11 ms·

I think the attacks are real. A year ago, Google announced their Titan firmware security chip[1], which would limit these kinds of attacks. I don't believe the

by uep 8y ago

I think the attacks are real. A year ago, Google announced their Titan firmware security chip[1], which would limit these kinds of attacks. I don't believe they designed and built this chip, and surrounding infrastructure, because of purely theoretical attacks. Besides that, over the last couple years there has also been a lot of work trying to neuter the Intel ME, because of how dangerous it is. Another example is that Google had also done work to replace the EFI/Intel ME with a Linux kernel [2]. This has limited usefulness against the most recent attack, but it is related (since it's still a chip that has more privileges than the primary CPU). I suspect that there are a very small number of people in these big companies who are aware of these attacks. It's hard for me to guess why the companies involved would deny that these exist. 1. https://www.zdnet.com/article/google-opens-up-on-titan-security-heres-how-chip-combats-hardware-backdoors/ https://www.zdnet.com/article/google-opens-up-on-titan-secur... 2. https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20with%20Linux.pdf https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20wit...

wjnc 8y ago
First guess: not being allowed to admit it due to national security reasons and it being an ongoing investigation. On the same day several Russians were exposed trying to attack OPCW. They were exposed by Dutch military intelligence. At the press briefing the UK ambassador was there. Same day US indicts several Russian spies. This to show that these are major, international events and that proper disclosure towards investors is probably on the back burner as long as operations are continuing. It must be maddening for those involved not to be allowed to discuss it, or even having to actively lie about it while government officials leak freely in the game of thrones.
- lern_too_spel 8y ago
  If they are under a gag order, they would simply not comment on it. Lying about it is never required and puts them at risk for shareholder lawsuits.
  - lozaning 8y ago
    I wonder if there isn't some level of national security super mega secret scenario situation where the government requires companies to do something and the government indemnifies them against all risks associated with the required action.
    - trhway 8y ago
      hasn't it been the case with NSA and carriers all along? http://articles.latimes.com/2012/oct/09/business/la-fi-court-wiretapping-20121010 http://articles.latimes.com/2012/oct/09/business/la-fi-court... "Congress granted retroactive immunity to people or companies aiding U.S. intelligence agents." In this case i'd not be surprised if Google/FB/AMZN/Apple/MS/Supermicro were even part of the CIA/NSA counter-sting - feeding of the false info back to Chinese intelligence through the detected 'mistery' chips.
      - lern_too_spel 8y ago
        The carriers never lied about it. They were provided immunity from criminal lawsuits, not civil lawsuits.
    - rrix2 8y ago
      How does the USG indemnify these companies for the massive breach of trust if that's indeed the case? You can't pay for trust.
    - ryanmarsh 8y ago
      I would be highly surprised if this wasn’t the case.
  - stephenr 8y ago
    Apple specifically states that they are not under any form of gag/confidentiality order/conditions: > Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.
- ryanmarsh 8y ago
  not being allowed to admit it due to national security reasons Came here to say this. When I read Amazon’s rebuttal my gut said “what if these folks had to respond but weren’t allowed to tell the truth?”. If the allegations went unanswered it could be damaging to Amazon and tip the hand of the spooks. If they answered and said they did find the devices the story could run away from them, the internet mob is good at writing articles with “problematic” in the title. Still I think this was a calculated leak. Why? Probably to put pressure on China in negotiations.
  - WillPostForFood 8y ago
    Bloomberg specifically says some of their sources are senior national security officials from the Obama administration, and the conversations date back to the Obama administration. It doesn't make sense they would have been planning this leak for years in anticipation of Trump winning and a trade war with China.
  - ocschwar 8y ago
    Amazon Web Services is the one branch of AMZN that is actually profitable. And the make or break for AWS is the assurance that when you're runnign stuff on one Amazon pizza box, your data are safe even from other users on that same box. You HAVE to get your assurance from Amazon if you're a corporate customer, for due diligence reasons. If that assurance is established to be a lie, every single corporate customer they have would be obliged to migrate to MSFT/RHAT/GOOG or elsewhere. AWS would be dead. I would say it's a calculated leak that happens to be materially false, meant to pressure CHina and kicj Bezos in the shin.
- ABCLAW 8y ago
  I think the NSL angle to the denials is bullshit - the denials themselves give you all you need. Read the denials carefully. They don't say the attacks haven't happened. They say they haven't found a variety of things. The apple denial in particular is interesting as it indicates that they have been corresponding with Bloomberg about this issue for a YEAR. Yet despite the magnitude of contact they refer to, they do not describe the nature of the vulnerability being discussed or refer to specific material elements they've refuted. Their statement regarding Bloomberg's most recent version of the facts isn't on material elements of the story. Having been involved in corporate risk responses I can say I've seen more vehement denials penned with perfect factual accuracy in respect of larger allegations, where the allegations turned out to be true. Almost every statement of defense looks exactly like this, with easy-win half-truth rebuttals to facts peppered around liberally to call the competence of your opposites into question. Edit: inserted a missing word.
  - djrogers 8y ago
    I'm not sure where you're reading the Apple denial you're referring to, but this is *incredibly clear, detailed, and leaves no room to wiggle: "Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement." Also: "If there were ever such an event as Bloomberg News has claimed, we would be forthcoming about it and we would work closely with law enforcement." And: "No one from Apple ever reached out to the FBI about anything like this, and we have never heard from the FBI about an investigation of this kind — much less tried to restrict it." If you read those as not material, then I'm at a loss as to what exactly would convince you.
    - ABCLAW 8y ago
      Those aren't clear at all. They're clear to you because you don't see the weasel wording. "Apple has never found [...]" So what about third parties/reports/partners/contractors? Have they found anything and is Apple aware of those findings? Not disclosed here. Are the QC processes in place sufficient to lead us to believe that Apple would/should have found this issue? etc. If not, who cares if they haven't found it. Before you complain about the semantics, Apple specifically uses the phrasing "We are not aware of any" in respect of investigations, yet they don't use that all-encompassing language in reference to attacks. "malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server" What is a malicious chip - could the inserted piece be classified as non-malicious or simply not a chip? What is a hardware manipulation - are they saying they've literally never found any deviation between spec and what they've received? Why place 'purposely planted' as a qualifying requirement there? "If there were ever such an event as Bloomberg News has claimed, we would be forthcoming about it and we would work closely with law enforcement." They don't indicate what was claimed. They reference a volume of correspondence with a variety of claims instead of the claims. We assume, contextually, that they're referring to the specific chip insertion, but that's not borne out by their statement. "No one from Apple ever reached out to the FBI about anything like this, and we have never heard from the FBI about an investigation of this kind — much less tried to restrict it." This is fully plausible and means nothing. They restrict their denial of contact with the FBI to outgoing, indicate they haven't received notice of an investigation of some kind, which doesn't mean there's no investigation - collaborating with the FBI specifically on this point wouldn't involve the FBI disclosing the full scope of the investigation to them. None of these statements actually deal with the issues claimed. They look like they do, but they don't. Want a real statement? "Upon being notified of the potential issue by Bloomberg this past year, we have analyzed all of the SuperMicro boards referenced to determine if any unauthorized chip insertion occurred and have found none of the alleged inserted chips or any evidence of associated suspicious network activity."
- matt4077 8y ago
  The press release specifically said that they are not under any sort of order preventing any disclosure. And while it is indeed possible for the government to make you stay quiet, forcing you to lie is considered compelled speech, which is a fundamental aspect of current thinking on the 1st Amendment, and not something that is likely to change. No, not even when a three-letter agency wants it. Also nobody at the either the NSA nor Apple cares about the sort of everyday world news you're mentioning. Maybe lay of the Tom Clancy for a while?
hsk0823 8y ago
but where are said chips being made?
devoply 8y ago
I think the attacks are real and if China is doing it then anyone else may be doing it as well including the US.
- alienreborn 8y ago
  Anyone else literally can't because they don't have supply chain advantage that China has.
  - PeterisP 8y ago
    Not anyone else, but there certainly are other nations with similar capabilities. USA is one of them - China is best suited for inserting "extra hardware" on a board as in this example, but if you'd want to insert similar functionality as some extra stuff in an existing chip, then USA could arguably do it easier than China. Also, South Korea and Taiwan have immense role in the supply chain and can do similar large scale things as China. However, yes, the lack of supply chain influence does make similar attacks much more difficult for a bunch of actors which are otherwise active in tech security area - Russia, Israel, North Korea, UK, etc.
    - est 8y ago
      > then USA could arguably do it easier than China USA would be easier to modify servers shipping to US, target specifically at datacenters. China needs to guess which batch of the contract manufacturing motherboard would go. It would be risky to leak the board tamper to everyone.
  - hiccuphippo 8y ago
    But can't they take advantage of the vulnerability created by the chips, without caring about who put them there?
  - golem14 8y ago
    5 eyes/Taiwan/some others could do in on the chip level I guess. Who knows what’s in the me or really all the SOCs...
dsdsdsds2 8y ago
I would really hope that this will give all the RISC-V open source effort some traction in the server / DC market. Certainly big corporations like Google, Facebook, Amazon and others could pull it off.
- samat 8y ago
  What’s the difference if that open source risc is manufactured in the same Chinese plant?
  - Cyph0n 8y ago
    More likely a fab in Taiwan than China. You can run your RISC-V cores on an FPGA if you’re really paranoid. Of course, you’d be sacrificing performance.
    - djrogers 8y ago
      It's not the RIC-V cores that would be the concern - 'tis the motherboards, NICs, etc...
      - fkd221 8y ago
        Yeah, so everything would need to be open and manufactured in the US.
        nickpsecurity 8y ago
        We have the fabs for it. Some are owned by defense contractors, too.
        Tempest1981 8y ago
        What if the NSA pressures the manufacturer?
    - throwaway2048 8y ago
      every FPGA is far more closed and secretive about its internals than Intel ever has been about its CPUs.
pasbesoin 8y ago
It's just my opinion, and so I held off saying, yesterday, but: The immediate economic outfall (co-morbid with institutional panic) would be so severe that this aspect alone would represent a national security issue.
- blattimwind 8y ago
  Supermicro stock dipped down to 50 % or so (20->10).
  - duskwuff 8y ago
    Supermicro has been dealing with some accounting irregularities for the last year or so. This news certainly hasn't helped, but they were already in a shaky position. https://www.marketwatch.com/story/super-micros-stock-set-to-be-delisted-as-filing-deadline-wont-be-met-2018-08-22 https://www.marketwatch.com/story/super-micros-stock-set-to-...
    - ryanmarsh 8y ago
      Or that’s a cover story for the dismantling of the spy operation.
    - blattimwind 8y ago
      That drop happened in the last two days, just after the story was published. https://www.bloomberg.com/quote/SMCI:US https://www.bloomberg.com/quote/SMCI:US
  - pasbesoin 8y ago
    I'm not talking about any effect specifically upon Supermicro. And... it's just a hypotheses, assuming news of such an exploit is indeed being suppressed.
    - pasbesoin 8y ago
      "hypothesis" -- sigh
deleted 8y ago
[deleted]
s_kilk 8y ago
> It's hard for me to guess why the companies involved would deny that these exist. My guess is that they know that everyone's confidence in them would crumble. Every business, ever household, everyone, would suddenly be aware that their data is not safe, even in the hands of the ones who say "trust us, we'll keep it safe".
- djrogers 8y ago
  > My guess is that they know that everyone's confidence in them would crumble. Why? Even if this were all true, the sum total of the accusation is that a small number of servers 4 years ago were compromised and Apple's security chops are so good they found a completely never-before-seen hardware attack and stopped it with the help of the FBI - all without any customer data being at risk.
coolspot 8y ago
Also interesting that Apple recently started to switch from Qualcomm to Intel modems. > The modem represents a milestone for Intel in a couple of ways; it is the first chip to be manufactured solely in-house and it is Intel’s first chip to support CDMA and GSM. > Apple’s original plan for the 2018 iPhones, via Nikkei, was for Intel to have exclusivity on modem orders for the first time — amidst its legal disputes with Qualcomm.
- Yoyoyou 8y ago
  Qualcomm was trying to milk Apple too hard.
  - dbuder 8y ago
    Qualcomm is milking us all too hard.
eridius 8y ago
I think these attacks are theoretically real. I don't think these specific instances of the attack as described by Bloomberg are real. The only plausible scenario in which none of Bloomberg, Apple, and Amazon are knowingly lying is one in which only a select few employees at Apple/Amazon knew about this and were talking to the FBI, as you suggested. Except this doesn't make sense. The only way in which a select few employees would know about this and nobody else is if these employees are subject to a gag order. But the only way they could be subject to a gag order is if the government came to them in the first place, said "here's a gag order, now that you have it I'll tell you about the attack". But according to Bloomberg, a random spot check by Apple employees found the chip, and IIRC they said a third-party security audit ordered by Amazon found the chip on the Elemental servers. In both cases, this attack would have been immediately reported up to the highest levels at the company prior to even beginning talks with the FBI. There's no scenario in which an employee at Apple or Amazon was made aware of the attack, reached out to the FBI, and received a gag order, prior to notifying their superiors and having the information make it all the way up to the executive level. Of course, you could claim that Bloomberg was wrong about how the chip was found and right about everything else, but that's not really plausible. Why would they be wrong about that and right about everything else? How would it even be possible for the government to have determined that Apple and Amazon had their hardware compromised without Apple and Amazon's knowing cooperation? The government doesn't have access to these servers, only Apple and Amazon do.
- Muromec 8y ago
  >How would it even be possible for the government to have determined that Apple and Amazon had their hardware compromised without Apple and Amazon's knowing cooperation? By having a spy in Chinese intelligence who sells it, then doing inspection when hardware goes through customs.
  - eridius 8y ago
    Super Micro is a US company. The finished product didn't go through customs. And any individual components that did would have been going to Super Micro, not to Apple or Amazon or any one of the 30 allegedly affected companies.

by uep 8y ago

wjnc 8y ago

First guess: not being allowed to admit it due to national security reasons and it being an ongoing investigation. On the same day several Russians were exposed trying to attack OPCW. They were exposed by Dutch military intelligence. At the press briefing the UK ambassador was there. Same day US indicts several Russian spies. This to show that these are major, international events and that proper disclosure towards investors is probably on the back burner as long as operations are continuing. It must be maddening for those involved not to be allowed to discuss it, or even having to actively lie about it while government officials leak freely in the game of thrones.

lern_too_spel 8y ago
If they are under a gag order, they would simply not comment on it. Lying about it is never required and puts them at risk for shareholder lawsuits.
- lozaning 8y ago
  I wonder if there isn't some level of national security super mega secret scenario situation where the government requires companies to do something and the government indemnifies them against all risks associated with the required action.
  - trhway 8y ago
    hasn't it been the case with NSA and carriers all along? http://articles.latimes.com/2012/oct/09/business/la-fi-court-wiretapping-20121010 http://articles.latimes.com/2012/oct/09/business/la-fi-court... "Congress granted retroactive immunity to people or companies aiding U.S. intelligence agents." In this case i'd not be surprised if Google/FB/AMZN/Apple/MS/Supermicro were even part of the CIA/NSA counter-sting - feeding of the false info back to Chinese intelligence through the detected 'mistery' chips.
    - lern_too_spel 8y ago
      The carriers never lied about it. They were provided immunity from criminal lawsuits, not civil lawsuits.
  - rrix2 8y ago
    How does the USG indemnify these companies for the massive breach of trust if that's indeed the case? You can't pay for trust.
  - ryanmarsh 8y ago
    I would be highly surprised if this wasn’t the case.
- stephenr 8y ago
  Apple specifically states that they are not under any form of gag/confidentiality order/conditions: > Finally, in response to questions we have received from other news organisations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.
ryanmarsh 8y ago
not being allowed to admit it due to national security reasons Came here to say this. When I read Amazon’s rebuttal my gut said “what if these folks had to respond but weren’t allowed to tell the truth?”. If the allegations went unanswered it could be damaging to Amazon and tip the hand of the spooks. If they answered and said they did find the devices the story could run away from them, the internet mob is good at writing articles with “problematic” in the title. Still I think this was a calculated leak. Why? Probably to put pressure on China in negotiations.
- WillPostForFood 8y ago
  Bloomberg specifically says some of their sources are senior national security officials from the Obama administration, and the conversations date back to the Obama administration. It doesn't make sense they would have been planning this leak for years in anticipation of Trump winning and a trade war with China.
- ocschwar 8y ago
  Amazon Web Services is the one branch of AMZN that is actually profitable. And the make or break for AWS is the assurance that when you're runnign stuff on one Amazon pizza box, your data are safe even from other users on that same box. You HAVE to get your assurance from Amazon if you're a corporate customer, for due diligence reasons. If that assurance is established to be a lie, every single corporate customer they have would be obliged to migrate to MSFT/RHAT/GOOG or elsewhere. AWS would be dead. I would say it's a calculated leak that happens to be materially false, meant to pressure CHina and kicj Bezos in the shin.
ABCLAW 8y ago
I think the NSL angle to the denials is bullshit - the denials themselves give you all you need. Read the denials carefully. They don't say the attacks haven't happened. They say they haven't found a variety of things. The apple denial in particular is interesting as it indicates that they have been corresponding with Bloomberg about this issue for a YEAR. Yet despite the magnitude of contact they refer to, they do not describe the nature of the vulnerability being discussed or refer to specific material elements they've refuted. Their statement regarding Bloomberg's most recent version of the facts isn't on material elements of the story. Having been involved in corporate risk responses I can say I've seen more vehement denials penned with perfect factual accuracy in respect of larger allegations, where the allegations turned out to be true. Almost every statement of defense looks exactly like this, with easy-win half-truth rebuttals to facts peppered around liberally to call the competence of your opposites into question. Edit: inserted a missing word.
- djrogers 8y ago
  I'm not sure where you're reading the Apple denial you're referring to, but this is *incredibly clear, detailed, and leaves no room to wiggle: "Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement." Also: "If there were ever such an event as Bloomberg News has claimed, we would be forthcoming about it and we would work closely with law enforcement." And: "No one from Apple ever reached out to the FBI about anything like this, and we have never heard from the FBI about an investigation of this kind — much less tried to restrict it." If you read those as not material, then I'm at a loss as to what exactly would convince you.
  - ABCLAW 8y ago
    Those aren't clear at all. They're clear to you because you don't see the weasel wording. "Apple has never found [...]" So what about third parties/reports/partners/contractors? Have they found anything and is Apple aware of those findings? Not disclosed here. Are the QC processes in place sufficient to lead us to believe that Apple would/should have found this issue? etc. If not, who cares if they haven't found it. Before you complain about the semantics, Apple specifically uses the phrasing "We are not aware of any" in respect of investigations, yet they don't use that all-encompassing language in reference to attacks. "malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server" What is a malicious chip - could the inserted piece be classified as non-malicious or simply not a chip? What is a hardware manipulation - are they saying they've literally never found any deviation between spec and what they've received? Why place 'purposely planted' as a qualifying requirement there? "If there were ever such an event as Bloomberg News has claimed, we would be forthcoming about it and we would work closely with law enforcement." They don't indicate what was claimed. They reference a volume of correspondence with a variety of claims instead of the claims. We assume, contextually, that they're referring to the specific chip insertion, but that's not borne out by their statement. "No one from Apple ever reached out to the FBI about anything like this, and we have never heard from the FBI about an investigation of this kind — much less tried to restrict it." This is fully plausible and means nothing. They restrict their denial of contact with the FBI to outgoing, indicate they haven't received notice of an investigation of some kind, which doesn't mean there's no investigation - collaborating with the FBI specifically on this point wouldn't involve the FBI disclosing the full scope of the investigation to them. None of these statements actually deal with the issues claimed. They look like they do, but they don't. Want a real statement? "Upon being notified of the potential issue by Bloomberg this past year, we have analyzed all of the SuperMicro boards referenced to determine if any unauthorized chip insertion occurred and have found none of the alleged inserted chips or any evidence of associated suspicious network activity."
matt4077 8y ago
The press release specifically said that they are not under any sort of order preventing any disclosure. And while it is indeed possible for the government to make you stay quiet, forcing you to lie is considered compelled speech, which is a fundamental aspect of current thinking on the 1st Amendment, and not something that is likely to change. No, not even when a three-letter agency wants it. Also nobody at the either the NSA nor Apple cares about the sort of everyday world news you're mentioning. Maybe lay of the Tom Clancy for a while?

hsk0823 8y ago

but where are said chips being made?

devoply 8y ago

I think the attacks are real and if China is doing it then anyone else may be doing it as well including the US.

alienreborn 8y ago
Anyone else literally can't because they don't have supply chain advantage that China has.
- PeterisP 8y ago
  Not anyone else, but there certainly are other nations with similar capabilities. USA is one of them - China is best suited for inserting "extra hardware" on a board as in this example, but if you'd want to insert similar functionality as some extra stuff in an existing chip, then USA could arguably do it easier than China. Also, South Korea and Taiwan have immense role in the supply chain and can do similar large scale things as China. However, yes, the lack of supply chain influence does make similar attacks much more difficult for a bunch of actors which are otherwise active in tech security area - Russia, Israel, North Korea, UK, etc.
  - est 8y ago
    > then USA could arguably do it easier than China USA would be easier to modify servers shipping to US, target specifically at datacenters. China needs to guess which batch of the contract manufacturing motherboard would go. It would be risky to leak the board tamper to everyone.
- hiccuphippo 8y ago
  But can't they take advantage of the vulnerability created by the chips, without caring about who put them there?
- golem14 8y ago
  5 eyes/Taiwan/some others could do in on the chip level I guess. Who knows what’s in the me or really all the SOCs...

dsdsdsds2 8y ago

I would really hope that this will give all the RISC-V open source effort some traction in the server / DC market. Certainly big corporations like Google, Facebook, Amazon and others could pull it off.

samat 8y ago
What’s the difference if that open source risc is manufactured in the same Chinese plant?
- Cyph0n 8y ago
  More likely a fab in Taiwan than China. You can run your RISC-V cores on an FPGA if you’re really paranoid. Of course, you’d be sacrificing performance.
  - djrogers 8y ago
    It's not the RIC-V cores that would be the concern - 'tis the motherboards, NICs, etc...
    - fkd221 8y ago
      Yeah, so everything would need to be open and manufactured in the US.
      - nickpsecurity 8y ago
        We have the fabs for it. Some are owned by defense contractors, too.
      - Tempest1981 8y ago
        What if the NSA pressures the manufacturer?
  - throwaway2048 8y ago
    every FPGA is far more closed and secretive about its internals than Intel ever has been about its CPUs.

pasbesoin 8y ago

It's just my opinion, and so I held off saying, yesterday, but: The immediate economic outfall (co-morbid with institutional panic) would be so severe that this aspect alone would represent a national security issue.

blattimwind 8y ago
Supermicro stock dipped down to 50 % or so (20->10).
- duskwuff 8y ago
  Supermicro has been dealing with some accounting irregularities for the last year or so. This news certainly hasn't helped, but they were already in a shaky position. https://www.marketwatch.com/story/super-micros-stock-set-to-be-delisted-as-filing-deadline-wont-be-met-2018-08-22 https://www.marketwatch.com/story/super-micros-stock-set-to-...
  - ryanmarsh 8y ago
    Or that’s a cover story for the dismantling of the spy operation.
  - blattimwind 8y ago
    That drop happened in the last two days, just after the story was published. https://www.bloomberg.com/quote/SMCI:US https://www.bloomberg.com/quote/SMCI:US
- pasbesoin 8y ago
  I'm not talking about any effect specifically upon Supermicro. And... it's just a hypotheses, assuming news of such an exploit is indeed being suppressed.
  - pasbesoin 8y ago
    "hypothesis" -- sigh

deleted 8y ago

[deleted]

s_kilk 8y ago

> It's hard for me to guess why the companies involved would deny that these exist. My guess is that they know that everyone's confidence in them would crumble. Every business, ever household, everyone, would suddenly be aware that their data is not safe, even in the hands of the ones who say "trust us, we'll keep it safe".

djrogers 8y ago
> My guess is that they know that everyone's confidence in them would crumble. Why? Even if this were all true, the sum total of the accusation is that a small number of servers 4 years ago were compromised and Apple's security chops are so good they found a completely never-before-seen hardware attack and stopped it with the help of the FBI - all without any customer data being at risk.

coolspot 8y ago

Also interesting that Apple recently started to switch from Qualcomm to Intel modems. > The modem represents a milestone for Intel in a couple of ways; it is the first chip to be manufactured solely in-house and it is Intel’s first chip to support CDMA and GSM. > Apple’s original plan for the 2018 iPhones, via Nikkei, was for Intel to have exclusivity on modem orders for the first time — amidst its legal disputes with Qualcomm.

Yoyoyou 8y ago
Qualcomm was trying to milk Apple too hard.
- dbuder 8y ago
  Qualcomm is milking us all too hard.

eridius 8y ago

I think these attacks are theoretically real. I don't think these specific instances of the attack as described by Bloomberg are real. The only plausible scenario in which none of Bloomberg, Apple, and Amazon are knowingly lying is one in which only a select few employees at Apple/Amazon knew about this and were talking to the FBI, as you suggested. Except this doesn't make sense. The only way in which a select few employees would know about this and nobody else is if these employees are subject to a gag order. But the only way they could be subject to a gag order is if the government came to them in the first place, said "here's a gag order, now that you have it I'll tell you about the attack". But according to Bloomberg, a random spot check by Apple employees found the chip, and IIRC they said a third-party security audit ordered by Amazon found the chip on the Elemental servers. In both cases, this attack would have been immediately reported up to the highest levels at the company prior to even beginning talks with the FBI. There's no scenario in which an employee at Apple or Amazon was made aware of the attack, reached out to the FBI, and received a gag order, prior to notifying their superiors and having the information make it all the way up to the executive level. Of course, you could claim that Bloomberg was wrong about how the chip was found and right about everything else, but that's not really plausible. Why would they be wrong about that and right about everything else? How would it even be possible for the government to have determined that Apple and Amazon had their hardware compromised without Apple and Amazon's knowing cooperation? The government doesn't have access to these servers, only Apple and Amazon do.

Muromec 8y ago
>How would it even be possible for the government to have determined that Apple and Amazon had their hardware compromised without Apple and Amazon's knowing cooperation? By having a spy in Chinese intelligence who sells it, then doing inspection when hardware goes through customs.
- eridius 8y ago
  Super Micro is a US company. The finished product didn't go through customs. And any individual components that did would have been going to Super Micro, not to Apple or Amazon or any one of the 30 allegedly affected companies.