5 ms·

As an ex-apple employee, all I’ll say is this means basically nothing. Everything was on a strict need-to-know basis and a condition of your employment was resp

As an ex-apple employee, all I’ll say is this means basically nothing. Everything was on a strict need-to-know basis and a condition of your employment was respecting that. I would be very surprised if more than a handful of Apple employees even knew what exactly what was purchased from Supermicro, so a random sample of employees absolutely would know nothing about this. Unless senior means Senior Vice President, it’s meaningless. That being said, SVP level people did categorically deny it, and I can’t see them doing so unequivocally unless they really believe that will hold up on the court of public opinion for their entire tenure there.

noobermin 8y ago
>A senior security engineer directly involved in Apple’s internal investigation described it as “endoscopic,” noting they had never seen a chip like the one described in the story, let alone found one. “I don’t know if something like this even exists,” this person said, noting that Apple was not provided with a malicious chip or motherboard to examine. "We were given nothing. No hardware. No chips. No emails."
- vehementi 8y ago
  Not once have we ever seen a tiny grain of sand sized malicious chip on the motherboards we bought that I've seen in the racks I inspected in the datacenters I had access to!
  - craftyguy 8y ago
    Hey folks, we have a testimony from an anonymous person on the internets claiming there's nothing to see here. Case closed!
  - geezerjay 8y ago
    Yes, and I never saw Belgium.
    - solarkraft 8y ago
      It's a wonderful city.
      - deleted 8y ago
        [deleted]
  - DaiPlusPlus 8y ago
    Probably easier to build “smart” Cat5 cables that draw PoE to energise a chip in a connector to power a long-range antennae built-in to the cable (outside the shielded layer, of course) to broadcast whatever goes on inside of it to the outside - and put 500x of them in a cable box delivered right outside an Apple iCloud data-center under the guise of a typo’d purchase-order from Monoprice or Tiger Direct.
    - deelowe 8y ago
      Why would apple be running Poe to the servers in their DC?
      - dogma1138 8y ago
        You wouldn’t need POE the nominal voltage of Ethernet can be used to power a small tap.
        DaiPlusPlus 8y ago
        But with PoE-levels of power you could broadcast a very long range away, useful if you have no way of getting someone on the inside.
        dogma1138 8y ago
        You don’t want to do that since those broadcasts are detectable not to mention that with PoE power levels you will still not be able to broadcast outside of a datacenter also you can’t build an IC that can even take leverage of that power while being hidden in a cable. All of these taps rely on external transceivers that will either record the traffic for later extraction or exfiltrate it through other means. Also while PoE has more power it’s also more sensitive to voltage drop over the line which means the tap it self will be detected while normal Ethernet works from -+0.5v to -+2.0v without any issue the voltage range is to allow for voltage drop over longer cables so any drop would be ignored by both end points as they’ll just assume the cable is a few meters longer.
    - 8y ago
bsder 8y ago
> Unless senior means Senior Vice President, it’s meaningless. And not even then. I suspect if someone did find something like this, they were told to bury it for plausible deniability. "Okay, crap, you found a hardware security breach. We'll tell people inside to quit buying those servers, but we'll cough up some other reason. Don't breathe a word of this any further."
- dwighttk 8y ago
  “Quit buying those servers in 8 months.”
klodolph 8y ago
Having worked at FAANG companies my experience matches yours. There are people doing good work in the information security teams, but they only tell you about attacks much later, with most of the details removed. One of the assumptions is that a certain (small) percentage of engineers are also agents of state-level adversaries.
jsoc815 8y ago
> That being said, SVP level people did categorically deny it Again, as someone who worked directly w/ executive level people (and lawyers), the denials mean only that the statements were cleared by lawyers and probably corporate communications staff. (Obviously, Elon @ TSLA's an exception.) After reading the story and the discussions here, I reviewed some of the statement language. There's lots of wiggle room. All is further complicated if US gov't agencies etc., are concerned. Rules and regs that the average person thinks will apply won't. This is just how it works.

noobermin 8y ago

>A senior security engineer directly involved in Apple’s internal investigation described it as “endoscopic,” noting they had never seen a chip like the one described in the story, let alone found one. “I don’t know if something like this even exists,” this person said, noting that Apple was not provided with a malicious chip or motherboard to examine. "We were given nothing. No hardware. No chips. No emails."

vehementi 8y ago
Not once have we ever seen a tiny grain of sand sized malicious chip on the motherboards we bought that I've seen in the racks I inspected in the datacenters I had access to!
- craftyguy 8y ago
  Hey folks, we have a testimony from an anonymous person on the internets claiming there's nothing to see here. Case closed!
- geezerjay 8y ago
  Yes, and I never saw Belgium.
  - solarkraft 8y ago
    It's a wonderful city.
    - deleted 8y ago
      [deleted]
- DaiPlusPlus 8y ago
  Probably easier to build “smart” Cat5 cables that draw PoE to energise a chip in a connector to power a long-range antennae built-in to the cable (outside the shielded layer, of course) to broadcast whatever goes on inside of it to the outside - and put 500x of them in a cable box delivered right outside an Apple iCloud data-center under the guise of a typo’d purchase-order from Monoprice or Tiger Direct.
  - deelowe 8y ago
    Why would apple be running Poe to the servers in their DC?
    - dogma1138 8y ago
      You wouldn’t need POE the nominal voltage of Ethernet can be used to power a small tap.
      - DaiPlusPlus 8y ago
        But with PoE-levels of power you could broadcast a very long range away, useful if you have no way of getting someone on the inside.
        dogma1138 8y ago
        You don’t want to do that since those broadcasts are detectable not to mention that with PoE power levels you will still not be able to broadcast outside of a datacenter also you can’t build an IC that can even take leverage of that power while being hidden in a cable. All of these taps rely on external transceivers that will either record the traffic for later extraction or exfiltrate it through other means. Also while PoE has more power it’s also more sensitive to voltage drop over the line which means the tap it self will be detected while normal Ethernet works from -+0.5v to -+2.0v without any issue the voltage range is to allow for voltage drop over longer cables so any drop would be ignored by both end points as they’ll just assume the cable is a few meters longer.
  - 8y ago

bsder 8y ago

> Unless senior means Senior Vice President, it’s meaningless. And not even then. I suspect if someone did find something like this, they were told to bury it for plausible deniability. "Okay, crap, you found a hardware security breach. We'll tell people inside to quit buying those servers, but we'll cough up some other reason. Don't breathe a word of this any further."

dwighttk 8y ago
“Quit buying those servers in 8 months.”

klodolph 8y ago

Having worked at FAANG companies my experience matches yours. There are people doing good work in the information security teams, but they only tell you about attacks much later, with most of the details removed. One of the assumptions is that a certain (small) percentage of engineers are also agents of state-level adversaries.

jsoc815 8y ago

> That being said, SVP level people did categorically deny it Again, as someone who worked directly w/ executive level people (and lawyers), the denials mean only that the statements were cleared by lawyers and probably corporate communications staff. (Obviously, Elon @ TSLA's an exception.) After reading the story and the discussions here, I reviewed some of the statement language. There's lots of wiggle room. All is further complicated if US gov't agencies etc., are concerned. Rules and regs that the average person thinks will apply won't. This is just how it works.