11 ms·

Apple Bloomberg Congressional Letter

145 points by wglb 8y ago

21 8y ago
Obviously people started to investigate this hack too much, so the US government forced Apple using a NSL to write a letter to Congress denying that any such hack occured. The Congress probably knows the truth, but they are also under NSL. Expect letters to Congress from Amazon and the 30 other hacked companies. It's the only way to kill this story, after they made the unbelivable mistake of forgetting to NSL Bloomberg despite having requests from them to comment on this story for months. Somebody is getting Guantanamoed over this slip.
- lucozade 8y ago
  This is the only possible explanation. Other than the other, much more plausible, one.
  - JumpCrisscross 8y ago
    > This is the only possible explanation There are a lot of possible explanations. As someone who finds both Bloomberg and Apple credible, this is potentially far more interesting than “one of them is totally lying.”
    - Karunamon 8y ago
      Zoom in a bit and forget about Bloomberg's credibility as a whole and look just at the journalists involved in this story. This isn't their first time hyping up garbage, but it's a lot more audacious: https://twitter.com/RobertMLee/status/1049617855396933632 https://twitter.com/RobertMLee/status/1049617855396933632
- humanrebar 8y ago
  Congress reports to nobody but their constituents. They cannot be "under NSL".
  - moftz 8y ago
    No, but if members that have security clearances were clued in on it, they would not be able to divulge anything and would be compelled to say nothing.
    - humanrebar 8y ago
      Compelled by what?
      - moftz 8y ago
        Compelled by the lifetime NDA the government makes you sign.
- jsjohnst 8y ago
  NSL can not compel you to lie, it can only compel you to stay silent. There’s decently extensive case law to support that.
  - ben_w 8y ago
    I’m not a lawyer, I’ve merely read news stories about how NSLs and associated court cases are overly-secret (https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit). Given what was reported in the Lavabit case, how sure are you that there is no secret caselaw which does, in fact, require companies to lie?
    - jsjohnst 8y ago
      Look up the case law surrounding “compelled speech” if you’d like more details.
cronz 8y ago
Maybe, and only maybe, the problem here is that people still believe journalists.
- maeln 8y ago
  Saying this is as stupid as trusting any articles. Yes, a lot of journalist do a very good job at providing crucial information that is vital to a democracy. Journalism is an important counter-power. Without journalism you wouldn't be aware of corruption, abuse of power and many other things. Yes there is tabloïd, yes there is bad reporting, bad journalism and yes, in the age of internet, even reputable journals spread unverified news. But dismissing an entire profession is amongst the most dangerous thing you can do. If you have an issue with some journalist, you can go and pay for journals that do a good job at verifying sources and do real investigation jobs. They are here, they exist.
  - crististm 8y ago
    @cronz. Not all jurnalists are created equal [meta] While the comment is very poor, lacks a deep consideration and can be considered stupid without a need for a deep analysis, WyTF is it dead? How not leaving it up to be downvoted into oblivion is a bad idea?
  - qubax 8y ago
    > Yes, a lot of journalist do a very good job at providing crucial information that is vital to a democracy. Journalism isn't vital to democracy. It didn't exist in the democracies of ancient world ( greece or roman empire ). It didn't exist during the founding of the US. > Journalism is an important counter-power. It can be a counter to power or it can be a servant to power. > Without journalism you wouldn't be aware of corruption, abuse of power and many other things. Of course we would. Do you really think people weren't aware of corruption before journalism? Journalism, like all institutions, can be used for good and evil. And they can be corruptible. It can be used to shed light to corruption or it can be used to hide corruption. It can be used to hold the powerful accountable or it be used to spread propaganda for the powerful. In the US, journalism has primarily been for the latter. Feel free to read up the history of newspapers and who created them. It was wealthy( bankers or tycoons ) and politicians who created our prominent newspapers. > They are here, they exist. If they do exist, they must exist as independent journalists. The problem with modern society is that journalists have duped everyone into thinking they are essential and they are objective/good/fair/etc. I don't think anyone paying attention believes this any more. The problem with journalism is that there are no checks and balances. Nobody holding journalists/journalism to account. A lot of it has to do with the fewer and fewer corporations owning so many media outlets and of course the ideological conformity enforced in almost all of the media.
okket 8y ago
Maybe relevant: Here is a podcast with Joe Fitzpatrick, one of the sources named in the Bloomberg article, who expresses doubts about the "Big Hack" story: https://risky.biz/RB517_feature/ https://risky.biz/RB517_feature/
qaq 8y ago
OK so no material details are provided in this letter. I am not aware of a single f500 company that was not breached at some point so we have not found any servers because we have various security tools installed is not really meaningful. Scanning outbound connections is not a meaningful defense in this case there are legitimate outbound connections going to say China and given China's ability to capture any inbound traffic there are def. ways to ex-filtrate data without raising any flags.
- danaris 8y ago
  ...But as I understand it, the Bloomberg report states that specific pieces of hardware were found by Apple, and Apple states that they have found no such thing.
  - qaq 8y ago
    This all depends on what gag orders are in place if the Apple source was off on having precise information of who discovered what etc. To me the language of all Apple communications so far look to be very carefully worded same for DHS.
    - danaris 8y ago
      Gag orders can only force companies not to say the truth. They can't force them to lie. They certainly can't compel them to make such clear, specific, long-winded, and persistent denials of claims like these. That kind of thing's the stuff of conspiracy theories and Hollywood plots.
      - qaq 8y ago
        Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity?
        mistersquid 8y ago
        With regard to DHS, Apple's Congressional Letter states: > On Saturday night, the U.S. Department of Homeland Security joined the U.K.'s National Cyber Security Centre in saying they have no reason to doubt the statements we've made.
mtw 8y ago
At this point, it seems like Apple and Amazon have hard facts and Bloomberg has more tales of "he said"/"she said" and didn't cross check. The journalists halved Supermicro stock value, they have a responsibility to prove this actually happened.
- myWindoonn 8y ago
  Half of a worthless stock isn't much of a big deal. Supermicro isn't filing basic essential paperwork with the SEC, which is simultaneously extremely fishy and also a basic prerequisite for being a publically-traded company, and this problem predates Bloomberg's article by months. I'm not a CFP, but you should probably sell your Supermicro holdings now; they aren't gonna recover. https://www.businesswire.com/news/home/20180821005681/en/ https://www.businesswire.com/news/home/20180821005681/en/
  - throwawaymath 8y ago
    That's not the point. Basic principles of integrity and accountability mandate that journalists be responsible for carefully weighing the consequences of their stories. They shouldn't just charge forward without significant due diligence and then put the onus on everyone else involved to prove the story isn't factual. That's specifically a component of their job when they're breaking the news. That a company's share price is already bruised or disreputable has no material impact here. It doesn't matter if a company has pre-existing and systemic financial problems; that doesn't mean we can be cavalier about publishing news that will wipe out half its value in a day. This kind of cavalier approach to company valuation isn't suitable for considering the consequences of erroneous stories. Moreover I think you'll find that regardless of how much you believe the stock is worthless, there is actually an objectively quantifiable loss that was suffered here. If you still believe the stock is worthless even after this reduction in share price then by all means short it. But you can't speak for the entire market, which clearly demonstrates that many parties disagree with you on Supermicro's valuation. Presumably some of those parties will be a little miffed if the Bloomberg story turns out to be largely incorrect - you can't just shrug and tell them, "Hey that stock is worthless, you shouldn't have owned any of it anyway."
myWindoonn 8y ago
Ah, excellent, George Stathakopoulos has nominated themselves as the scapegoat. I will be disappointed if they are not dismissed if Bloomberg's allegations are substantiated. Ditto to Steve Schmidt [0] with their post. Edit: Apparently this is "callous". To be clear, Apple and AWS have both lied about operational issues to customers before and have had human-rights and labor-rights issues in their supply chains for years, China is a human-rights abuser who cannot stop disappearing and brainwashing religious minorities, the GOs of the USA and UK are currently administered by incompetent fascists who have lied repeatedly about this sort of thing for decades, and China has attacked USA companies before [1]. I personally haven't made up my mind; all of Bloomberg's evidence is circumstantial and unverified, and all of the evidence against the incident is hearsay from known liars. But I'm saying that if the evidence manifests, and the story has sufficient truth to show any part of these statements to be false, then I would like to see these folks take one for the team; after all, they stand to gain in stature if the story falls apart! And the stakes are obviously high. [0] https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/ https://aws.amazon.com/blogs/security/setting-the-record-str... [1] https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora
- georgespencer 8y ago
  This seems like a callous thing to say.
plg 8y ago
what an awful looking letterhead design, I'm surprised
- Terretta 8y ago
  That’s funny, I sent it to a colleague saying how nice it was to see something so simple yet distinctive.
_Codemonkeyism 8y ago
Surely this Apple execs would be the first execs to ever lie. I'm interested by the Bloomberg follow up or if they fold.
ckastner 8y ago
> If any of the reported details cited above were true, we would have every interest—economic, regulatory, and ethical—to be forthcoming about it. That's the key argument. This isn't just a "your word against mine" type of thing. Were this issue true, then it could represent a significant legal risk to Apple. Categorically denying something that can easily be proven by an external audit (a scenario that they cannot rule out might happen), as strongly worded as they did (excerpt below), would open them up to a huge legal liability in addition to the security issue itself, and for no real upside. > In the end, our internal investigations directly contradict every consequential assertion made in the article—some of which, we note, were based on a single anonymous source. Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server.
- sandworm101 8y ago
  >> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Then where are they buying their hardware? Every company that I've talked to who purchases electronics from China has had issues. Stuff isn't as ordered. Strange boards are added. You have to rigorously inspect everything. Nobody has told me about rice-sized stealth chips, but malware, old firmware (ie with known/public vulnerabilities) and under-spec parts are a norm in the industry. What seems odd about this Bloomberg story is the difference in intent. Rather than a supplier trying to save a few bucks, or a wayward employee inserting something to harvest CC details, they ascribe this to government conspiracy, to a cold war battle between secret squirrels.
  - bilbo0s 8y ago
    The reason I'm skeptical of the story is that the people inspecting hardware at Apple are at least as smart as I am. If I would do a certain thing to inspect hardware and firmware, then that means Apple would do at least that thing. Those are brilliant hardware guys. I'm having a hard time seeing how you sneak something by them. I think maybe in the firmware? (But probably not. They've also got the most brilliant firmware security guys on the planet.) And on the off chance that this thing did slip by, a picture was provided of the purported part. It would have been a simple matter to go back through all of your audits looking for that part. Because if I'm smart enough to catalog and record my hardware audits, that means that Apple was doing so a looong time before I was. I don't know man? I'm getting more and more skeptical of this story by the day.
creeble 8y ago
Once again, this is easy for Bloomberg to prove: X-Ray or it didn't happen. Fake news. Surely the factory produced more than a few of these mobos. All the world needs is an X-Ray of one board with the magical chip.
- 394549 8y ago
  > Once again, this is easy for Bloomberg to prove: X-Ray or it didn't happen. Fake news. Surely the factory produced more than a few of these mobos. All the world needs is an X-Ray of one board with the magical chip. That's not true, and fundamentally misunderstands what journalists' job is. They're reporters not researchers: they report on information in testimony and documents they acquire, they don't do the research to to create that information themselves. They cross-check testimony and documents between multiple sources to verify the information, they don't replicate research. Bloomberg doesn't have a bugged motherboard to X-ray. Per their story, all of those were owned by other entities. There's very little reason to expect that they have an example, since they weren't a target and the people they talked to were likely not authorized to hand over their employees property. Given that, it's unlikely they even asked for one since it would have been a foolish request.
Greetz899 8y ago
For me it seems that there are more coincidential elements here than what is apparent - for example the disappearance of the Interpol chief, etc. https://newcompendium.com/2018/10/the-chinese-chip-is-just-the-tip-of-the-iceberg/ https://newcompendium.com/2018/10/the-chinese-chip-is-just-t...
thrower123 8y ago
There's something fishy going on here. I don't really think that Bloomberg would fabricate the story out of whole cloth, so there has to be something there somewhere. It's possible that they were duped, but if they didn't make some efforts to corroborate the story, that would be shockingly poor journalism, the kind of thing you expect from the National Enquirer, not a major financial paper. On the other side, it doesn't take much of a lapse in QA to let a single bad part through, when you are dealing with billions of components like Apple is.
- nneonneo 8y ago
  Maybe it doesn’t take much of a lapse in QA to let a single bad article through, when you’re dealing with hundreds of articles like Businessweek is...
  - jedieaston 8y ago
    It was the cover of last weeks issue, they had to have a known-good story for it to make it that far.
- saudioger 8y ago
  My understanding is that while the sources were left anonymous, they were definitely confirmed as intelligence agents by Bloomberg... so if they were duped, it's a pretty serious (propaganda-level?) duping.
  - robmiller 8y ago
    Well, the Smith-Mundt Act[0] was repealed in an NDAA passed a few years ago under Obama... [0] https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act
  - WillPostForFood 8y ago
    This is where Bloomberg is already caught playing little loose with the truth. They are saying they have 17 sources, some of which are intelligence officials, but that doesn't mean they have 17 people confirming the specifics of these incidents. Apple's response notes that the accusation is reliant on a /single/ anonymous source. Intelligence officials may have simply confirmed that China is interested and tried to do this kind of thing.
DenisM 8y ago
Perhaps someone created a disinformation campaign against Bloomberg? That would fit the facts we observe - Bloomberg is adamant in their story and Apple/Google are adamant it’s entirely false.
- rdlecler1 8y ago
  This is the best solution I’ve heard yet. On the one hand I can’t believe apple would make such a strong categorical denial of it wasn’t a false story. At the same time, a Bloomberg reporter is not going to risk a career unless they had strong conviction with their sources and Bloomberg is not going to risk their reputation unless they felt the sources were solid and fully vetted.
fhood 8y ago
Until someone produces some actual compromised hardware, I'm leaning towards Apple on this one. I don't know what is going on, and I fully trust that Bloomberg was very confident in the story, but for Apple to deny this so strongly, repeatedly and vehemently indicates to me that they are telling what they believe to be the truth as well.
- kickopotomus 8y ago
  This is what I am thinking as well. The initial denial could be due to a gag order if the investigation is ongoing or if the information was simply deemed classified. However, to go to these lengths to deny the story makes me feel that Bloomberg may not have gotten all the facts straight.
jasonlotito 8y ago
Let's say Bloomberg did its due-diligence is telling the truth. That doesn't mean Apple here can't also be telling the truth as they see it. Bloomberg could have spoken to a few select individuals who shared things only they knew. I don't see any reason they couldn't have kept this hidden from others, allowing the upper management plausible deniability. These people lower on the totem pole could report to the government, and upper management could deny all day long. Couple this with my own personal experience with Apple sharing personal data it had no right to share, and the fact that only a single person signed this letter, and Bloomberg still not backing down, Apple has a way to go. They could start by having every person would would remotely be involved with something like this (from top to bottom) signing a legally binding letter attesting that Bloomberg's story is not true. Until you have this, it only takes one individual who hid something from Seniors to make this true.
busterarm 8y ago
Breaking: https://finance.yahoo.com/news/evidence-hacked-supermicro-hardware-found-150152882.html https://finance.yahoo.com/news/evidence-hacked-supermicro-ha...
tptacek 8y ago
If nothing else, this has to put to rest the "gag order" or "NSL" conspiracy theory.

145 points by wglb 8y ago

21 8y ago

Obviously people started to investigate this hack too much, so the US government forced Apple using a NSL to write a letter to Congress denying that any such hack occured. The Congress probably knows the truth, but they are also under NSL. Expect letters to Congress from Amazon and the 30 other hacked companies. It's the only way to kill this story, after they made the unbelivable mistake of forgetting to NSL Bloomberg despite having requests from them to comment on this story for months. Somebody is getting Guantanamoed over this slip.

lucozade 8y ago
This is the only possible explanation. Other than the other, much more plausible, one.
- JumpCrisscross 8y ago
  > This is the only possible explanation There are a lot of possible explanations. As someone who finds both Bloomberg and Apple credible, this is potentially far more interesting than “one of them is totally lying.”
  - Karunamon 8y ago
    Zoom in a bit and forget about Bloomberg's credibility as a whole and look just at the journalists involved in this story. This isn't their first time hyping up garbage, but it's a lot more audacious: https://twitter.com/RobertMLee/status/1049617855396933632 https://twitter.com/RobertMLee/status/1049617855396933632
humanrebar 8y ago
Congress reports to nobody but their constituents. They cannot be "under NSL".
- moftz 8y ago
  No, but if members that have security clearances were clued in on it, they would not be able to divulge anything and would be compelled to say nothing.
  - humanrebar 8y ago
    Compelled by what?
    - moftz 8y ago
      Compelled by the lifetime NDA the government makes you sign.
jsjohnst 8y ago
NSL can not compel you to lie, it can only compel you to stay silent. There’s decently extensive case law to support that.
- ben_w 8y ago
  I’m not a lawyer, I’ve merely read news stories about how NSLs and associated court cases are overly-secret (https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit). Given what was reported in the Lavabit case, how sure are you that there is no secret caselaw which does, in fact, require companies to lie?
  - jsjohnst 8y ago
    Look up the case law surrounding “compelled speech” if you’d like more details.

cronz 8y ago

Maybe, and only maybe, the problem here is that people still believe journalists.

maeln 8y ago
Saying this is as stupid as trusting any articles. Yes, a lot of journalist do a very good job at providing crucial information that is vital to a democracy. Journalism is an important counter-power. Without journalism you wouldn't be aware of corruption, abuse of power and many other things. Yes there is tabloïd, yes there is bad reporting, bad journalism and yes, in the age of internet, even reputable journals spread unverified news. But dismissing an entire profession is amongst the most dangerous thing you can do. If you have an issue with some journalist, you can go and pay for journals that do a good job at verifying sources and do real investigation jobs. They are here, they exist.
- crististm 8y ago
  @cronz. Not all jurnalists are created equal [meta] While the comment is very poor, lacks a deep consideration and can be considered stupid without a need for a deep analysis, WyTF is it dead? How not leaving it up to be downvoted into oblivion is a bad idea?
- qubax 8y ago
  > Yes, a lot of journalist do a very good job at providing crucial information that is vital to a democracy. Journalism isn't vital to democracy. It didn't exist in the democracies of ancient world ( greece or roman empire ). It didn't exist during the founding of the US. > Journalism is an important counter-power. It can be a counter to power or it can be a servant to power. > Without journalism you wouldn't be aware of corruption, abuse of power and many other things. Of course we would. Do you really think people weren't aware of corruption before journalism? Journalism, like all institutions, can be used for good and evil. And they can be corruptible. It can be used to shed light to corruption or it can be used to hide corruption. It can be used to hold the powerful accountable or it be used to spread propaganda for the powerful. In the US, journalism has primarily been for the latter. Feel free to read up the history of newspapers and who created them. It was wealthy( bankers or tycoons ) and politicians who created our prominent newspapers. > They are here, they exist. If they do exist, they must exist as independent journalists. The problem with modern society is that journalists have duped everyone into thinking they are essential and they are objective/good/fair/etc. I don't think anyone paying attention believes this any more. The problem with journalism is that there are no checks and balances. Nobody holding journalists/journalism to account. A lot of it has to do with the fewer and fewer corporations owning so many media outlets and of course the ideological conformity enforced in almost all of the media.

okket 8y ago

Maybe relevant: Here is a podcast with Joe Fitzpatrick, one of the sources named in the Bloomberg article, who expresses doubts about the "Big Hack" story: https://risky.biz/RB517_feature/ https://risky.biz/RB517_feature/

qaq 8y ago

OK so no material details are provided in this letter. I am not aware of a single f500 company that was not breached at some point so we have not found any servers because we have various security tools installed is not really meaningful. Scanning outbound connections is not a meaningful defense in this case there are legitimate outbound connections going to say China and given China's ability to capture any inbound traffic there are def. ways to ex-filtrate data without raising any flags.

danaris 8y ago
...But as I understand it, the Bloomberg report states that specific pieces of hardware were found by Apple, and Apple states that they have found no such thing.
- qaq 8y ago
  This all depends on what gag orders are in place if the Apple source was off on having precise information of who discovered what etc. To me the language of all Apple communications so far look to be very carefully worded same for DHS.
  - danaris 8y ago
    Gag orders can only force companies not to say the truth. They can't force them to lie. They certainly can't compel them to make such clear, specific, long-winded, and persistent denials of claims like these. That kind of thing's the stuff of conspiracy theories and Hollywood plots.
    - qaq 8y ago
      Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity?
      - mistersquid 8y ago
        With regard to DHS, Apple's Congressional Letter states: > On Saturday night, the U.S. Department of Homeland Security joined the U.K.'s National Cyber Security Centre in saying they have no reason to doubt the statements we've made.

mtw 8y ago

At this point, it seems like Apple and Amazon have hard facts and Bloomberg has more tales of "he said"/"she said" and didn't cross check. The journalists halved Supermicro stock value, they have a responsibility to prove this actually happened.

myWindoonn 8y ago
Half of a worthless stock isn't much of a big deal. Supermicro isn't filing basic essential paperwork with the SEC, which is simultaneously extremely fishy and also a basic prerequisite for being a publically-traded company, and this problem predates Bloomberg's article by months. I'm not a CFP, but you should probably sell your Supermicro holdings now; they aren't gonna recover. https://www.businesswire.com/news/home/20180821005681/en/ https://www.businesswire.com/news/home/20180821005681/en/
- throwawaymath 8y ago
  That's not the point. Basic principles of integrity and accountability mandate that journalists be responsible for carefully weighing the consequences of their stories. They shouldn't just charge forward without significant due diligence and then put the onus on everyone else involved to prove the story isn't factual. That's specifically a component of their job when they're breaking the news. That a company's share price is already bruised or disreputable has no material impact here. It doesn't matter if a company has pre-existing and systemic financial problems; that doesn't mean we can be cavalier about publishing news that will wipe out half its value in a day. This kind of cavalier approach to company valuation isn't suitable for considering the consequences of erroneous stories. Moreover I think you'll find that regardless of how much you believe the stock is worthless, there is actually an objectively quantifiable loss that was suffered here. If you still believe the stock is worthless even after this reduction in share price then by all means short it. But you can't speak for the entire market, which clearly demonstrates that many parties disagree with you on Supermicro's valuation. Presumably some of those parties will be a little miffed if the Bloomberg story turns out to be largely incorrect - you can't just shrug and tell them, "Hey that stock is worthless, you shouldn't have owned any of it anyway."

myWindoonn 8y ago

Ah, excellent, George Stathakopoulos has nominated themselves as the scapegoat. I will be disappointed if they are not dismissed if Bloomberg's allegations are substantiated. Ditto to Steve Schmidt [0] with their post. Edit: Apparently this is "callous". To be clear, Apple and AWS have both lied about operational issues to customers before and have had human-rights and labor-rights issues in their supply chains for years, China is a human-rights abuser who cannot stop disappearing and brainwashing religious minorities, the GOs of the USA and UK are currently administered by incompetent fascists who have lied repeatedly about this sort of thing for decades, and China has attacked USA companies before [1]. I personally haven't made up my mind; all of Bloomberg's evidence is circumstantial and unverified, and all of the evidence against the incident is hearsay from known liars. But I'm saying that if the evidence manifests, and the story has sufficient truth to show any part of these statements to be false, then I would like to see these folks take one for the team; after all, they stand to gain in stature if the story falls apart! And the stakes are obviously high. [0] https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/ https://aws.amazon.com/blogs/security/setting-the-record-str... [1] https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora

georgespencer 8y ago
This seems like a callous thing to say.

plg 8y ago

what an awful looking letterhead design, I'm surprised

Terretta 8y ago
That’s funny, I sent it to a colleague saying how nice it was to see something so simple yet distinctive.

_Codemonkeyism 8y ago

Surely this Apple execs would be the first execs to ever lie. I'm interested by the Bloomberg follow up or if they fold.

ckastner 8y ago

> If any of the reported details cited above were true, we would have every interest—economic, regulatory, and ethical—to be forthcoming about it. That's the key argument. This isn't just a "your word against mine" type of thing. Were this issue true, then it could represent a significant legal risk to Apple. Categorically denying something that can easily be proven by an external audit (a scenario that they cannot rule out might happen), as strongly worded as they did (excerpt below), would open them up to a huge legal liability in addition to the security issue itself, and for no real upside. > In the end, our internal investigations directly contradict every consequential assertion made in the article—some of which, we note, were based on a single anonymous source. Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server.

sandworm101 8y ago
>> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Then where are they buying their hardware? Every company that I've talked to who purchases electronics from China has had issues. Stuff isn't as ordered. Strange boards are added. You have to rigorously inspect everything. Nobody has told me about rice-sized stealth chips, but malware, old firmware (ie with known/public vulnerabilities) and under-spec parts are a norm in the industry. What seems odd about this Bloomberg story is the difference in intent. Rather than a supplier trying to save a few bucks, or a wayward employee inserting something to harvest CC details, they ascribe this to government conspiracy, to a cold war battle between secret squirrels.
- bilbo0s 8y ago
  The reason I'm skeptical of the story is that the people inspecting hardware at Apple are at least as smart as I am. If I would do a certain thing to inspect hardware and firmware, then that means Apple would do at least that thing. Those are brilliant hardware guys. I'm having a hard time seeing how you sneak something by them. I think maybe in the firmware? (But probably not. They've also got the most brilliant firmware security guys on the planet.) And on the off chance that this thing did slip by, a picture was provided of the purported part. It would have been a simple matter to go back through all of your audits looking for that part. Because if I'm smart enough to catalog and record my hardware audits, that means that Apple was doing so a looong time before I was. I don't know man? I'm getting more and more skeptical of this story by the day.

creeble 8y ago

Once again, this is easy for Bloomberg to prove: X-Ray or it didn't happen. Fake news. Surely the factory produced more than a few of these mobos. All the world needs is an X-Ray of one board with the magical chip.

394549 8y ago
> Once again, this is easy for Bloomberg to prove: X-Ray or it didn't happen. Fake news. Surely the factory produced more than a few of these mobos. All the world needs is an X-Ray of one board with the magical chip. That's not true, and fundamentally misunderstands what journalists' job is. They're reporters not researchers: they report on information in testimony and documents they acquire, they don't do the research to to create that information themselves. They cross-check testimony and documents between multiple sources to verify the information, they don't replicate research. Bloomberg doesn't have a bugged motherboard to X-ray. Per their story, all of those were owned by other entities. There's very little reason to expect that they have an example, since they weren't a target and the people they talked to were likely not authorized to hand over their employees property. Given that, it's unlikely they even asked for one since it would have been a foolish request.

Greetz899 8y ago

For me it seems that there are more coincidential elements here than what is apparent - for example the disappearance of the Interpol chief, etc. https://newcompendium.com/2018/10/the-chinese-chip-is-just-the-tip-of-the-iceberg/ https://newcompendium.com/2018/10/the-chinese-chip-is-just-t...

thrower123 8y ago

There's something fishy going on here. I don't really think that Bloomberg would fabricate the story out of whole cloth, so there has to be something there somewhere. It's possible that they were duped, but if they didn't make some efforts to corroborate the story, that would be shockingly poor journalism, the kind of thing you expect from the National Enquirer, not a major financial paper. On the other side, it doesn't take much of a lapse in QA to let a single bad part through, when you are dealing with billions of components like Apple is.

nneonneo 8y ago
Maybe it doesn’t take much of a lapse in QA to let a single bad article through, when you’re dealing with hundreds of articles like Businessweek is...
- jedieaston 8y ago
  It was the cover of last weeks issue, they had to have a known-good story for it to make it that far.
saudioger 8y ago
My understanding is that while the sources were left anonymous, they were definitely confirmed as intelligence agents by Bloomberg... so if they were duped, it's a pretty serious (propaganda-level?) duping.
- robmiller 8y ago
  Well, the Smith-Mundt Act[0] was repealed in an NDAA passed a few years ago under Obama... [0] https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act
- WillPostForFood 8y ago
  This is where Bloomberg is already caught playing little loose with the truth. They are saying they have 17 sources, some of which are intelligence officials, but that doesn't mean they have 17 people confirming the specifics of these incidents. Apple's response notes that the accusation is reliant on a /single/ anonymous source. Intelligence officials may have simply confirmed that China is interested and tried to do this kind of thing.

DenisM 8y ago

Perhaps someone created a disinformation campaign against Bloomberg? That would fit the facts we observe - Bloomberg is adamant in their story and Apple/Google are adamant it’s entirely false.

rdlecler1 8y ago
This is the best solution I’ve heard yet. On the one hand I can’t believe apple would make such a strong categorical denial of it wasn’t a false story. At the same time, a Bloomberg reporter is not going to risk a career unless they had strong conviction with their sources and Bloomberg is not going to risk their reputation unless they felt the sources were solid and fully vetted.

fhood 8y ago

Until someone produces some actual compromised hardware, I'm leaning towards Apple on this one. I don't know what is going on, and I fully trust that Bloomberg was very confident in the story, but for Apple to deny this so strongly, repeatedly and vehemently indicates to me that they are telling what they believe to be the truth as well.

kickopotomus 8y ago
This is what I am thinking as well. The initial denial could be due to a gag order if the investigation is ongoing or if the information was simply deemed classified. However, to go to these lengths to deny the story makes me feel that Bloomberg may not have gotten all the facts straight.

jasonlotito 8y ago

Let's say Bloomberg did its due-diligence is telling the truth. That doesn't mean Apple here can't also be telling the truth as they see it. Bloomberg could have spoken to a few select individuals who shared things only they knew. I don't see any reason they couldn't have kept this hidden from others, allowing the upper management plausible deniability. These people lower on the totem pole could report to the government, and upper management could deny all day long. Couple this with my own personal experience with Apple sharing personal data it had no right to share, and the fact that only a single person signed this letter, and Bloomberg still not backing down, Apple has a way to go. They could start by having every person would would remotely be involved with something like this (from top to bottom) signing a legally binding letter attesting that Bloomberg's story is not true. Until you have this, it only takes one individual who hid something from Seniors to make this true.

busterarm 8y ago

Breaking: https://finance.yahoo.com/news/evidence-hacked-supermicro-hardware-found-150152882.html https://finance.yahoo.com/news/evidence-hacked-supermicro-ha...

tptacek 8y ago

If nothing else, this has to put to rest the "gag order" or "NSL" conspiracy theory.