5 ms·

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers. It's also about the worst possible way to drop and 0-day, but whatever.

darawk 8y ago
Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.
- AstralStorm 8y ago
  Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.
  - darawk 8y ago
    It's still an odd strategic move though. They could get caught in the lie, in which case they would both be exposed to pretty serious legal and financial trouble.
  - eloff 8y ago
    Replacing the hardware would be cheap compared to the hit they could take getting caught in such an outright lie. Public companies have obligations to their shareholders not to lie about things like this. They're opening themselves up to lawsuits.
- Arn_Thor 8y ago
  Their reputations could take a huge hit from this story alone, so a strong denial is the first defense. If they are unaware of any investigation, as they claim, then that makes even more sense.
  - brorfred 8y ago
    The part I don't understand is why Apple would take such a huge PR hit from the story. I way I read it is that they found out about the problem, diagnosed it and replaced all servers all within a very short time. A careful writeup about what happened, what kind of information that might have leaked, and what they do to avoid it in the future would to me be a net PR win at this point. The next question would be how all other customers has acted.
    - kevin_b_er 8y ago
      If Apple were to agree with and state that China is spying on them, then they might face repercussions from the Chinese government on their extensive business interests in China. They make all the stuff there. This is monetary threat to Apple, so lying is within character for a corporation to preserve their business.
      - lordlimecat 8y ago
        If the story were true Apple cannot lie about it publicly like this; the SEC would have their heads. They would have to hedge, "we are investigating Bloomberg's allegations and take security seriously."
        _Tev 8y ago
        I wonder why people on HN take these arguments seriously. You either anger govt that is authoritarian & capable of confiscating your entire production (basically ending your current business) OR You make some half-truth statement (not necessary to be lying, but that does not change the point), and - if everything will be revealed - one agency of democratic govt will be pissed and slap you with big fine. Basically this is big enough to make SEC meaningless.
- _pmf_ 8y ago
  For me, the Apple piece is not as black and white. > "Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple." They deny Bloomberg's specifics, but basically admit that the general attack vector very much works.
  - shawnz 8y ago
    That quote seems to be describing a software attack, not a hardware attack.
okket 8y ago
This also illustrates why hardware implants do not work as a mass infiltration tool. The idea is not getting caught, otherwise risking the whole operation. Implementing a threat like this is counterproductive.
- amelius 8y ago
  Intel ME seems pretty successful though.
  - dvfjsdhgfv 8y ago
    This amazes me. Everyone freaks about the Chinese doing it, whereas we're surrounded by millions of computers doing the same thing - or at least able to - without us even knowing or being able to block it.
    - teknologist 8y ago
      I suppose a big difference is that Intel ME is on the spec sheet, is known about, and is sold as a feature for sysadmins. It's not cool that it's not optional, but it can be switched off.
Theodores 8y ago
> "chinese whispers" Does anyone have a better phrase for this? A Chinese workmate called me out for using that phrase in his presence. Until then I had used the phrase since childhood without thinking that there were connotations and with nobody complaining. However, after that one fateful conversation I did see that my language could be improved. But how? Does anyone have a concise alternative that conveys the same thing without implying anything about how Chinese people communicate in whispers, to get things wrong?
- detaro 8y ago
  Not a native speaker: Does it have additional meaning to the reference to the children's game where everyone whispers to their neighbor, passing a message along? If not, isn't that also known as the "telephone game"?
  - KineticLensman 8y ago
    I was going to reply "I don't know, it's all Greek to me" but then decided that was not a good idea. So, [0] says > Chinese whispers is the British term for what is known as the telephone game in the United States and then lists several other names for the same game. I've also met people who when discussing confusing messages say "send three and fourpence, we're going to a dance", which is a result of 'Chinese whispers' being applied to the input "send reinforcements, we're going to advance". The reference to the pre-decimal coinage ('three and fourpence', i.e. three shillings and four pence, approx £0.17) in this old phrase shows how long the concept has been around in British English (we decimalised in 1971). [0] https://en.wikipedia.org/wiki/Chinese_whispers https://en.wikipedia.org/wiki/Chinese_whispers
- kweks 8y ago
  In France it is the "Arab telephone" !
- ytjohn 8y ago
  I had never even heard the phrase until this thread. A quick google/wikipedia shows me it's the British term for what we in the US call "telephone". I guess I learned something new today. https://en.wikipedia.org/wiki/Chinese_whispers#Etymology https://en.wikipedia.org/wiki/Chinese_whispers#Etymology > As the game is popular among children worldwide, it is also known under various other names depending on locality, such as Russian scandal,[3] whisper down the lane, broken telephone, operator, grapevine, gossip, don't drink the milk, secret message, the messenger game, and pass the message among others.[1] In France, it is called téléphone arabe (Arabic telephone) or téléphone sans fil (wireless telephone).[4][better source needed] In Malaysia, this game is commonly referred to as telefon rosak, which translates to broken telephone. In the United States, the game is known under the name telephone – which in this use is never shortened to the colloquial and more common word phone.

darawk 8y ago

Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.

AstralStorm 8y ago
Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.
- darawk 8y ago
  It's still an odd strategic move though. They could get caught in the lie, in which case they would both be exposed to pretty serious legal and financial trouble.
- eloff 8y ago
  Replacing the hardware would be cheap compared to the hit they could take getting caught in such an outright lie. Public companies have obligations to their shareholders not to lie about things like this. They're opening themselves up to lawsuits.
Arn_Thor 8y ago
Their reputations could take a huge hit from this story alone, so a strong denial is the first defense. If they are unaware of any investigation, as they claim, then that makes even more sense.
- brorfred 8y ago
  The part I don't understand is why Apple would take such a huge PR hit from the story. I way I read it is that they found out about the problem, diagnosed it and replaced all servers all within a very short time. A careful writeup about what happened, what kind of information that might have leaked, and what they do to avoid it in the future would to me be a net PR win at this point. The next question would be how all other customers has acted.
  - kevin_b_er 8y ago
    If Apple were to agree with and state that China is spying on them, then they might face repercussions from the Chinese government on their extensive business interests in China. They make all the stuff there. This is monetary threat to Apple, so lying is within character for a corporation to preserve their business.
    - lordlimecat 8y ago
      If the story were true Apple cannot lie about it publicly like this; the SEC would have their heads. They would have to hedge, "we are investigating Bloomberg's allegations and take security seriously."
      - _Tev 8y ago
        I wonder why people on HN take these arguments seriously. You either anger govt that is authoritarian & capable of confiscating your entire production (basically ending your current business) OR You make some half-truth statement (not necessary to be lying, but that does not change the point), and - if everything will be revealed - one agency of democratic govt will be pissed and slap you with big fine. Basically this is big enough to make SEC meaningless.
_pmf_ 8y ago
For me, the Apple piece is not as black and white. > "Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple." They deny Bloomberg's specifics, but basically admit that the general attack vector very much works.
- shawnz 8y ago
  That quote seems to be describing a software attack, not a hardware attack.

okket 8y ago

This also illustrates why hardware implants do not work as a mass infiltration tool. The idea is not getting caught, otherwise risking the whole operation. Implementing a threat like this is counterproductive.

amelius 8y ago
Intel ME seems pretty successful though.
- dvfjsdhgfv 8y ago
  This amazes me. Everyone freaks about the Chinese doing it, whereas we're surrounded by millions of computers doing the same thing - or at least able to - without us even knowing or being able to block it.
  - teknologist 8y ago
    I suppose a big difference is that Intel ME is on the spec sheet, is known about, and is sold as a feature for sysadmins. It's not cool that it's not optional, but it can be switched off.

Theodores 8y ago

> "chinese whispers" Does anyone have a better phrase for this? A Chinese workmate called me out for using that phrase in his presence. Until then I had used the phrase since childhood without thinking that there were connotations and with nobody complaining. However, after that one fateful conversation I did see that my language could be improved. But how? Does anyone have a concise alternative that conveys the same thing without implying anything about how Chinese people communicate in whispers, to get things wrong?

detaro 8y ago
Not a native speaker: Does it have additional meaning to the reference to the children's game where everyone whispers to their neighbor, passing a message along? If not, isn't that also known as the "telephone game"?
- KineticLensman 8y ago
  I was going to reply "I don't know, it's all Greek to me" but then decided that was not a good idea. So, [0] says > Chinese whispers is the British term for what is known as the telephone game in the United States and then lists several other names for the same game. I've also met people who when discussing confusing messages say "send three and fourpence, we're going to a dance", which is a result of 'Chinese whispers' being applied to the input "send reinforcements, we're going to advance". The reference to the pre-decimal coinage ('three and fourpence', i.e. three shillings and four pence, approx £0.17) in this old phrase shows how long the concept has been around in British English (we decimalised in 1971). [0] https://en.wikipedia.org/wiki/Chinese_whispers https://en.wikipedia.org/wiki/Chinese_whispers
kweks 8y ago
In France it is the "Arab telephone" !
ytjohn 8y ago
I had never even heard the phrase until this thread. A quick google/wikipedia shows me it's the British term for what we in the US call "telephone". I guess I learned something new today. https://en.wikipedia.org/wiki/Chinese_whispers#Etymology https://en.wikipedia.org/wiki/Chinese_whispers#Etymology > As the game is popular among children worldwide, it is also known under various other names depending on locality, such as Russian scandal,[3] whisper down the lane, broken telephone, operator, grapevine, gossip, don't drink the milk, secret message, the messenger game, and pass the message among others.[1] In France, it is called téléphone arabe (Arabic telephone) or téléphone sans fil (wireless telephone).[4][better source needed] In Malaysia, this game is commonly referred to as telefon rosak, which translates to broken telephone. In the United States, the game is known under the name telephone – which in this use is never shortened to the colloquial and more common word phone.