9 ms·

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has y

by Jerry2 8y ago

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community") as a way to scare technology companies from doing business in China? Someone at the SEC should scrutinize SMCI shorts at the very least.

peterlk 8y ago
To be clear, there is a very real threat of China embedding chips that do "bad things" inside chips that are sold to the US (source: I once worked on a government contract and saw such chips - they were, to my knowledge, unrelated to this specific case). I'm not sure where that points, but there are strong motivations at play.
- cm2187 8y ago
  Not the least because since Snowden we know the NSA does it.
- xiphias2 8y ago
  The key is ,,inside chips''. There's no reason to do those bad things on the die using an extra chip, as it's too easy to prove.
AdequateLobster 8y ago
Well, did you expect any of those companies to acknowledge their own incompetence? And do you seriously think Businessweek can make all this up out of thin air?
notatoad 8y ago
It's certainly beginning to look like Bloomberg got played. I don't know what the motivation would be for Bloomberg to deliberately deceive readers, but I can't help notice that the article came out at roughly the same time as Mike Pence was giving a speech whose central premise was that China is meddling in american politics, and all the attention currently focused on Russian hacking should be focused on Chinese hacking. If this story actually is false the US government has plenty of incentive to have planted it.
- kristofferR 8y ago
  Did you miss the other hacking news from yesterday? https://www.cnbc.com/2018/10/04/doj-charges-7-russian-intelligence-operatives-with-hacking.html https://www.cnbc.com/2018/10/04/doj-charges-7-russian-intell...
- jnbiche 8y ago
  But go read the Chinese response. It certainly looks like a non-denial to me. Pretty much says, "yeah, it was us, but US is doing the same to us". The full statement can be found at the link below, but the take-away is pretty much this quote from the statement: "Supply chain safety in cyberspace is an issue of common concern, and China is also a victim." https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
guywhocodes 8y ago
I'm not convinced which story is strictly the correct one yet but I don't think the strength of the denial is an argument for either. It just shows that it's important that your narrative wins, truth or not.
- hrktb 8y ago
  The burden of proof should be on the side pushing the accusations. In that sense, Apple’s denial puts it squarely back to Bloomberg to prove it’s not bulshit. Until then it would be fair to discard their narrative.
  - jtbayly 8y ago
    Hmmm... Sort of like Kavanaugh.
mikekchar 8y ago
My general response whenever there is something like this: Look at the past stories by the reporter. Bloomberg handily lists them for you. https://www.bloomberg.com/authors/AQrv1y2ieI0/jordan-robertson https://www.bloomberg.com/authors/AQrv1y2ieI0/jordan-roberts... Take a look at those stories in the strong light of being able to see them in retrospect and decide for yourself if this reporter is prone to going to press without a full understanding of the situation. I have my opinion, but it's best for people to form their own.
- matchagaucho 8y ago
  hmmm... definitely a trend of reporting on hacks. And perhaps with sensationalist clickbait headlines. But they are confirmed hacks (Equifax, FB, Cambridge Analytica).
  - deleted 8y ago
    [deleted]
- matt4077 8y ago
  The headlines are somewhat over-the-top, but none of those articles show examples of them deliberately making up a story. I wouldn't read it, because they seem to repeatedly overstate the possible impact of their stories. But if you work in the space, or are the victim of an attack, this thread-level-orange style of writing may feel entirely appropriate. It's no different than, say, insinuating that something is wrong with <x>. But instead of clearly explaining the criticism, to "let smart people figure it out for themselves". That's the laziest conspiracy sales tactic, and it exploits peoples' insecurities by tying the carrot ("I'm one of the smart ones!") to the stick of accepting whatever theory is being peddled.
- jnbiche 8y ago
  In this case, there's relatively little ground for misunderstanding or exaggeration. There's either a malicious chip or there's not. I suppose in the "worst case" scenario, there could be a malicious chip, but some other government than the Chinese put it there. However, reading the statement from the Chinese government in response to this story, which never actually denies the incident and instead complains about being victim to such hardware hacking themselves, that's not the impression I get: https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
nacho2sweet 8y ago
Straight up some hardware/embedded nerd that posts on here would have one of these chips in the wild and already have posted a hardware break down blog post under a microscope of one. They kinda seem like a Tom Clancy fantasy. But I dunno.
raverbashing 8y ago
> Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations. That to me is the icing on the cake. Companies are usually not direct like that. (Unless this is some kind of new NDA that allows/mandates itself to be denied)
matchagaucho 8y ago
"before servers are put into production at Apple they are inspected for security vulnerabilities" A chip smaller than a grain of rice nested between motherboard layers. What tools could detect such a chip? While I don't doubt Apple inspects, the zero-day threat always exists.
- baybal2 8y ago
  Xray inspection by a human specialist
  - sterlind 8y ago
    Further in the article, Bloomberg mentions a chip, smaller than a pencil tip, sandwiched inside the PCB itself, under other traces. That seems bananas difficult to pull off, but could x-ray inspection find such a thing if it existed?
    - baybal2 8y ago
      I specifically mention non-automatic inspection as automatic one may well not have the "paranoid mode," unlike a human who specifically told to go over every individual square millimetre.
      - matchagaucho 8y ago
        Minimum quantity orders for these servers are typically 10,000. Even at 1,000, I don't see how humans could reliably detect this.
    - minxomat 8y ago
      Yes, because the incident they reference was a mid-PCB-layer chip discovered by govt agencies using X-rays. The findings were presented at a private conference in Virginia. Sources who attended said "they've seen the xray pictures" etc.
sterlind 8y ago
Remember when Clapper gave the "least untruthful answer possible" about domestic bulk collection? [0] It's naive to think Apple and Amazon couldn't lie in response to the article, if the intelligence was highly-classified. They may be under extremely strict gag orders (e.g. "give no response whatsoever, including silence, other than denial") and protected by promises of indemnity, as telcos were in the wake of the NSA disclosures. Bloomberg is exquisitely specific and detailed about the chip, including photos and placement (on the baseboard management bridge, disguised as a shielding element.) There's two possibilities, then: someone cajoled dozens of officials across several companies to lie to Bloomberg, or the tech companies have been cajoled into lying. Either way, the proof is in the pudding: every hardware pentesting shop will be going after these boards like they're looking for golden tickets. Either we'll get our die shot, or Bloomberg's getting their pants sued off. 0. https://m.youtube.com/watch?v=Jkb5FKlETqY https://m.youtube.com/watch?v=Jkb5FKlETqY
- tinus_hn 8y ago
  I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order, if there also is the option of not addressing it at all.
  - michaelt 8y ago
    I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order I've always thought such denials are pointless. You think everyone at Google knows every secret gag order they're under? Of course not, that would get leaked within minutes. If I was the NSA I'd find a "patriotic" mid-level or junior employee with the power I wanted to subvert, and give them a gagging order that stopped them telling their boss. That way the Google PR can honestly say that the CEO and legal team haven't seen or heard of a gagging order.
    - sct202 8y ago
      I think it would be odd then if no one else in the company is aware of the issue that those mid/junior level employees would then leak the information to Bloomberg during an active investigation.
deleted 8y ago
[deleted]
wanderingjew 8y ago
The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers. It's also about the worst possible way to drop and 0-day, but whatever.
- darawk 8y ago
  Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.
  - AstralStorm 8y ago
    Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.
    - darawk 8y ago
      It's still an odd strategic move though. They could get caught in the lie, in which case they would both be exposed to pretty serious legal and financial trouble.
    - eloff 8y ago
      Replacing the hardware would be cheap compared to the hit they could take getting caught in such an outright lie. Public companies have obligations to their shareholders not to lie about things like this. They're opening themselves up to lawsuits.
captainmuon 8y ago
Another option is the attacker has those companies "by the balls". They knew that the supply chain was completely compromized, and has been for a while. Admitting this, after so much time, is financial suicide in the best case. Maybe the companies are even being blackmailed by the attackers. Another twist, maybe someone in the government does not want this to come out officially, because they would be forced to take action against China. On the other hand, maybe this is exactly what the government wants, so they "leak" this information - be it true or false - on purpose. In the end, the world is so messed up currently that every conspiracy theory seems to be equally plausible.
- creaghpatr 8y ago
  Puts these somewhat irrational Trump claims from July into context? *This is speculation/conspiracy, but if they've been looking into this for years, I could see the Trump admin using this as leverage to bring Apple manufacturing and/or offshore cash back to the US in exchange for covering up this alleged national security issue. >https://www.businessinsider.com/trump-claims-again-apple-is-building-plants-in-united-states-2018-7 https://www.businessinsider.com/trump-claims-again-apple-is-...
StriverGuy 8y ago
Why do you so blindly believe amzn/aapl over bloomberg? You do realize that reputation is a huge part of success, particularly in the security and hardware space. Of course amazon and apple will deny this story. For starters, they are probably under a gag order from the government to not leak anything regarding their findings since the investigation is still ongoing. Secondly, it is of no benefit to admit they failed in oversite on their side with this one.
liftbigweights 8y ago
It is very odd. If there was any truth to the story, I wouldn't expect such strong denial from apple and amazon. There has been a noticable uptick in anti-chinese news lately, particularly on business oriented news ( cnbc, bloomberg, fox business, et al ). Obviously some elements of the government or power structure has instructed them to do so. But why? Also, if the IC wanted to put pressure on tech companies, wouldn't they just contact apple and amazon directly. Maybe there is a rift within the IC with one group being pro-china and another being anti-china? Or is the IC and news companies done targeting social media tech companies and switching their attention to regular tech companies? Just have to wait and see.

by Jerry2 8y ago

peterlk 8y ago

To be clear, there is a very real threat of China embedding chips that do "bad things" inside chips that are sold to the US (source: I once worked on a government contract and saw such chips - they were, to my knowledge, unrelated to this specific case). I'm not sure where that points, but there are strong motivations at play.

cm2187 8y ago
Not the least because since Snowden we know the NSA does it.
xiphias2 8y ago
The key is ,,inside chips''. There's no reason to do those bad things on the die using an extra chip, as it's too easy to prove.

AdequateLobster 8y ago

Well, did you expect any of those companies to acknowledge their own incompetence? And do you seriously think Businessweek can make all this up out of thin air?

notatoad 8y ago

It's certainly beginning to look like Bloomberg got played. I don't know what the motivation would be for Bloomberg to deliberately deceive readers, but I can't help notice that the article came out at roughly the same time as Mike Pence was giving a speech whose central premise was that China is meddling in american politics, and all the attention currently focused on Russian hacking should be focused on Chinese hacking. If this story actually is false the US government has plenty of incentive to have planted it.

kristofferR 8y ago
Did you miss the other hacking news from yesterday? https://www.cnbc.com/2018/10/04/doj-charges-7-russian-intelligence-operatives-with-hacking.html https://www.cnbc.com/2018/10/04/doj-charges-7-russian-intell...
jnbiche 8y ago
But go read the Chinese response. It certainly looks like a non-denial to me. Pretty much says, "yeah, it was us, but US is doing the same to us". The full statement can be found at the link below, but the take-away is pretty much this quote from the statement: "Supply chain safety in cyberspace is an issue of common concern, and China is also a victim." https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...

guywhocodes 8y ago

I'm not convinced which story is strictly the correct one yet but I don't think the strength of the denial is an argument for either. It just shows that it's important that your narrative wins, truth or not.

hrktb 8y ago
The burden of proof should be on the side pushing the accusations. In that sense, Apple’s denial puts it squarely back to Bloomberg to prove it’s not bulshit. Until then it would be fair to discard their narrative.
- jtbayly 8y ago
  Hmmm... Sort of like Kavanaugh.

mikekchar 8y ago

My general response whenever there is something like this: Look at the past stories by the reporter. Bloomberg handily lists them for you. https://www.bloomberg.com/authors/AQrv1y2ieI0/jordan-robertson https://www.bloomberg.com/authors/AQrv1y2ieI0/jordan-roberts... Take a look at those stories in the strong light of being able to see them in retrospect and decide for yourself if this reporter is prone to going to press without a full understanding of the situation. I have my opinion, but it's best for people to form their own.

matchagaucho 8y ago
hmmm... definitely a trend of reporting on hacks. And perhaps with sensationalist clickbait headlines. But they are confirmed hacks (Equifax, FB, Cambridge Analytica).
- deleted 8y ago
  [deleted]
matt4077 8y ago
The headlines are somewhat over-the-top, but none of those articles show examples of them deliberately making up a story. I wouldn't read it, because they seem to repeatedly overstate the possible impact of their stories. But if you work in the space, or are the victim of an attack, this thread-level-orange style of writing may feel entirely appropriate. It's no different than, say, insinuating that something is wrong with <x>. But instead of clearly explaining the criticism, to "let smart people figure it out for themselves". That's the laziest conspiracy sales tactic, and it exploits peoples' insecurities by tying the carrot ("I'm one of the smart ones!") to the stick of accepting whatever theory is being peddled.
jnbiche 8y ago
In this case, there's relatively little ground for misunderstanding or exaggeration. There's either a malicious chip or there's not. I suppose in the "worst case" scenario, there could be a malicious chip, but some other government than the Chinese put it there. However, reading the statement from the Chinese government in response to this story, which never actually denies the incident and instead complains about being victim to such hardware hacking themselves, that's not the impression I get: https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...

nacho2sweet 8y ago

Straight up some hardware/embedded nerd that posts on here would have one of these chips in the wild and already have posted a hardware break down blog post under a microscope of one. They kinda seem like a Tom Clancy fantasy. But I dunno.

raverbashing 8y ago

> Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations. That to me is the icing on the cake. Companies are usually not direct like that. (Unless this is some kind of new NDA that allows/mandates itself to be denied)

matchagaucho 8y ago

"before servers are put into production at Apple they are inspected for security vulnerabilities" A chip smaller than a grain of rice nested between motherboard layers. What tools could detect such a chip? While I don't doubt Apple inspects, the zero-day threat always exists.

baybal2 8y ago
Xray inspection by a human specialist
- sterlind 8y ago
  Further in the article, Bloomberg mentions a chip, smaller than a pencil tip, sandwiched inside the PCB itself, under other traces. That seems bananas difficult to pull off, but could x-ray inspection find such a thing if it existed?
  - baybal2 8y ago
    I specifically mention non-automatic inspection as automatic one may well not have the "paranoid mode," unlike a human who specifically told to go over every individual square millimetre.
    - matchagaucho 8y ago
      Minimum quantity orders for these servers are typically 10,000. Even at 1,000, I don't see how humans could reliably detect this.
  - minxomat 8y ago
    Yes, because the incident they reference was a mid-PCB-layer chip discovered by govt agencies using X-rays. The findings were presented at a private conference in Virginia. Sources who attended said "they've seen the xray pictures" etc.

sterlind 8y ago

Remember when Clapper gave the "least untruthful answer possible" about domestic bulk collection? [0] It's naive to think Apple and Amazon couldn't lie in response to the article, if the intelligence was highly-classified. They may be under extremely strict gag orders (e.g. "give no response whatsoever, including silence, other than denial") and protected by promises of indemnity, as telcos were in the wake of the NSA disclosures. Bloomberg is exquisitely specific and detailed about the chip, including photos and placement (on the baseboard management bridge, disguised as a shielding element.) There's two possibilities, then: someone cajoled dozens of officials across several companies to lie to Bloomberg, or the tech companies have been cajoled into lying. Either way, the proof is in the pudding: every hardware pentesting shop will be going after these boards like they're looking for golden tickets. Either we'll get our die shot, or Bloomberg's getting their pants sued off. 0. https://m.youtube.com/watch?v=Jkb5FKlETqY https://m.youtube.com/watch?v=Jkb5FKlETqY

tinus_hn 8y ago
I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order, if there also is the option of not addressing it at all.
- michaelt 8y ago
  I think there is no way they would claim they are not under any gag order if they were forced to never confirm such an order I've always thought such denials are pointless. You think everyone at Google knows every secret gag order they're under? Of course not, that would get leaked within minutes. If I was the NSA I'd find a "patriotic" mid-level or junior employee with the power I wanted to subvert, and give them a gagging order that stopped them telling their boss. That way the Google PR can honestly say that the CEO and legal team haven't seen or heard of a gagging order.
  - sct202 8y ago
    I think it would be odd then if no one else in the company is aware of the issue that those mid/junior level employees would then leak the information to Bloomberg during an active investigation.

deleted 8y ago

[deleted]

wanderingjew 8y ago

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers. It's also about the worst possible way to drop and 0-day, but whatever.

darawk 8y ago
Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.
- AstralStorm 8y ago
  Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.
  - darawk 8y ago
    It's still an odd strategic move though. They could get caught in the lie, in which case they would both be exposed to pretty serious legal and financial trouble.
  - eloff 8y ago
    Replacing the hardware would be cheap compared to the hit they could take getting caught in such an outright lie. Public companies have obligations to their shareholders not to lie about things like this. They're opening themselves up to lawsuits.

captainmuon 8y ago

Another option is the attacker has those companies "by the balls". They knew that the supply chain was completely compromized, and has been for a while. Admitting this, after so much time, is financial suicide in the best case. Maybe the companies are even being blackmailed by the attackers. Another twist, maybe someone in the government does not want this to come out officially, because they would be forced to take action against China. On the other hand, maybe this is exactly what the government wants, so they "leak" this information - be it true or false - on purpose. In the end, the world is so messed up currently that every conspiracy theory seems to be equally plausible.

creaghpatr 8y ago
Puts these somewhat irrational Trump claims from July into context? *This is speculation/conspiracy, but if they've been looking into this for years, I could see the Trump admin using this as leverage to bring Apple manufacturing and/or offshore cash back to the US in exchange for covering up this alleged national security issue. >https://www.businessinsider.com/trump-claims-again-apple-is-building-plants-in-united-states-2018-7 https://www.businessinsider.com/trump-claims-again-apple-is-...

StriverGuy 8y ago

Why do you so blindly believe amzn/aapl over bloomberg? You do realize that reputation is a huge part of success, particularly in the security and hardware space. Of course amazon and apple will deny this story. For starters, they are probably under a gag order from the government to not leak anything regarding their findings since the investigation is still ongoing. Secondly, it is of no benefit to admit they failed in oversite on their side with this one.

liftbigweights 8y ago

It is very odd. If there was any truth to the story, I wouldn't expect such strong denial from apple and amazon. There has been a noticable uptick in anti-chinese news lately, particularly on business oriented news ( cnbc, bloomberg, fox business, et al ). Obviously some elements of the government or power structure has instructed them to do so. But why? Also, if the IC wanted to put pressure on tech companies, wouldn't they just contact apple and amazon directly. Maybe there is a rift within the IC with one group being pro-china and another being anti-china? Or is the IC and news companies done targeting social media tech companies and switching their attention to regular tech companies? Just have to wait and see.