4 ms·

If there was hidden hardware on a bunch of servers, where is the hardware now? Why doesn’t Bloomberg’s sources have the hardware or know which boards they were?

If there was hidden hardware on a bunch of servers, where is the hardware now? Why doesn’t Bloomberg’s sources have the hardware or know which boards they were? Bloomberg provides zero evidence this happaned, outside of their anonymous sources.

FractalParadigm 8y ago
My thoughts exactly. They're making claims that virtually everyone in tech is denying and haven't/can't produce any evidence. Not to mention, if this hardware had been trying to phone home, it's safe to assume it would have set off some kind of an alert at at least one of these places.
- dboreham 8y ago
  To be fair, the article does mention that it set off alerts.
- pmart123 8y ago
  When you read the article, I believe they are alluding to the fact that Apple and Amazon did discover the vunerabilities. “In 2016, Apple informed Supermicro that it was severing their relationship entirely—a decision a spokesman for Apple ascribed in response to Businessweek’s questions to an unrelated and relatively minor security incident.”
  - yonkshi 8y ago
    And Apple's own statement said that the journalist is probably confusion a separate, software based, incident with this incident. https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/ https://www.apple.com/newsroom/2018/10/what-businessweek-got...
- vmchale 8y ago
  > Not to mention, if this hardware had been trying to phone home, it's safe to assume it would have set off some kind of an alert at at least one of these places. Maybe at some big companies, but not anywhere I've worked. I hardly know anyone who audits outgoing traffic with dedicated hardware.
  - brisance 8y ago
    Apple's valuation is >$1 trillion. Is that big enough?
    - deleted 8y ago
      [deleted]
    - RaleyField 8y ago
      > $1 trillion I wonder if there is some magical market cap boundary beyond which companies stop being grossly negligent. We know it's over 200B as Intel somehow never bothered fixing their products for decades, let's hope five times that is big enough.
      - teknologist 8y ago
        Considering Apple just released a $1k+ phone that doesn't charge when plugged in with the screen off, I wouldn't bet on it. (Just search on YouTube)
- caseysoftware 8y ago
  The original article specifically says that they saw odd network behavior and issues with the firmware. If this is all true (?), that's a piece of how they found it.
- perl4ever 8y ago
  Matt Levine wrote in his Thursday column: "...let us consider a hypothetical. What if: 1. Everything in the Businessweek story is true, Chinese spies planted hardware backdoors in computers built and used by major American companies, and the FBI investigated along with those companies and discovered the backdoors. 2. It is a national-security secret and the companies were instructed by the FBI never to acknowledge it. 3. The companies are patriotically but falsely denying the hack."
  - briandear 8y ago
    If it were Apple, they wouldn’t write a categorical denial because once the “truth” leaked, their credibility would be shot for a long time. The standard Apple answer would be “Apple could not be reached for comment.” But no, they went thermonuclear on the denial.
    - sneak 8y ago
      The people hypothetically demanding these denials have gone literally thermonuclear before. It’s an entirely different ball game when you deal with the guys with machine guns.
gthtjtkt 8y ago
> where is the hardware now? How many people at Apple or Amazon have the ability to steal compromised hardware and surreptitiously hand it to a journalist? That seems like a pretty lofty expectation.
ardy42 8y ago
> Why doesn’t Bloomberg’s sources have the hardware or know which boards they were? How do you know Bloomberg's sources don't? They're anonymous, and while they might know about the implants in detail, they may not have the authority to take examples on a public dog and pony show. Also, if they want to keep their anonymity, they probably have to be careful about what gets released in order avoid exposing themselves. For example, if you have a limited-distribution report you want to leak info from, leaking a summary of the report is a lot safer than leaking the report text itself. At a minimum, the latter narrows down the leaker to someone who had physical access to a copy.
- dis-sys 8y ago
  This is as stupid as saying Xinhua/Caixin have anonymous sources with solid evidence showing Trump is from Mars.
  - ardy42 8y ago
    > This is as stupid as saying Xinhua/Caixin have anonymous sources with solid evidence showing Trump is from Mars. That tone is pretty uncalled for. The Bloomberg story may or may not be completely accurate, but it's fairly detailed and plausible. While you may categorically distrust anonymous sources, it's not stupid to think they may sometimes be right and that you can trust reputable journalists to vet what they say a fair amount of the time. This story is still young. I wonder what other news organizations can find out about it (beyond the press release responses).
    - jmknoll 8y ago
      Also worth noting that Bloomberg has demonstrated its willingness to put journalistic integrity ahead of profits in the past. They’re currently blocked in China because of a story they ran years ago about the business connections of the country’s top leaders.
      - dis-sys 8y ago
        that story a few years ago was backed by solid facts, independently confirmed by multiple sources. what bloomberg has this time?
bsder 8y ago
> Bloomberg provides zero evidence this happaned, outside of their anonymous sources. Bloomberg probably ran this hoping that now that people are looking, some folks outside the circle of anonymous sources will find the chip so that they don't risk exposing their sources.
- briandear 8y ago
  Publishing fishing expedition stories is irresponsible journalism. Bloomberg is a market-influencing outlet: printing unsubstantiated rumor is unethical, especially given their influence.
  - bsder 8y ago
    It's not a fishing exhibition if you have a bunch of sources from different directions all corroborating the story. The story is so explosive that I find it very difficult to believe that Bloomberg isn't on very solid ground. Nevertheless, getting hold of irrefutable physical evidence may be very difficult. By breaking the story, they now have lots of people now looking for that evidence. In addition, they may now have enough cover to be able to actually present evidence in their possession and claim that it came from an outside source in order to protect their sources. There is no good reason for Bloomberg to lie about this as it will significantly damage their reputation and bottom line if proven false. Now, that doesn't mean that Bloomberg wasn't the target of an operation and was given planted, false information to trace leaks. However, as this has been in the playbook very recently, I would expect the press to be on guard for this.
cm2187 8y ago
Like if a newspaper reports on a cocaine seizure, you expect them to keep a stach of cocaine in the newsroom?
- cknoxrun 8y ago
  Typically there are photos of the drug seizure.
  - kkarakk 8y ago
    even when vice is covering it up? there are nuances everywhere. if you don't trust the reporters/editors to be accountable, the whole system of news reporting falls apart
- shaklee3 8y ago
  Except one of those is, you know, illegal...
  - ggggtez 8y ago
    Imagine that the boards actually do exist, and represent an espionage by a foreign government. Why would the company not immediately hand it over to the FBI/CIA, and immediately be forced to sign an NDA? It would most certainly be illegal.

FractalParadigm 8y ago

My thoughts exactly. They're making claims that virtually everyone in tech is denying and haven't/can't produce any evidence. Not to mention, if this hardware had been trying to phone home, it's safe to assume it would have set off some kind of an alert at at least one of these places.

dboreham 8y ago
To be fair, the article does mention that it set off alerts.
pmart123 8y ago
When you read the article, I believe they are alluding to the fact that Apple and Amazon did discover the vunerabilities. “In 2016, Apple informed Supermicro that it was severing their relationship entirely—a decision a spokesman for Apple ascribed in response to Businessweek’s questions to an unrelated and relatively minor security incident.”
- yonkshi 8y ago
  And Apple's own statement said that the journalist is probably confusion a separate, software based, incident with this incident. https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/ https://www.apple.com/newsroom/2018/10/what-businessweek-got...
vmchale 8y ago
> Not to mention, if this hardware had been trying to phone home, it's safe to assume it would have set off some kind of an alert at at least one of these places. Maybe at some big companies, but not anywhere I've worked. I hardly know anyone who audits outgoing traffic with dedicated hardware.
- brisance 8y ago
  Apple's valuation is >$1 trillion. Is that big enough?
  - deleted 8y ago
    [deleted]
  - RaleyField 8y ago
    > $1 trillion I wonder if there is some magical market cap boundary beyond which companies stop being grossly negligent. We know it's over 200B as Intel somehow never bothered fixing their products for decades, let's hope five times that is big enough.
    - teknologist 8y ago
      Considering Apple just released a $1k+ phone that doesn't charge when plugged in with the screen off, I wouldn't bet on it. (Just search on YouTube)
caseysoftware 8y ago
The original article specifically says that they saw odd network behavior and issues with the firmware. If this is all true (?), that's a piece of how they found it.
perl4ever 8y ago
Matt Levine wrote in his Thursday column: "...let us consider a hypothetical. What if: 1. Everything in the Businessweek story is true, Chinese spies planted hardware backdoors in computers built and used by major American companies, and the FBI investigated along with those companies and discovered the backdoors. 2. It is a national-security secret and the companies were instructed by the FBI never to acknowledge it. 3. The companies are patriotically but falsely denying the hack."
- briandear 8y ago
  If it were Apple, they wouldn’t write a categorical denial because once the “truth” leaked, their credibility would be shot for a long time. The standard Apple answer would be “Apple could not be reached for comment.” But no, they went thermonuclear on the denial.
  - sneak 8y ago
    The people hypothetically demanding these denials have gone literally thermonuclear before. It’s an entirely different ball game when you deal with the guys with machine guns.

gthtjtkt 8y ago

> where is the hardware now? How many people at Apple or Amazon have the ability to steal compromised hardware and surreptitiously hand it to a journalist? That seems like a pretty lofty expectation.

ardy42 8y ago

> Why doesn’t Bloomberg’s sources have the hardware or know which boards they were? How do you know Bloomberg's sources don't? They're anonymous, and while they might know about the implants in detail, they may not have the authority to take examples on a public dog and pony show. Also, if they want to keep their anonymity, they probably have to be careful about what gets released in order avoid exposing themselves. For example, if you have a limited-distribution report you want to leak info from, leaking a summary of the report is a lot safer than leaking the report text itself. At a minimum, the latter narrows down the leaker to someone who had physical access to a copy.

dis-sys 8y ago
This is as stupid as saying Xinhua/Caixin have anonymous sources with solid evidence showing Trump is from Mars.
- ardy42 8y ago
  > This is as stupid as saying Xinhua/Caixin have anonymous sources with solid evidence showing Trump is from Mars. That tone is pretty uncalled for. The Bloomberg story may or may not be completely accurate, but it's fairly detailed and plausible. While you may categorically distrust anonymous sources, it's not stupid to think they may sometimes be right and that you can trust reputable journalists to vet what they say a fair amount of the time. This story is still young. I wonder what other news organizations can find out about it (beyond the press release responses).
  - jmknoll 8y ago
    Also worth noting that Bloomberg has demonstrated its willingness to put journalistic integrity ahead of profits in the past. They’re currently blocked in China because of a story they ran years ago about the business connections of the country’s top leaders.
    - dis-sys 8y ago
      that story a few years ago was backed by solid facts, independently confirmed by multiple sources. what bloomberg has this time?

bsder 8y ago

> Bloomberg provides zero evidence this happaned, outside of their anonymous sources. Bloomberg probably ran this hoping that now that people are looking, some folks outside the circle of anonymous sources will find the chip so that they don't risk exposing their sources.

briandear 8y ago
Publishing fishing expedition stories is irresponsible journalism. Bloomberg is a market-influencing outlet: printing unsubstantiated rumor is unethical, especially given their influence.
- bsder 8y ago
  It's not a fishing exhibition if you have a bunch of sources from different directions all corroborating the story. The story is so explosive that I find it very difficult to believe that Bloomberg isn't on very solid ground. Nevertheless, getting hold of irrefutable physical evidence may be very difficult. By breaking the story, they now have lots of people now looking for that evidence. In addition, they may now have enough cover to be able to actually present evidence in their possession and claim that it came from an outside source in order to protect their sources. There is no good reason for Bloomberg to lie about this as it will significantly damage their reputation and bottom line if proven false. Now, that doesn't mean that Bloomberg wasn't the target of an operation and was given planted, false information to trace leaks. However, as this has been in the playbook very recently, I would expect the press to be on guard for this.

cm2187 8y ago

Like if a newspaper reports on a cocaine seizure, you expect them to keep a stach of cocaine in the newsroom?

cknoxrun 8y ago
Typically there are photos of the drug seizure.
- kkarakk 8y ago
  even when vice is covering it up? there are nuances everywhere. if you don't trust the reporters/editors to be accountable, the whole system of news reporting falls apart
shaklee3 8y ago
Except one of those is, you know, illegal...
- ggggtez 8y ago
  Imagine that the boards actually do exist, and represent an espionage by a foreign government. Why would the company not immediately hand it over to the FBI/CIA, and immediately be forced to sign an NDA? It would most certainly be illegal.