12 ms·
UK cyber security agency backs Apple, Amazon China hack denials
- yAnonymous 8y agoOk, it definitely happened.
- deleted 8y ago[deleted]
- justtopost 8y agoDoes it seem a little odd for the 5 eyes to be weighing in while the us gov is silent? I am not sure how to read this but it is weird. I have never seen them make a public statement on a hack in a way specific to specific companies (and not others mentioned in the bloomberg article). Even if taken at face value, it can only mean 2 things. 1. They already, thouroughly investigated it (draw your own conclusions what they found or any involvement) or 2. They just issued an official statement without possibly having the time to investigate the merits of the accusation. This not only doesn't pass the sniff test, its evidince of yet another turd on our lawn.
- JumpCrisscross 8y ago> Does it seem a little odd for the 5 eyes to be weighing in while the us gov is silent? Chances are, American intelligence has been running counterintelligence operations through this network. That leaves lots of people in American intelligence who would prefer this remain a secret, without a similar restriction elsewhere.
- dsfyu404ed 8y agoThe big question is whether it's your neighbor's turd or your neighbor's dog's turd. Re: 1, if they investigated it then that means that "it" was something in the first place thus warranting the investigation. Re: 2, that's the kind of thing you do when you need to inject uncertainty into the situation to buy yourself or your buddies time to tie up loose ends/burn evidence/figure out what story they'll tell the politicians.
- yAnonymous 8y agoWhat if it was the 5 eyes who are responsible in the first place (knowing that the targeted services are used all over the world) and now they want to a) officially deny anything happend b) unofficially shift the blame to China Whatever happens, my popcorn is ready.
- mattlondon 8y agoOr, 3rd option, they did it (not china) and are trying to play it down as a non-event. "Nothing to see here - move along!" while thinking of a new means to hide this stuff in the server hardware...
- kryogen1c 8y agoI don't think this is feasible. They are 100% going to get caught with this tactic. If they were guilty in the way you guess, I think the likely response would be to muddy the waters with FUD and create lots of confusion.
- 7000skeletons 8y ago"Trust me, we know a thing or two about adding malicious chips to systems." - GCHQ, probably
- beaker52 8y agoIt could also be possible that these companies are legally bound by some sort of investigation-related order to maintain ignorance to the presence of the chips and that Bloomberg have just sunk an ongoing investigation/counter-espionage operation, potentially putting an associated intelligence network at risk.
- sschueller 8y agoThis seems preposterous to me. We are not in China here.
- chatmasta 8y agoThere is plenty of precedent for the US government issuing national security letters (“NSLs”) containing gag orders for ongoing investigations, often with massive monetary penalties imposed for violations.
- sschueller 8y agoApple with the largest pockets and very positive ratings would be the one that could make a stance against such draconian laws.
- chatmasta 8y agoUnless the fine is implemented as a percent of revenue, market cap or the like. Similarly, the US government once threatened to fine Yahoo $250k per day for non-compliance with PRISM. [0] As an aside, what do you think is draconian about such a law? It seems like there are reasonable arguments for why it would be in the national best interest to keep an ongoing investigation classified. In fact it seems like an unusually straight forward application of the cliche justification “for national security reasons.” [0] https://news.ycombinator.com/item?id=8305925 https://news.ycombinator.com/item?id=8305925
- sschueller 8y ago
- sorokod 8y ago“We are aware of the media reports but at this stage have no reason to doubt the detailed assessments made by AWS and Apple,” This is a pretty mild statement, would not say it backs Apple and Amazon.
- JdeBP 8y agoYes, it's not really backing them any more than the equally non-committal statement from the Norwegian National Security Authority is. The Reuters headline is not borne out by its article. * https://news.ycombinator.com/item?id=18146242 https://news.ycombinator.com/item?id=18146242
- SyneRyder 8y agoAustralia's Department of Defence also has a rather vague statement in response: "Defence will continue to work with the ACSC [Australian Cyber Security Centre] to continue to monitor the situation," the spokesperson said. http://www.abc.net.au/news/science/2018-10-05/supermicro-malicious-chips-china-australian-government/10342006 http://www.abc.net.au/news/science/2018-10-05/supermicro-mal...
- deleted 8y ago[deleted]
- TheOtherHobbes 8y agoIt's not the UK's job to back Apple and Amazon. "We have no reason to doubt" is not a weasel statement. "At this stage" is a weasel statement, but only in the sense that it means "We haven't investigated this or seen any evidence ourselves, and until we do we'll go with the line taken by Apple and AWS." This can be taken as meaning "The US has given us details and asked us to deny them" - which makes no sense, IMO. Or "The US has given us no details" - which is rather more likely.
- tedunangst 8y agoNobody said it was a weasel statement. Nobody said it was their job to back these companies. The claim is that, counter to the title, they have not backed these companies.
- hhh 8y agoIf I might don the tinfoil cap, this is a mighty fine time to bring negative light onto CN, with Dragonfly stirring the pot and a testimony from Google's CEO next month.
- kerng 8y agoIf Bloomberg has something here (which is not unlikely) it shows how incredibly important a free press is!
- mtgx 8y agoI'm not sure this is necessarily a point in Apple and Amazon's favor. Also, as another comment here mentions, the "backing" in the title seems stronger than GCHQ's actual statement.
- howard941 8y agoA cowworker remarked to me earlier today that the denials don't matter, true or false the story serves a domestic US purpose in distracting from $OTHERNEWS (in this case the kavenaugh circus)
- wlll 8y ago"Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server." According to Apple. If I were cynical, and I am, I could see that Apple aren't telling the whole truth here. If you don't want to find malicious chips in your servers, don't look. Just destroy the ones you suspect and don't examine them.
- akerro 8y agoIs it possible that the article on Bloomberg was state sponsored and there is no backdoored chip under another chip?
- phkahler 8y agoWhy would they say anything at all?
- rasz 8y agoAgency spying on Amnesty International, G20 summit, tapping undersea cables (INCENSER https://arstechnica.com/tech-policy/2014/11/new-snowden-docs-gchqs-ties-to-telco-gave-spies-global-surveillance-reach/ https://arstechnica.com/tech-policy/2014/11/new-snowden-docs...), with _multiple_ courts pronouncing their data collection programs violated human rights https://venturebeat.com/2015/02/06/nsa-and-gchq-collusion-on-internet-surveillance-was-unlawful-says-u-k-court/ https://venturebeat.com/2015/02/06/nsa-and-gchq-collusion-on... https://www.theguardian.com/uk-news/2018/sep/13/gchq-data-collection-violated-human-rights-strasbourg-court-rules https://www.theguardian.com/uk-news/2018/sep/13/gchq-data-co...) wouldnt lie to us!
- sjcsjc 8y agoGCHQ saying it's not true makes me far more inclined to believe it.
- keehun 8y agoJust to clarify your sentence, do you mean "far more inclined to believe China did spy on Apple/Amazon, etc"? Or you're far more inclined to believe Apple/Amazon, etc?
- wetpaws 8y agoLike many people here, I did not believe this until they started denying it so much.
- sorokod 8y agoThe actual quotes in Reuters article: “We are aware of the media reports but at this stage have no reason to doubt the detailed assessments made by AWS and Apple,” "The NCSC engages confidentially with security researchers and urges anybody with credible intelligence about these reports to contact us" This is not backing.
- teknologist 8y agoEasy to say if they cleaned up the evidence. What's convenient about recalling servers is that they're all neatly lined up in racks in datacenters, making them easy to pull out and replace. Supermicro would have lists of affected serial numbers, allowing them to take them back and make sure there aren't any samples lingering around for independent analysis.
- wyldfire 8y agoI heard this on NPR [1] and thought it was interesting and hadn't seen it in these articles on HN: > When [Bloomberg] asked China's foreign ministry for a response, a lot of times they'll say things like, you're crazy; we know nothing about this. Their response was a little more nuanced and contextual in the environment we're in now. Basically they said, we are a victim of these kinds of attacks, too. And, you know, they're right. The U.S. government - it's very, very good at these kinds of hardware attacks. Supporting evidence for Bloomberg's claim: NSA interdiction of US export shipments [2]. [1] https://www.npr.org/2018/10/04/654518383/bloomberg-reporter-outlines-how-chinese-microchips-infiltrated-nearly-30-u-s-com https://www.npr.org/2018/10/04/654518383/bloomberg-reporter-... [2] https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal...
- stephengillie 8y agoAre you saying the NSA bribed manufacturers in China to add these to boards - so Americans would discover then and accuse the Chinese government of espionage? Is this the stick to the tariff's carrot? Remember, astronauts couldn't have met aliens on the moon, if the moon landings were faked.
- nkrisc 8y ago> Remember, astronauts couldn't have met aliens on the moon, if the moon landings were faked. Now that's a debate I'd pay to watch.
- deleted 8y ago[deleted]
- rqs 8y agoOr maybe just those manufacturers doing their online shopping and accidentally bought those kind of comprised chips. Yes, you can actually buy the similar looking chip on Taobao.com by searching HHM1523C1[0] or HHM1526[1]. Some vendors even claims the chips they're selling are "Imported, 100% legit". And, of course there can be another interpretation: We (China) bugged your server, because you (the U.S.) bugged ours first. The water is so muddy right now, maybe wait for more information? [0] https://s.taobao.com/search?q=HHM1523C1 https://s.taobao.com/search?q=HHM1523C1 [1] https://s.taobao.com/search?q=HHM1526 https://s.taobao.com/search?q=HHM1526
- stretchwithme 8y agoIt seems unlikely that Amazon would not detect attempts to reach unauthorized IP addresses. If you’ve used AWS security groups, you know that you can specify what IP ranges your machines can access. While many customers aren’t locking this access down, I’m fairly certain Amazon knows exactly what they are doing on the AWS systems they use. Detecting such attempts on a brand new system would spur them to identify the source. They’d have found that chip, most likely.
- rconti 8y agoVirtually any halfway competent enterprise would catch this as well. This is network security 101.
- andy_ppp 8y agoI think there is another plausible reason for denials of course. The chip might not be Chinese.
- supergirl 8y agothat would actually explain the strong denials and involvement of UK spy agency. being caught with NSA chips in servers would be far worse for Apple than with chinese chips.
- zeist 8y agoI am pretty sure some security issues did happened else supermicro would have definitely sued the reporters by now. But then the mild response by US government and the FBI in general means that the so called attack wasn't as sophisticated as claimed by Bloomberg.
- richsherwood 8y agoOn the other side of the coin, it’s possible that they have a vested interest in keep in this quiet as it would bring attention to their own practices.
- we1 8y agoCan confirm. My boost mobile iPhone 6 had weird memory signatures. Most likely Chinese malicious chips.
- torgian 8y agoFunny how this story comes out shortly after Apple announced you can’t fully repair the newest MacBook pros and iMac pros without their software for “security sake”. Coincidence? Yeah probably, and very tin-foil hat, but who knows?
- rasz 8y agoThere is a TON of counterfeit Apple service parts on the market. This is the result of the only real source of parts being pulls from recycled units, and Apple has this neat "recycle initiative" requiring subcontractors SHRED everything and provide detailed protocols of destruction. Most counterfeits differ in lower quality, not gorilla gorilla glass, lower brightness not quite actual white backlight, non IPS IPS LCDs, 7 year old 4 times repackaged "brand new" batteries etc. There are also replacements with straight up fake, dummy plastic parts thrown in, for example https://www.youtube.com/watch?v=TalLpLWaOV4 https://www.youtube.com/watch?v=TalLpLWaOV4. It becomes real brand problem when Staples "fixes" your product using scam parts.
- torgian 8y agoBut there are also a ton of people using real or just as good parts to repair their macs. Those people, who can’t afford a non-warranty repair at Apple, will be hurt the most. It’s especially true in east Asia. Yes, there are plenty of counterfeits, but there are also plenty of legitimate ones too.