10 ms·
Apple tells Congress it found no signs of hacking attack
- jackweirdy 8y agoTime for Bloomberg to add a little more detail to their claims now, surely?
- cmiles74 8y agoIt would be really nice for Bloomberg to either offer more evidence or tell us they have lost confidence in the article. Likely they will do neither.
- craftyguy 8y ago> Likely they will do neither Right, they likely have already gotten everything they wanted from the article, there's no reason for them to damage their reputation by 'losing confidence' in it, and providing more evidence to support the article won't net them as much publicity/clicks/whatevers as working on the Next Big Article will.
- mruts 8y agoYou realize Bloomberg doesn't really make any money from 'clicks', right? They are a data provider, and as such, have a pretty strong incentive to ensure their data is accurate.
- craftyguy 8y agoThat fits under the "whatever" category.
- mruts 8y agoBut the incentives are very different. Bloomberg makes almost all of their income from the Bloomberg terminal. Their TV network, their news website, everything else, is solely in service to their primary business. The percentage of revenue that comes from advertising for Bloomberg is vanishingly small. Companies follow incentives, and in this case, I think we can reasonably conclude that Bloomberg thought the article was 100% accurate (not saying it is though, I think it's too soon to tell).
- Valmar 8y agoSo... were Bloomberg just bare-face lying, then?
- okket 8y agoIMHO overenthusiastic journalists got fed wrong/incomplete information. Also, every detail is plausible, but at whole, this scenario is just improbable. Details can be deceiving. For a prior incident, see https://en.wikipedia.org/wiki/BadBIOS https://en.wikipedia.org/wiki/BadBIOS
- draugadrotten 8y agoKremlin surely is behind this psyOps attack to undermine the credibility of Western media. Trump. Both. China too. If Apple found no signs of hacking only tells us that their SIEM isn't good enough. This spy stuff is Inception IRL.
- okket 8y agoSure. Completely unthinkable that journalists saw a "market moving" story [0] that passed the plausibility test in details, found some anonymous sources and went for it. [0] "Bloomberg News Pays Reporters More If Their Stories Move Markets" https://news.ycombinator.com/item?id=18162440 https://news.ycombinator.com/item?id=18162440
- bsder 8y agoSure, completely unthinkable that the NSA and big companies are attempting to cover up a story of hacking and surveillance. <rolls eyes> This story has been out less than 72 hours? Most of them over a weekend. Let's let the researchers get back to work today and start actually looking for physical evidence. Personally, I'm MORE worried with all the denials rather than less. If there was nothing to the story, I would expect Apple to say "We don't know anything about this" and then simply ignore the ongoing kerfuffle--especially on a weekend. The fact that they seem to be in full on PR mode at the highest levels on a weekend is somewhat worrying.
- jpkeisala 8y agoI find it hard to believe China would risk their industry by doing something like this where the device has "hard" evidence on spying. They can just find a security flaw on the software and use that.
- draugadrotten 8y agoIt does not have to be China behind the hardware devices, if they are real, just because they were planted in China. It could be Russia, Iran or any other agency with enough money to pay off the supply chain. Heck, even Escobar would have done this if he was alive. Didn't he buy military Submarines at one point?
- est 8y agothe hardest part is predict which batch of motherboards will be assembled and delivered to which customer. According to Bloomberg, Supermicro has 4 contract factories for motherboards production in China. But Supermicro itself assemble in US/Taiwan only.
- _pmf_ 8y ago> I find it hard to believe China would risk their industry Do you think Apple will start producing iPhones in Apple Park's basement?
- jnbiche 8y agoInteresting. I don't think Apple world make a sworn statement to Congress if they weren't absolutely sure it was true. Look like I may have been wrong--perhaps this was a false story planted by certain US officials to slander China. Did Bloomberg get played?
- lolc 8y agoI don't think it was a sworn statement by Apple officials. Just a letter.
- qaq 8y agoAgain the only thing they said that they have not uncovered any sings of hacking based on whatever endpoint and other security systems they have in place. No vendor has ever claimed they can can detect 100% best solutions can detect 98-99% given the number of exploits this depending on operating system means from many thousands to millions of exploits that will not be detected.
- cmiles74 8y agoApple has been pretty clear in their statements and it's a given that they can't detect 100% of outgoing malicious data from their network. But they are denying much more: the servers with the altered boards entering their supply chain, Apple's rapid removal and replacement of all those servers, and so on.
- qaq 8y ago"Stathakopoulos repeated Apple’s statements to the press that it never found malicious chips or vulnerabilities purposely planted in any server or been contacted by the Federal Bureau of Investigation (FBI) about such concerns. He said he would be available to brief Congressional staff on the issue this week." I have not seen "they are denying much more: the servers with the altered boards entering their supply chain". All statements I've read are worded very carefully.
- 8y ago
- okket 8y agoPrevious discussion from 10 hours ago: https://news.ycombinator.com/item?id=18163325 https://news.ycombinator.com/item?id=18163325 (31 comments)
- 21 8y agoIf Apple and Amazon can be put under a NSL gag, why wouldn't they also put Bloomberg under it? They had the whole of an year to do it.
- coolspot 8y agoIt is not like PR department of Apple received NSL gag, it is like small security group within Apple that found the bug has been gagged. So nor Apple executives, nor PR department honestly know about the bug. They deny it because from their perspective there was no breach.
- deleted 8y ago[deleted]
- krn 8y agoI have watched multiple hearings on the US Senate Judiciary Committee in the last few years, and was surprised how many people managed to do both, not to lie and not to reveal the truth, by making huge statements with extremely carefully picked up wording.
- SyneRyder 8y agoJust to throw something extra into the mix - infosec podcast Risky Business managed to track down a source (apparently a trusted source of 15 years) who provided photos to them of what the source claimed was "extra unlabelled components on sensitive buses" they'd found on a teardown they conducted of a Supermicro board. And then, the source retracted the statement and said the photos were from different equipment, and that they didn't find hardware backdoors on Supermicro equipment. This page on the Risky Business site explains their correction in more detail. https://risky.biz/RB516_feature/ https://risky.biz/RB516_feature/ Generally Risky Business is pretty good (they had some great inside info on the "hack" of the 2016 Australian Census), so I find this an intriguing and interesting extra datapoint. If Risky Business can be misled this way, maybe this is how Bloomberg could be misled too.
- brennebeck 8y agoNot to go ‘too tinfoil’ here, but couldn’t that also imply the source was discovered and harassed/served a gag, or something of that sort? (Purely as devil’s advocate speculation)
- SyneRyder 8y agoI don't get that feeling in this specific case, but I'm wary of speculating. Patrick (the guy who hosts the podcast) and the source are probably the only two people who actually know. That said - listening to the podcast, where he interviews someone (who is not the source) and asks them near the end "Have you heard anything about this over the last few years? Have you heard any rumours or anything to suggest China is behaving in this way?" It is a really awkward silence and very nervous laugh, with a vague reply about having seen news reports. That bit is around 22:07 in the podcast if you want to skip ahead. Then maybe go research a bit about who the interviewee is.
- brennebeck 8y agoInteresting. I’ll give it a listen. Thanks for the reference time as well.
- 8y ago
- nakedrobot2 8y agoThe somewhat paranoid, but possibly correct conclusion here, just like with some of the other recent "acts of chaos" (election tampering, and other misinformation campaigns) is to "Blame Russia". This might be one of the simpler explanations - Russia planted the data / evidence / sources to Bloomberg, with the sole objective being to sow chaos in the world. This, to me, is the only explanation where it makes sense that both sides think they're right - Bloomberg really did have those sources and Apple et al really didn't find any evidence of this tampering. (Rewind to the hours after the presidential election - those who were blaming Russia already were labeled as kooks, right?)
- 21 8y agoI also thought about that. The problem with this theory is that Bloomberg says that many of it's sources are US officials.
- draw_down 8y agoNote well: those who have been accusing Apple of lying about this are now saying that the company is lying to Congress. Lying to Congress is, shall we say, not a great idea. This is a serious accusation. You can make it, of course- but be aware of what exactly you're accusing them of at this point.
- alcanatara 8y agoHardware implants are more widespread than one would think: https://newcompendium.com/2018/10/the-chinese-chip-is-just-the-tip-of-the-iceberg/ https://newcompendium.com/2018/10/the-chinese-chip-is-just-t...