3 ms·
> someone in the design lab (not in production) downloaded infected firmware from SM's support site Other than the claim that the infected firmware is "still h
by ams6110 8y ago
> someone in the design lab (not in production) downloaded infected firmware from SM's support site
Other than the claim that the infected firmware is "still hosted there" (which beggars belief) that sounds more like an engineer was spearphished and fooled into downloading firmware from what he believed to be the SM support site.
- andybak 8y agoThis is why public statements need a high level of detail to set the record straight.
- abalone 8y agoFYI "still" meant as of the time of the follow-up reporting in 2016, not today. I think it's believable that SuperMicro's support site got hacked. But I agree that was an incident on par with a sole developer installing malware on their system, not a supply chain compromise or major security incident with production systems.
- philipodonnell 8y agoIsn't hacking the support site a supply chain compromise? Much discussion about software supply chain attacks was around the role of NPM as a vector, which can be thought of as a source of "drivers" that make various products and services work, similar to the role that a support site for a physical manufacturer plays.
- abalone 8y agoI meant the supply chain for their data center. But I won’t split hairs.. yes support site compromise is a supplier problem and probably a factor in Apple shifting away. But clearly Apple had more protections in place for their production systems than what some dev installed in the design lab. So I think Apple’s denial is fair.