3 ms·

> If any of the reported details cited above were true, we would have every interest—economic, regulatory, and ethical—to be forthcoming about it. That's the k

> If any of the reported details cited above were true, we would have every interest—economic, regulatory, and ethical—to be forthcoming about it. That's the key argument. This isn't just a "your word against mine" type of thing. Were this issue true, then it could represent a significant legal risk to Apple. Categorically denying something that can easily be proven by an external audit (a scenario that they cannot rule out might happen), as strongly worded as they did (excerpt below), would open them up to a huge legal liability in addition to the security issue itself, and for no real upside. > In the end, our internal investigations directly contradict every consequential assertion made in the article—some of which, we note, were based on a single anonymous source. Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server.

sandworm101 8y ago
>> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Then where are they buying their hardware? Every company that I've talked to who purchases electronics from China has had issues. Stuff isn't as ordered. Strange boards are added. You have to rigorously inspect everything. Nobody has told me about rice-sized stealth chips, but malware, old firmware (ie with known/public vulnerabilities) and under-spec parts are a norm in the industry. What seems odd about this Bloomberg story is the difference in intent. Rather than a supplier trying to save a few bucks, or a wayward employee inserting something to harvest CC details, they ascribe this to government conspiracy, to a cold war battle between secret squirrels.
- bilbo0s 8y ago
  The reason I'm skeptical of the story is that the people inspecting hardware at Apple are at least as smart as I am. If I would do a certain thing to inspect hardware and firmware, then that means Apple would do at least that thing. Those are brilliant hardware guys. I'm having a hard time seeing how you sneak something by them. I think maybe in the firmware? (But probably not. They've also got the most brilliant firmware security guys on the planet.) And on the off chance that this thing did slip by, a picture was provided of the purported part. It would have been a simple matter to go back through all of your audits looking for that part. Because if I'm smart enough to catalog and record my hardware audits, that means that Apple was doing so a looong time before I was. I don't know man? I'm getting more and more skeptical of this story by the day.
  - sandworm101 8y ago
    >> I'm having a hard time seeing how you sneak something by them. Apple orders in bulk. They aren't x-raying every server bound for their latest datacenter. I've worked with companies that do examine for every tiny imperfection. It costs thousands per-server and means significant and often random delays (defense industry). If apple, a publicly-traded company, were so rigorous they wouldn't be able to hide the costs. So we know they aren't. I'm sure that apple does inspect systems that it deems vital to its internal systems, but servers meant for customer use are too numerous.
  - jvzr 8y ago
    That chip picture is apparently a 'coupler' example photograph provided by Fitzpatrick, the security consultant. In the podcast mentioned below, he apparently was very astonished to find it as it means Bloomberg never saw the chip itself
  - rdlecler1 8y ago
    I’d assume it’s a sampling problem. Do they fully inspect every board? If they ship three modified boards for an entire data warehouse could that be sufficient?
- simonh 8y ago
  I don't understand why you are confused. It's the difference in intent that you mention in your last paragraph that Apple is referring to when they say 'purposefully planted'. That's they key allegation by Bloomberg, that these are demonstrably purposeful malicious hardware features.
saudioger 8y ago
They're already on the hook for an enormous liability if it's true, so lying about it isn't really the worst option if there's even a small chance it avoids the issue. After seeing what VW did with emissions, I wouldn't say any huge corporate cover-up is out of the question. Especially considering this situation would be very bad even if did happen and they were 100% truthful about it (it would create huge problems with China for them and their supply chain). We just can't reasonably make conclusions either way yet.
- SpikeDad 8y ago
  Not even the same. The VW coverup was to coverup a specific, fraudulent behavior by the company in an attempt to commit fraud. The Apple situation is basically a reporter with no named sources saying that Apple itself was fooled by outside sources. There's a HUGE difference between willful fraud (VW) and corporate embarrassment (Apple IF it was true).
  - saudioger 8y ago
    Well my point is that it could be corporate embarrassment AND willful fraud to cover up the corporate embarrassment. They have a huge incentive to lie, because even if they were truthful from the beginning and this did happen... it would be very bad for them. I also think this goes far beyond "embarrassment" — this is something that could potentially destroy Apple's supply chain.
- ckastner 8y ago
  > They're already on the hook for an enormous liability if it's true Correct, but this liability would (most probably) be based on showing some kind of negligence. > so lying about it isn't really the worst option if there's even a small chance it avoids the issue Deliberately lying about it would be fraud. Getting caught with that would dramatically increase the liability. Since you used the VW example: do you really think it would have cost VW something around the order of $30bn if some foreign power had manipulated their emissions test without their knowledge? Or that executives would have been arrested? > After seeing what VW did with emissions, I wouldn't say any huge corporate cover-up This isn't a cover-up, though. This is Apple expressly addressing the issue, and categorically denying every part of it. To everyone, up to and including Congress, no less.

sandworm101 8y ago

>> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Then where are they buying their hardware? Every company that I've talked to who purchases electronics from China has had issues. Stuff isn't as ordered. Strange boards are added. You have to rigorously inspect everything. Nobody has told me about rice-sized stealth chips, but malware, old firmware (ie with known/public vulnerabilities) and under-spec parts are a norm in the industry. What seems odd about this Bloomberg story is the difference in intent. Rather than a supplier trying to save a few bucks, or a wayward employee inserting something to harvest CC details, they ascribe this to government conspiracy, to a cold war battle between secret squirrels.

bilbo0s 8y ago
The reason I'm skeptical of the story is that the people inspecting hardware at Apple are at least as smart as I am. If I would do a certain thing to inspect hardware and firmware, then that means Apple would do at least that thing. Those are brilliant hardware guys. I'm having a hard time seeing how you sneak something by them. I think maybe in the firmware? (But probably not. They've also got the most brilliant firmware security guys on the planet.) And on the off chance that this thing did slip by, a picture was provided of the purported part. It would have been a simple matter to go back through all of your audits looking for that part. Because if I'm smart enough to catalog and record my hardware audits, that means that Apple was doing so a looong time before I was. I don't know man? I'm getting more and more skeptical of this story by the day.
- sandworm101 8y ago
  >> I'm having a hard time seeing how you sneak something by them. Apple orders in bulk. They aren't x-raying every server bound for their latest datacenter. I've worked with companies that do examine for every tiny imperfection. It costs thousands per-server and means significant and often random delays (defense industry). If apple, a publicly-traded company, were so rigorous they wouldn't be able to hide the costs. So we know they aren't. I'm sure that apple does inspect systems that it deems vital to its internal systems, but servers meant for customer use are too numerous.
- jvzr 8y ago
  That chip picture is apparently a 'coupler' example photograph provided by Fitzpatrick, the security consultant. In the podcast mentioned below, he apparently was very astonished to find it as it means Bloomberg never saw the chip itself
- rdlecler1 8y ago
  I’d assume it’s a sampling problem. Do they fully inspect every board? If they ship three modified boards for an entire data warehouse could that be sufficient?
simonh 8y ago
I don't understand why you are confused. It's the difference in intent that you mention in your last paragraph that Apple is referring to when they say 'purposefully planted'. That's they key allegation by Bloomberg, that these are demonstrably purposeful malicious hardware features.

saudioger 8y ago

They're already on the hook for an enormous liability if it's true, so lying about it isn't really the worst option if there's even a small chance it avoids the issue. After seeing what VW did with emissions, I wouldn't say any huge corporate cover-up is out of the question. Especially considering this situation would be very bad even if did happen and they were 100% truthful about it (it would create huge problems with China for them and their supply chain). We just can't reasonably make conclusions either way yet.

SpikeDad 8y ago
Not even the same. The VW coverup was to coverup a specific, fraudulent behavior by the company in an attempt to commit fraud. The Apple situation is basically a reporter with no named sources saying that Apple itself was fooled by outside sources. There's a HUGE difference between willful fraud (VW) and corporate embarrassment (Apple IF it was true).
- saudioger 8y ago
  Well my point is that it could be corporate embarrassment AND willful fraud to cover up the corporate embarrassment. They have a huge incentive to lie, because even if they were truthful from the beginning and this did happen... it would be very bad for them. I also think this goes far beyond "embarrassment" — this is something that could potentially destroy Apple's supply chain.
ckastner 8y ago
> They're already on the hook for an enormous liability if it's true Correct, but this liability would (most probably) be based on showing some kind of negligence. > so lying about it isn't really the worst option if there's even a small chance it avoids the issue Deliberately lying about it would be fraud. Getting caught with that would dramatically increase the liability. Since you used the VW example: do you really think it would have cost VW something around the order of $30bn if some foreign power had manipulated their emissions test without their knowledge? Or that executives would have been arrested? > After seeing what VW did with emissions, I wouldn't say any huge corporate cover-up This isn't a cover-up, though. This is Apple expressly addressing the issue, and categorically denying every part of it. To everyone, up to and including Congress, no less.