4 ms·
In the past, these Bloomberg reporters have misreported on NSA exploiting Heartbleed. Here is the Washington Post giving them shit about it:[1] As for the 2016
by abalone 8y ago
In the past, these Bloomberg reporters have misreported on NSA exploiting Heartbleed. Here is the Washington Post giving them shit about it:[1]
As for the 2016 incident, read Apple's denial more closely. They denied finding infected firmware on servers purchased from SuperMicro. What happened is someone in the design lab (not in production) downloaded infected firmware from SM's support site, where it was "still hosted".[2] While you might say Apple could have been clearer at the time, that is nothing like the very strong, clear, detailed denials at hand here.
[1] https://www.washingtonpost.com/blogs/erik-wemple/wp/2014/04/23/bloomberg-celebrates-challenged-story-on-the-nsa-and-heartbleed-bug/?noredirect=on&utm_term=.80bc2dac8b45 https://www.washingtonpost.com/blogs/erik-wemple/wp/2014/04/...
[2] https://arstechnica.com/information-technology/2017/02/apple-axed-supermicro-servers-from-datacenters-because-of-bad-firmware-update/ https://arstechnica.com/information-technology/2017/02/apple...
- ams6110 8y ago> someone in the design lab (not in production) downloaded infected firmware from SM's support site Other than the claim that the infected firmware is "still hosted there" (which beggars belief) that sounds more like an engineer was spearphished and fooled into downloading firmware from what he believed to be the SM support site.
- andybak 8y agoThis is why public statements need a high level of detail to set the record straight.
- abalone 8y agoFYI "still" meant as of the time of the follow-up reporting in 2016, not today. I think it's believable that SuperMicro's support site got hacked. But I agree that was an incident on par with a sole developer installing malware on their system, not a supply chain compromise or major security incident with production systems.
- philipodonnell 8y agoIsn't hacking the support site a supply chain compromise? Much discussion about software supply chain attacks was around the role of NPM as a vector, which can be thought of as a source of "drivers" that make various products and services work, similar to the role that a support site for a physical manufacturer plays.
- abalone 8y agoI meant the supply chain for their data center. But I won’t split hairs.. yes support site compromise is a supplier problem and probably a factor in Apple shifting away. But clearly Apple had more protections in place for their production systems than what some dev installed in the design lab. So I think Apple’s denial is fair.
- deleted 8y ago[deleted]
- mtgx 8y agoStill waiting for WashPost to disclose their owner's deals with the CIA whenever it publishes a post about the CIA...
- stochastic_monk 8y agoThere’s also that one time they published 16 anti-Sanders articles in 16 hours, probably because his ideas would reduce Amazon’s profits. [0] [0] https://www.democracynow.org/2016/3/11/headlines/washington_post_runs_16_anti_sanders_ads_in_16_hours https://www.democracynow.org/2016/3/11/headlines/washington_...
- gowld 8y agoA news website publishes many articles about hot topics. Is 16 a lot or a littler? Is that more or less than pro-Sanders or anti/pro-Clinton articles? DemocracyNow had nothing to say about that. Even though a complaint whose only evidence is one hand-assembled image shouldn't be taken seriously as an evidence-backed analysis, here goes: WaPo's response to that cherry-picking accusation (which included some strange cherries, like "Sanders stands up to Clinton's interruptions" being called a negative story): https://www.washingtonpost.com/news/the-fix/wp/2016/03/08/has-the-washington-post-been-too-hard-on-bernie-sanders-this-week/?utm_term=.cb807ae34600 https://www.washingtonpost.com/news/the-fix/wp/2016/03/08/ha... and the complaints ignored pro-Sanders and anti-Clintion articles from those same days. https://www.google.com/search?q=site:washingtonpost.com+clinton&tbs=cdr:1,cd_min:3/6/2016,cd_max:3/8/2016&tbm=nws https://www.google.com/search?q=site:washingtonpost.com+clin...
- stochastic_monk 8y agoThank you for the extra context. The reality is much less harsh than the article would have me believe.
- makomk 8y agoNot even infected firmware, an infected Windows driver package. Which, although embarrassing for Supermicro, is a lot less sophisticated or unusual an attack than anything being claimed.
- ColanR 8y ago> Bloomberg reporters have misreported on NSA exploiting Heartbleed Bad source given. The WP relies on NSA officials denying they used heartbleed. You believe that?
- parrellel 8y agoHalf the people's reactions here rely on them believing the US Security Apparatus and large corporations are... honest. God, people.
- netheril96 8y agoIsn't Bloomberg a large corporation itself?
- parrellel 8y agoI give their journalism arm a bit more credence than Apple's PR arm, let's put it that way.