestly think the corporate denials here need to be outright ignored because they have so much to lose. A story of this magnitude is basically like pointing a gun to someone's head and asking them for permission to pull the trigger.

fermienrico 8y ago
I see Apple and Amazon has a tremendous incentive to lie. What incentive do you see for Bloomberg to report a major story and lie!? Why would they do that?
- saudioger 8y ago
  You can theorize all sorts of conspiracies, like the government planting the story to distance China... so it's possible Bloomberg was mislead. I think at this point it's more believable the story is true, because Bloomberg is the most credible participant at this point... they're anonymous sources, but as long as Bloomberg did their due diligence as journalists, they've validated their (numerous) sources as credible. ...and like you said, all these corporations have MASSIVE amounts to lose. Just check out what Trend Micro's stock is doing today.
  - fermienrico 8y ago
    That's exactly my point. They have MASSIVE amounts to lose - that's why they don't want to admit that their datacenters are compromised. Super Micro's stock is down -41%.
- jrnichols 8y ago
  > What incentive do you see for Bloomberg to report a major story and lie!? Why would they do that? just like all of their other stories on Apple products/etc that have been wrong - page clicks and ad revenue. Writing about Apple gets you both. the WSJ is in the same boat. Quoting vague "sources briefed on the matter" is just mysterious enough to keep the reader on the hook for more. I haven't trusted Bloomberg to report anything accurate about Apple for years now.

vthallam 8y ago

> The White House requested periodic updates as information came in, the person familiar with the discussions says. You can't make this up, at least not in Bloomberg, that too in a front page or cover page write up. Truth could be somewhere in between and I am sure we will have more information in the coming weeks.

getcollc 8y ago

Is this the tiny chip bloomberg is refering to? Maybe they shorted a bunch of aapl and amzn, I'd suggest SEC to investigate the editor who wrote up this crap https://www.digikey.jp/product-detail/en/tdk-corporation/HHM1522B1/445-3987-1-ND/1955584?cur=JPY&lang=en https://www.digikey.jp/product-detail/en/tdk-corporation/HHM...

morpheuskafka 8y ago

The US needs to make electronics supply chain sovereignty the number one priority of the federal defense budget. Why are we fighting useless drone wars when our country is being attacked on a daily basis in the cyber realm? If this story is true, it will be an escalation clearly and willfully by the PRC from mere state-sanctioned economic espionage to an act of war against the US.

an0n404 8y ago

A little suspect when they say " giving them access to the most sensitive code even on machines that have crashed or are turned off." When it is turned off? A magical chip that works without electricity is much more valuable than any data which could be exfiltrated from servers. A chip that works without power changes the world more than the iPhone... in the iPhone Age

getcollc 8y ago

https://www.reuters.com/article/us-china-cyber-dhs-idUSKCN1MH00Y https://www.reuters.com/article/us-china-cyber-dhs-idUSKCN1M... So what happens to the reporter then?

directtt 8y ago

Now with the annoucement from the Homeland Security Department of the US, it's very clear, even to a kid, that Bloomberg is lying. The question is should the authors, Jordan Robertson and Michael Riley, get punishment for creating this fake story? They have already created damages. And they may also have some, let's try some conspiracy, motivation in favor of the Trump's gov... since the report is "very conveniently" appeared on the same day of Pence's speech.