18 ms·

AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

461 points by magoghm 8y ago

wyldfire 8y ago
The denials seem convincing. And yet the story seems very much plausible. US NSA does these kinds of attacks, why not China? > They offered no proof, story kept changing, and showed no interest in our answers unless we could validate their theories If that's really the case then it seems likely that their source may have indeed deceived them. But don't they have multiple sources? > The article also claims ... we conducted a network-wide audit of SuperMicro motherboards and discovered the malicious chips in a Beijing data center. Bloomberg's source for this claim must be distinct from the Israeli security researcher, right? Perhaps, if this was a Russian HUMINT attack, it's another glorious success for GRU.
- bcruddy 8y ago
  The NSA has never done something on this scale. With sec researchers looking at _everything_ right now it would have been uncovered by now. The major point in this story wasn't a hardware hack, it was a hardware hack on a MASSIVE scale, a scale that would have to be treated as an act of war against the _rest of the world_. If this article were true it would have been the first public volley in WWIII.
  - LeifCarrotson 8y ago
    Why would this be treated as an act of war? Spy work happens all the time; it's a normal state of affairs. One country or company stealing secrets from another country or company happened today, whether or not the Bloomberg report holds water. It's only the first volley in WWIII if world militaries choose to escalate in response.
  - philwelch 8y ago
    The NSA works with the advantages they have, and likewise for China. For example, PRISM involves tapping communications within American service providers like Google and Facebook, which is an advantage to the NSA because these are American companies that are subject to US law, FISA warrants, etc, and yet foreign adversaries still use these services. China's advantage is manufacturing--the manufacturing is in China, within the control of the Chinese government, and yet the manufactured hardware is still exported to China's foreign adversaries--and the way to exploit that is to do something exactly like what Bloomberg is reporting.
  - moftz 8y ago
    The number of implants doesn't need to be that great. If you are already tapped into Supermicro's supply chain and ordering system, then you can already figure out when a bulk of servers passing through manufacturing are going out to a certain customer. Bribe someone or have an agent on the floor slip in the implant during assembly. Maybe the gerber files for the boards already have the necessary pads built-in for debug, maybe someone is swapping in modified gerbers. Maybe the implant is installed totally after hours when the boards are already built or when they are on their way to the final assembly facility.
- briandear 8y ago
  Plausible doesn’t mean “it happened.” It’s plausible that a convicted thief might steal again; that doesn’t give a news outlet to write, “anonymous sources said Joe Thief stole something from Target.” No evidence at all other than “Joe Thief” could have conceivably stolen something just because he happened to be at Target. A lot of things are “plausible” but accusing people of having done the thing versus, it would be possible doesn’t rise to the standards necessary to maintain journalistic integrity. Enough with printing anonymously sourced speculation as fact! Good journalists get sources on the record and, if they use anonymous sources, use them for background and not as primary sources. See Woodward and Berstein’s work on Watergate on how to use anonymous sources correctly.
- draw_down 8y ago
  It's plausible that any given person committed murder; people commit murder all the time. That does not imply your mom is a murderer.
nil_pointer 8y ago
[removed]
- gbin 8y ago
  What bothers me is that we have no proof and everything is vague. The motherboard needs to account for the chip at the PCB traces level to work right? Did anybody saw a weird 6 traces converging at a point for no reason on all the motherboards on the market? What is the exact model? Which bus it is fed from? Give me the name of the bus instead of vague journalistic stuff! Send pictures, output captures, anything.
  - bonestamp2 8y ago
    > Did anybody saw a weird 6 traces converging at a point for no reason on all the motherboards on the market? You do ask some good questions, but if apple can dropship my one macbook pro from China when I order it, I suspect they could dropship 1 (or many) of these boards to Apple, Amazon, etc when ordered. In other words, they wouldn't have to produce all of them with this special chip. Hell, they might only need to send one to each customer to infiltrate their network. If Apple ordered thousands of these, I doubt they would xray each one (assuming they're multi-layered boards).
    - coliveira 8y ago
      You seem to forget how difficult it is to manufacture a single unit of a mother board to achieve the effect you're imagining. Do you really think they have a production line where every week or so they create a different mother board adding this circuit? Why in the world would they create these additional costs, and is it even economically justifiable? This whole story seems each day worse, just like believing in Big Foot.
      - philwelch 8y ago
        The whole point of inserting malicious hardware for shadowy intelligence-related reasons is that you do it either out of government coercion or via government funding. I don't know why it's so implausible that Chinese intelligence is using the Chinese tech industry to carry out their operations when American intelligence uses the American tech industry to carry out their operations. Nobody said PRISM was fake news because why would Apple and Google and Facebook invest in it; the actual investment came from NSA and the cooperation of these companies is via top secret FISA warrants. China doesn't even need to maintain the pretense of legality that the NSA does. Again, I don't think the Bloomberg story by itself is credible anymore, but I also don't think it's as implausible as you are making it sound.
wpdev_63 8y ago
I really have little doubt that the Chinese are integrating their spy chips into computer hardware going to the big four or even the pentagon. It's probably how they stole the designs to the f-35[you know that plane that costs over a trillion dollars to develop]. It would catastrophic if apple knew or even acknowledges the possibility of the Chinese having a backdoor into their servers and would result in massive shift in policy[+profit]. The NSA has been known to intercept electronics in shipping and putting in their own specialized pcb board replacements with microphones, cameras, etc. and are _very_ hard to detect. Hell the Russian even went back to typewriters for security purposes[0]. It would be foolish to think that the Chinese/Russians aren't doing the same thing to us. [0]:https://www.telegraph.co.uk/news/worldnews/europe/russia/10173645/Kremlin-returns-to-typewriters-to-avoid-computer-leaks.html https://www.telegraph.co.uk/news/worldnews/europe/russia/101...
- shitloadofbooks 8y ago
  US companies are integrating fairly public "spy chips" in the form of Intel's ME and AMD's PSP. These have very little/no benefit for the average consumer.
  - wpdev_63 8y ago
    Well that hasn't been confirmed with all the research around it[0]. A spy chip/core doesn't need to be part of intel ime to be in there though. [0]:https://www.youtube.com/watch?v=wsmHmYxyoxg https://www.youtube.com/watch?v=wsmHmYxyoxg
- ceejayoz 8y ago
  While I'm sure there's all sorts of technological approaches in use, the Snowden incident showed a much easier method of stealing secrets.
  - reaperducer 8y ago
    Easier != only.
- 8y ago
sneak 8y ago
Why did these demands for retraction take so long?
- jackconnor 8y ago
  They quadruple-checked all their audits to make sure they were actually accurate in saying "nothing here".
  - macintux 8y ago
    Precisely. Worst thing would be to realize later you overlooked something and have to issue a correction. And a story with this many moving pieces, you’ve got a lot of ground to cover. It’s so very hard to prove the absence of something.
    - khana 8y ago
      One can posit the Bloomberg story (be it legit or not) led to a worthwhile task of US companies taking a pause and scrutinizing their hardware..
hckdff 8y ago
Call me a cynic, but the more these aholes call for a retraction the more I feel the story has legs. Even if it isn't true it's very plausibility is what scares them shitless.
- devoply 8y ago
  The main issue is that most of their stuff is manufactured in China, they see themselves taking a huge hit in profitability if the US all the sudden forced them to only do stuff in the US because of security.
  - mrybczyn 8y ago
    Yup. Their entire business success, their 1 trillion dolar story, all their "shareholder value" can be summed up by: "we don't build anything, the Chinese build it for us". Time to pay the piper.
    - frou_dh 8y ago
      You don't need to coin a phrase - they laser-etch this split right onto the product: https://i.imgur.com/lHMIz5N.jpg https://i.imgur.com/lHMIz5N.jpg
- JoshTko 8y ago
  So how should have Apple and Amazon acted if they were indeed truly innocent? Their behavior seems to be very consistent with what they are saying.
  - gregcrv 8y ago
    Maybe let's let the justice system figure things out?
    - simias 8y ago
      Is the justice system involved in any way at this point? Or are you suggesting that Apple and Amazon should sue for libel or something like that?
Steko 8y ago
An easy way Bloomberg could support their story: allow one or more of their "senior insider" sources at Apple/Amazon to speak with another outlet (AP, NYT, whoever) who agrees to maintain their anonymity.
- izaan 8y ago
  yeah, right.
- jackconnor 8y ago
  One of the interviewees did speak (though he's not apple or amazon), and said that Bloomberg completely misrepresented what he said to support this theory, which he totally disagrees with: https://9to5mac.com/2018/10/09/bloomberg/ https://9to5mac.com/2018/10/09/bloomberg/
  - appleiigs 8y ago
    The article you linked states, Bloomberg says: > Joe FitzPatrick was not one of these 17 individual primary sources that included company insiders and government officials,
    - jackconnor 8y ago
      Oh, he was one of the named sources. Good catch, though that doesn't change the point.
      - kevin_thibedeau 8y ago
        The entire story is an elaboration of a hypothetical example Fitzpatrick gave in consultation. That the final article is an exact match is seriously problematic.
- pvg 8y ago
  Who their sources choose to speak to is not up to Bloomberg.
jackconnor 8y ago
There should be hundreds of thousands or millions of these hacked motherboards, and nobody has found a single one despite hardware geeks worldwide searching like it was Willy Wonka's final golden ticket. This story was bogus, it most likely came from a ton of rumors that got conflated, hence why they had to go with anonymous sources as opposed to any physical evidence. I'd be surprised if Bloomberg has any credibility in tech journalism by the end of the year, and a good chance they may end up stuck in a courtroom trying to defend the decision to run this piece (on the front page, no less) for a long, long time.
- 1001101 8y ago
  > hardware geeks worldwide searching like it was Willy Wonka's final golden ticket. The stuff of dreams for security researchers.
- compcoffee 8y ago
  >I'd be surprised if Bloomberg has any credibility in tech journalism If the tech world turns their back on Bloomberg, I'll give them more credibility; not less.
  - jackconnor 8y ago
    I'm curious too. This seems like a sides thing, and of course a lot of people are anti-tech these days. But, to side with the publisher of garbage tech journalism just because you don't like tech seems a little counter-productive. You can hate tech people without willfully believing things you know are false.
  - wepple 8y ago
    I’m curious; why?
- ElBarto 8y ago
  Assuming the story is real it is quite obvious that there aren't that many compromised motherboards. It wouldn't make sense and it would make the attack easier to detect and to publicly incriminate the culprit. As the attack is said to have been discovered 3 years ago it is also not surprising that housekeeping has already been done a long time ago.
elejo 8y ago
Elephant in the room: we shouldn't trust journalists to begin with.
- unethical_ban 8y ago
  This is a pretty cavalier comment for a brand new poster. Welcome to Hacker News, where deep discussion is welcome. The issue with trust in journalism is a real one, and as "deepfakes" and the current problems with the perceptions of "fake news" and "anything I don't like to hear is probably made up", the question of faith/trust in journalism and reporting is huge. I don't think trust in journalism should go down. I think that when journalists and publications are caught with misleading or inaccurate stories, it should be in their interest to catch the problems and self-correct. The name of an institution is its integrity: It is built over time, and can lose its value quicker than it gains it. There are correct ways to do journalism.
  - nineeightseven 8y ago
    Unfortunately it's not in their interest to self-correct, it's only in their interests to generate clicks.
  - Karunamon 8y ago
    Aye, only when the incentives align. The proliferation of clickbait, native ads, and lack of consequences (social or otherwise) for poor vetting or lying outright... “Journalistic integrity” is quickly on its way to becoming a pejorative term, if it’s not already there.
- deleted 8y ago
  [deleted]
jorblumesea 8y ago
Surely at least a few of these boards should be floating around, can't Bloomberg or others dig up a few physical examples? Unlike software 0 days or other more ephemeral issues this should be hard to conceal and easy to reproduce.
kevinmchugh 8y ago
As a press outlet they have a pretty solid defense in the first amendment
- jackconnor 8y ago
  Well yes, haha, but if they knew or should've known that what they were reported was false and it causes monetary damages, then they can be taken to civil court. So, if they are sued they will be fighting to prove that they believed this article was true when they published it. Since Joe Fitzpatrick, one of the sources, has already come out and said that he speculated some hypotheticals that then made it into the story as fact, it doesn't seem that hard to prove that they published something they weren't sure was fact, which did cause a lot of monetary damages to quite a few companies.
  - rconti 8y ago
    It's the same thing as "Funding secured!"
    - kevinmchugh 8y ago
      except that: bloomberg is a press outlet, musk isn't, and bloomberg has no responsibility to the shareholders of the companies they covered, whereas musk is CEO.
- hn_throwaway_99 8y ago
  Tell that to Gawker.
  - ascagnel_ 8y ago
    Gawker was bankrupted because they were stupid -- they were ordered by a judge to take down a video, and defied that court order. If you knowingly and intentionally defy a court order, and then gloat about how you're doing it, you're going to get burnt by any judge, no matter how willing they are to listen to your core argument.
- 8y ago
IOT_Apprentice 8y ago
2016 report by ARS Technica: https://arstechnica.com/information-technology/2016/03/report-apple-designing-its-own-servers-to-avoid-snooping/ https://arstechnica.com/information-technology/2016/03/repor... 2017 followup by ARS Technica: https://arstechnica.com/information-technology/2017/02/apple-axed-supermicro-servers-from-datacenters-because-of-bad-firmware-update/ https://arstechnica.com/information-technology/2017/02/apple... So the story is 2 years old from a reporting standpoint.
- acqq 8y ago
  But the article points that Apple wanted to protect themselves from some much more widely know threats: "Building its own servers with motherboards it designed would be the most surefire way for Apple to prevent unauthorized snooping via extra chips. As we've previously reported, the National Security Agency is known to intercept and modify equipment before it reaches the hands of its intended customers." ... "The report comes as Apple fights the US government over whether it should have to write new software to help investigators unlock an iPhone used by a terrorist."
- simonh 8y ago
  Dodgy firmware is nothing new, it’s just compromised code after all.
  - krn 8y ago
    According to Bloomberg, that's how everything started: > Apple made its discovery of suspicious chips inside Supermicro servers around May 2015, after detecting odd network activity and firmware problems, according to a person familiar with the timeline. Two of the senior Apple insiders say the company reported the incident to the FBI but kept details about what it had detected tightly held, even internally. Government investigators were still chasing clues on their own when Amazon made its discovery and gave them access to sabotaged hardware, according to one U.S. official. This created an invaluable opportunity for intelligence agencies and the FBI—by then running a full investigation led by its cyber- and counterintelligence teams—to see what the chips looked like and how they worked. If this was true, the public denials wouldn't surprise me at all.
fanzhang 8y ago
The lack of confirming evidence is a strong sign the Bloomberg reporters were played. It's interesting to wonder who might have done that though -- US businesses who might gain? Those from within the administration? Regardless of the truthfulness of the report, the damage is done and the hack story fits in well for the protectionist trajectory the US is taking.
- deleted 8y ago
  [deleted]
- lallysingh 8y ago
  Supermicro short sellers?
  - deleted 8y ago
    [deleted]
- noobermin 8y ago
  There's no need to think so big. The people who thought they might gain might have very well been Bloomberg reporters, who really wanted to believe their story was true because it would have been the scoop of a lifetime. They really should have done their homework properly instead of trying to craft a story. Of course, if it turns out they deliberately mislead, then that makes it worse, and it was very imprudent thinking that they wouldn't be caught.
- leoc 8y ago
  It's certainly not the case that the US government has been above disinformation campaigns aimed at its own citizens even in the recent https://www.wired.co.uk/article/mirage-men https://www.wired.co.uk/article/mirage-men https://www.dailygrail.com/2013/06/a-fractured-hall-of-mirrors/ https://www.dailygrail.com/2013/06/a-fractured-hall-of-mirro... or very recent https://www.nytimes.com/2017/12/16/us/politics/pentagon-program-ufo-harry-reid.html https://www.nytimes.com/2017/12/16/us/politics/pentagon-prog... past. Though of course there would be much more political risk in lying to Bloomberg News than in using up and throwing away an old ufologist loser like Paul Bennewitz. (Still, it's even a little suprising how, in a country which avows military patriotism as strongly as the USA, the USAF can contribute to the destruction of a patriotic WWII veteran, then publicly gloat about it afterwards, and absolutely no-one gives two shits.)
clamprecht 8y ago
If Bloomberg ends up retracting the story, then the new question, for me, is how did this happen? Was it simply Bloomberg trying to get views? Or is it more interesting, like did their "sources" intentionally give them a fake story in order to hurt their credibility? Or was it to cast doubt on the anti-China stories in general?
- jahlove 8y ago
  It should be pointed out that Bloomberg authors get bonuses if they write stories that move the market: https://www.businessinsider.com/bloomberg-reporters-compensation-2013-12 https://www.businessinsider.com/bloomberg-reporters-compensa... Not saying that was necessarily a motivation here, but it's worth pointing out.
  - deleted 8y ago
    [deleted]
  - justtopost 8y ago
    Keep parroting this if you want, but that ended in 2014.
- spydum 8y ago
  I can’t help resist the thought: this was planted for political purposes. 1. If people buy the narrative, it works as anti-China talking points and we continue to villanize China and look for US to step up manufacturing of tech. 2. If it blows up and backfires, we get to villanize journalism as a profession and push for government takeover of media to ensure honest and integrity above profit (eg fakenews). By planted story, I mean insiders or impostors feeding lies to journalists- tho I would hope Bloomberg would know how to vet a source?
  - 5minbreak 8y ago
    Agree on 2. If only someone in the US administration really hated what he calls "Fake News" by established media and "Made-up anonymous sources". "Won't anybody think of the poor economy! These unfounded stories are doing direct damage. Disclose your sources to the government or lose your Real News License."
fredgrott 8y ago
are they aware statements like this confirm it? If it were false the case would fall under libel and slander. Someone is obfuscating truths here
- panopticon 8y ago
  Libel and defamation lawsuits are tricky because one would need to prove that Bloomberg ran the story knowing it was false or ran the story with "reckless disregard" for the factual accuracy of the reporting and prove that the article resulted in damage to the plaintiff. Many dubious articles go unchallenged because it's often not worth pursuing legal action.
  - CosmicShadow 8y ago
    It's not like these companies don't have the money or legal resources to do it though.
markoutso 8y ago
With the "trade war" going on I wouldn't be surprised if this was intentionally put out in order to reduce the us dependency on china.
- techntoke 8y ago
  Overpriced corrupt vendors are likely hurting to open compute designs and hardware.
buttholesurfer 8y ago
BuzzFeed is fake news run by idiots. Look at the article (s) they have now on their front page... It's nothing but college age "editors" who are "googling" things and looking at Twitter for content. I know it'll be an unpopular opinion on here but they are a huge source of bullshit on the internet.
Overtonwindow 8y ago
That’s well and good and all...but it’s in Amazon and Apple’s best interest to deny everything.
- greglindahl 8y ago
  It is? They're both public companies. If they get caught having strongly denied something that's true, that's worse than no comment, and the inevitable stock market motion and shareholder lawsuits that will result.
- simias 8y ago
  I still haven't heard a compelling argument for that. The only plausible reasons I've heard for Apple and Amazon lying about that are because they're being pressured by the American and/or Chinese governments. And if that's what's going on they're really going the extra mile with these calls for retraction. I don't really buy it, if they really wanted to gaslight Bloomberg they could do it more subtly and without putting themselves in such an awkward position if strong contradicting evidence came to light.
code4tee 8y ago
It’s really starting to smell like Bloomberg got played hard here. To preserve their journalistic integrity they either need to produce some supporting evidence real fast or admit they screwed up and retract the story.
- kristianov 8y ago
  Smells more and more like something 4chan would do.
ariwilson 8y ago
Why was Google not affected by these Supermicro motherboards?
- trhway 8y ago
  From my scouring some time ago on Ebay Google seems to use board designs modified and produces to their specs from some Taywan nonames. So while they also can potentially be similarly attacked, it wouldn't be the same attack. Wrt. the subj of the Bloomberg story - back in 90ies Russian FSB would comb through the internals of every PCs they bought for their use. That though was before Intel ME :)
williesleg 8y ago
Well that took a long time.
simonebrunozzi 8y ago
(disclaimer: I worked at AWS from 2008 to 2014 as Technology Evangelist, and know Andy Jassy personally) I know nothing specific about the issue per se, but I am convinced that Andy Jassy is speaking the truth here, for two reasons: 1) I've never seen a company as obsessed with security as AWS, and/or with such a big budget for security. 2) There's so many actors/employees involved in the audits, security, etc, that convincing some of them to "hide" a fact like this would be just too risky for a company that big. If that were really the case, I would rather work on a contingency plan, assuming that sooner or later the "leak" would come out. There is a tiny chance that something bad happened, and that Amazon's magic PR twist managed to still provide a truthful statement (Steve Schmidt) while hiding that. "A chance", because of the various back and forth business between AWS and Chinese companies. "Tiny", because other scenarios are much more probable and plausible. This looks like a very poor example of journalism, on Bloomberg's side. On a different note, I still believe that weird/illegal stuff keeps going on between companies and governments worldwide, for the simple reason that these things keep coming up when there's a new leak, or when secrecy on certain classified documents gets lifted or expires.
- wpdev_63 8y ago
  If you can disclose, what kind of security audits do you perform on your server hardware?
  - VectorLock 8y ago
    I'd like to know this as well. Not many can match the resources that AWS has so what actual checks are they doing of the hardware they receive from overseas suppliers? There is going to be "don't tip your security hand" reticence to share so I doubt we'll get any straight answers.
- smokeyj 8y ago
  https://en.wikipedia.org/wiki/Alex_Stamos#Yahoo https://en.wikipedia.org/wiki/Alex_Stamos#Yahoo! Any move like this would start with the CEO. We have no idea if it’s a “hack” or a hush-hush back door provided by the feds. Let Bezos the pentagon lapdog give official statements instead.
abalone 8y ago
Gruber doesn't get posted on HN much for some reason but he found a great tidbit on this: The reporters were flippantly dismissive of the (strong and repeated) company denials.[1] Jordan Robertson was on TV saying companies have no "advantage" in "confirming" his reporting because "no consumer data [was] stolen." He seems to take very casually the distinction between "not disclosing" something and outright lying and engaging in an industry-wide conspiracy about it. He later tried to walk back that line but it's an interesting window into their mindset. It doesn't strike me as particularly strong journalistic reasoning. [1] https://daringfireball.net/linked/2018/10/22/jassy-bloomberg-should-retract https://daringfireball.net/linked/2018/10/22/jassy-bloomberg...
jonbronson 8y ago
What's more plausible in this scenario: One or two journalists run a fake story, possibly for financial gain or simply notoriety, or that hundreds and even thousands of engineers and managers across multiple tech companies are all complicit in the most elaborate and coordinated corporate conspiracy in history, all just to hide the fact that they were breached...
- panda888888 8y ago
  It's possible that the hack wasn't that big (targeted to only certain boards) and that the higher-ups at the companies don't know the details
duxup 8y ago
Any reason for these calls for retraction? It's not like there aren't false stories about what happens at Apple or Amazon regularly, not that they're usually about hacking but the public calls for retraction seem somewhat as unique as the story.
- panda888888 8y ago
  Agreed. The pointed denials make the whole thing even weirder.
- creeble 8y ago
  But this is about hacking / being hacked. You would be sure to see a denial in that case.
newscracker 8y ago
I said it recently in different words and I'll say it again. There is no good ending for Bloomberg in this story, or at least for the reporters on the story and the editor who let it run. The longer it digs its heels in adamantly and doesn't retract this story, the worse it's going to get. Its deep pockets can handle a huge scandal and embarrassment for a while, but it'll face the ignominy of being ignored by sources in many circles if it doesn't act quickly (one of the ways, perhaps, would be to reveal more information that can be verified by third parties). It's as sticky a situation as it gets, and it will define/decimate Bloomberg for the future.
sbr464 8y ago
I’m curious how the internal meeting (at the newspaper) goes, when they have no actual proof, such as an actual compromised device. How could you possibly publish such a huge/important story without that smoking gun? We live in too much of a scientific/fact driven period of time to allow this to be taken seriously in my opinion.
Paraesthetic 8y ago
Sounds like they are running scared? Could this be a cover up do you think?
tinkerteller 8y ago
What's up with calling these division leads as "CEO"? Do they only answer to the board elected by shareholders?
the_other_guy 8y ago
It's not fake news unless you hurt me!
nova22033 8y ago
This story probably came from someone in the national security establishment who has zero understanding of the underlying technology but has a vested interest in the red scare..

461 points by magoghm 8y ago

The denials seem convincing. And yet the story seems very much plausible. US NSA does these kinds of attacks, why not China? > They offered no proof, story kept changing, and showed no interest in our answers unless we could validate their theories If that's really the case then it seems likely that their source may have indeed deceived them. But don't they have multiple sources? > The article also claims ... we conducted a network-wide audit of SuperMicro motherboards and discovered the malicious chips in a Beijing data center. Bloomberg's source for this claim must be distinct from the Israeli security researcher, right? Perhaps, if this was a Russian HUMINT attack, it's another glorious success for GRU.

bcruddy 8y ago
The NSA has never done something on this scale. With sec researchers looking at _everything_ right now it would have been uncovered by now. The major point in this story wasn't a hardware hack, it was a hardware hack on a MASSIVE scale, a scale that would have to be treated as an act of war against the _rest of the world_. If this article were true it would have been the first public volley in WWIII.
- LeifCarrotson 8y ago
  Why would this be treated as an act of war? Spy work happens all the time; it's a normal state of affairs. One country or company stealing secrets from another country or company happened today, whether or not the Bloomberg report holds water. It's only the first volley in WWIII if world militaries choose to escalate in response.
- philwelch 8y ago
  The NSA works with the advantages they have, and likewise for China. For example, PRISM involves tapping communications within American service providers like Google and Facebook, which is an advantage to the NSA because these are American companies that are subject to US law, FISA warrants, etc, and yet foreign adversaries still use these services. China's advantage is manufacturing--the manufacturing is in China, within the control of the Chinese government, and yet the manufactured hardware is still exported to China's foreign adversaries--and the way to exploit that is to do something exactly like what Bloomberg is reporting.
- moftz 8y ago
  The number of implants doesn't need to be that great. If you are already tapped into Supermicro's supply chain and ordering system, then you can already figure out when a bulk of servers passing through manufacturing are going out to a certain customer. Bribe someone or have an agent on the floor slip in the implant during assembly. Maybe the gerber files for the boards already have the necessary pads built-in for debug, maybe someone is swapping in modified gerbers. Maybe the implant is installed totally after hours when the boards are already built or when they are on their way to the final assembly facility.
briandear 8y ago
Plausible doesn’t mean “it happened.” It’s plausible that a convicted thief might steal again; that doesn’t give a news outlet to write, “anonymous sources said Joe Thief stole something from Target.” No evidence at all other than “Joe Thief” could have conceivably stolen something just because he happened to be at Target. A lot of things are “plausible” but accusing people of having done the thing versus, it would be possible doesn’t rise to the standards necessary to maintain journalistic integrity. Enough with printing anonymously sourced speculation as fact! Good journalists get sources on the record and, if they use anonymous sources, use them for background and not as primary sources. See Woodward and Berstein’s work on Watergate on how to use anonymous sources correctly.
draw_down 8y ago
It's plausible that any given person committed murder; people commit murder all the time. That does not imply your mom is a murderer.

nil_pointer 8y ago

[removed]

gbin 8y ago
What bothers me is that we have no proof and everything is vague. The motherboard needs to account for the chip at the PCB traces level to work right? Did anybody saw a weird 6 traces converging at a point for no reason on all the motherboards on the market? What is the exact model? Which bus it is fed from? Give me the name of the bus instead of vague journalistic stuff! Send pictures, output captures, anything.
- bonestamp2 8y ago
  > Did anybody saw a weird 6 traces converging at a point for no reason on all the motherboards on the market? You do ask some good questions, but if apple can dropship my one macbook pro from China when I order it, I suspect they could dropship 1 (or many) of these boards to Apple, Amazon, etc when ordered. In other words, they wouldn't have to produce all of them with this special chip. Hell, they might only need to send one to each customer to infiltrate their network. If Apple ordered thousands of these, I doubt they would xray each one (assuming they're multi-layered boards).
  - coliveira 8y ago
    You seem to forget how difficult it is to manufacture a single unit of a mother board to achieve the effect you're imagining. Do you really think they have a production line where every week or so they create a different mother board adding this circuit? Why in the world would they create these additional costs, and is it even economically justifiable? This whole story seems each day worse, just like believing in Big Foot.
    - philwelch 8y ago
      The whole point of inserting malicious hardware for shadowy intelligence-related reasons is that you do it either out of government coercion or via government funding. I don't know why it's so implausible that Chinese intelligence is using the Chinese tech industry to carry out their operations when American intelligence uses the American tech industry to carry out their operations. Nobody said PRISM was fake news because why would Apple and Google and Facebook invest in it; the actual investment came from NSA and the cooperation of these companies is via top secret FISA warrants. China doesn't even need to maintain the pretense of legality that the NSA does. Again, I don't think the Bloomberg story by itself is credible anymore, but I also don't think it's as implausible as you are making it sound.

wpdev_63 8y ago

I really have little doubt that the Chinese are integrating their spy chips into computer hardware going to the big four or even the pentagon. It's probably how they stole the designs to the f-35[you know that plane that costs over a trillion dollars to develop]. It would catastrophic if apple knew or even acknowledges the possibility of the Chinese having a backdoor into their servers and would result in massive shift in policy[+profit]. The NSA has been known to intercept electronics in shipping and putting in their own specialized pcb board replacements with microphones, cameras, etc. and are _very_ hard to detect. Hell the Russian even went back to typewriters for security purposes[0]. It would be foolish to think that the Chinese/Russians aren't doing the same thing to us. [0]:https://www.telegraph.co.uk/news/worldnews/europe/russia/10173645/Kremlin-returns-to-typewriters-to-avoid-computer-leaks.html https://www.telegraph.co.uk/news/worldnews/europe/russia/101...

shitloadofbooks 8y ago
US companies are integrating fairly public "spy chips" in the form of Intel's ME and AMD's PSP. These have very little/no benefit for the average consumer.
- wpdev_63 8y ago
  Well that hasn't been confirmed with all the research around it[0]. A spy chip/core doesn't need to be part of intel ime to be in there though. [0]:https://www.youtube.com/watch?v=wsmHmYxyoxg https://www.youtube.com/watch?v=wsmHmYxyoxg
ceejayoz 8y ago
While I'm sure there's all sorts of technological approaches in use, the Snowden incident showed a much easier method of stealing secrets.
- reaperducer 8y ago
  Easier != only.
8y ago

sneak 8y ago

Why did these demands for retraction take so long?

jackconnor 8y ago
They quadruple-checked all their audits to make sure they were actually accurate in saying "nothing here".
- macintux 8y ago
  Precisely. Worst thing would be to realize later you overlooked something and have to issue a correction. And a story with this many moving pieces, you’ve got a lot of ground to cover. It’s so very hard to prove the absence of something.
  - khana 8y ago
    One can posit the Bloomberg story (be it legit or not) led to a worthwhile task of US companies taking a pause and scrutinizing their hardware..

hckdff 8y ago

Call me a cynic, but the more these aholes call for a retraction the more I feel the story has legs. Even if it isn't true it's very plausibility is what scares them shitless.

devoply 8y ago
The main issue is that most of their stuff is manufactured in China, they see themselves taking a huge hit in profitability if the US all the sudden forced them to only do stuff in the US because of security.
- mrybczyn 8y ago
  Yup. Their entire business success, their 1 trillion dolar story, all their "shareholder value" can be summed up by: "we don't build anything, the Chinese build it for us". Time to pay the piper.
  - frou_dh 8y ago
    You don't need to coin a phrase - they laser-etch this split right onto the product: https://i.imgur.com/lHMIz5N.jpg https://i.imgur.com/lHMIz5N.jpg
JoshTko 8y ago
So how should have Apple and Amazon acted if they were indeed truly innocent? Their behavior seems to be very consistent with what they are saying.
- gregcrv 8y ago
  Maybe let's let the justice system figure things out?
  - simias 8y ago
    Is the justice system involved in any way at this point? Or are you suggesting that Apple and Amazon should sue for libel or something like that?

Steko 8y ago

An easy way Bloomberg could support their story: allow one or more of their "senior insider" sources at Apple/Amazon to speak with another outlet (AP, NYT, whoever) who agrees to maintain their anonymity.

izaan 8y ago
yeah, right.
jackconnor 8y ago
One of the interviewees did speak (though he's not apple or amazon), and said that Bloomberg completely misrepresented what he said to support this theory, which he totally disagrees with: https://9to5mac.com/2018/10/09/bloomberg/ https://9to5mac.com/2018/10/09/bloomberg/
- appleiigs 8y ago
  The article you linked states, Bloomberg says: > Joe FitzPatrick was not one of these 17 individual primary sources that included company insiders and government officials,
  - jackconnor 8y ago
    Oh, he was one of the named sources. Good catch, though that doesn't change the point.
    - kevin_thibedeau 8y ago
      The entire story is an elaboration of a hypothetical example Fitzpatrick gave in consultation. That the final article is an exact match is seriously problematic.
pvg 8y ago
Who their sources choose to speak to is not up to Bloomberg.

jackconnor 8y ago

There should be hundreds of thousands or millions of these hacked motherboards, and nobody has found a single one despite hardware geeks worldwide searching like it was Willy Wonka's final golden ticket. This story was bogus, it most likely came from a ton of rumors that got conflated, hence why they had to go with anonymous sources as opposed to any physical evidence. I'd be surprised if Bloomberg has any credibility in tech journalism by the end of the year, and a good chance they may end up stuck in a courtroom trying to defend the decision to run this piece (on the front page, no less) for a long, long time.

1001101 8y ago
> hardware geeks worldwide searching like it was Willy Wonka's final golden ticket. The stuff of dreams for security researchers.
compcoffee 8y ago
>I'd be surprised if Bloomberg has any credibility in tech journalism If the tech world turns their back on Bloomberg, I'll give them more credibility; not less.
- jackconnor 8y ago
  I'm curious too. This seems like a sides thing, and of course a lot of people are anti-tech these days. But, to side with the publisher of garbage tech journalism just because you don't like tech seems a little counter-productive. You can hate tech people without willfully believing things you know are false.
- wepple 8y ago
  I’m curious; why?
ElBarto 8y ago
Assuming the story is real it is quite obvious that there aren't that many compromised motherboards. It wouldn't make sense and it would make the attack easier to detect and to publicly incriminate the culprit. As the attack is said to have been discovered 3 years ago it is also not surprising that housekeeping has already been done a long time ago.

elejo 8y ago

Elephant in the room: we shouldn't trust journalists to begin with.

unethical_ban 8y ago
This is a pretty cavalier comment for a brand new poster. Welcome to Hacker News, where deep discussion is welcome. The issue with trust in journalism is a real one, and as "deepfakes" and the current problems with the perceptions of "fake news" and "anything I don't like to hear is probably made up", the question of faith/trust in journalism and reporting is huge. I don't think trust in journalism should go down. I think that when journalists and publications are caught with misleading or inaccurate stories, it should be in their interest to catch the problems and self-correct. The name of an institution is its integrity: It is built over time, and can lose its value quicker than it gains it. There are correct ways to do journalism.
- nineeightseven 8y ago
  Unfortunately it's not in their interest to self-correct, it's only in their interests to generate clicks.
- Karunamon 8y ago
  Aye, only when the incentives align. The proliferation of clickbait, native ads, and lack of consequences (social or otherwise) for poor vetting or lying outright... “Journalistic integrity” is quickly on its way to becoming a pejorative term, if it’s not already there.
deleted 8y ago
[deleted]

jorblumesea 8y ago

Surely at least a few of these boards should be floating around, can't Bloomberg or others dig up a few physical examples? Unlike software 0 days or other more ephemeral issues this should be hard to conceal and easy to reproduce.

kevinmchugh 8y ago

As a press outlet they have a pretty solid defense in the first amendment

jackconnor 8y ago
Well yes, haha, but if they knew or should've known that what they were reported was false and it causes monetary damages, then they can be taken to civil court. So, if they are sued they will be fighting to prove that they believed this article was true when they published it. Since Joe Fitzpatrick, one of the sources, has already come out and said that he speculated some hypotheticals that then made it into the story as fact, it doesn't seem that hard to prove that they published something they weren't sure was fact, which did cause a lot of monetary damages to quite a few companies.
- rconti 8y ago
  It's the same thing as "Funding secured!"
  - kevinmchugh 8y ago
    except that: bloomberg is a press outlet, musk isn't, and bloomberg has no responsibility to the shareholders of the companies they covered, whereas musk is CEO.
hn_throwaway_99 8y ago
Tell that to Gawker.
- ascagnel_ 8y ago
  Gawker was bankrupted because they were stupid -- they were ordered by a judge to take down a video, and defied that court order. If you knowingly and intentionally defy a court order, and then gloat about how you're doing it, you're going to get burnt by any judge, no matter how willing they are to listen to your core argument.
8y ago

IOT_Apprentice 8y ago

2016 report by ARS Technica: https://arstechnica.com/information-technology/2016/03/report-apple-designing-its-own-servers-to-avoid-snooping/ https://arstechnica.com/information-technology/2016/03/repor... 2017 followup by ARS Technica: https://arstechnica.com/information-technology/2017/02/apple-axed-supermicro-servers-from-datacenters-because-of-bad-firmware-update/ https://arstechnica.com/information-technology/2017/02/apple... So the story is 2 years old from a reporting standpoint.

acqq 8y ago
But the article points that Apple wanted to protect themselves from some much more widely know threats: "Building its own servers with motherboards it designed would be the most surefire way for Apple to prevent unauthorized snooping via extra chips. As we've previously reported, the National Security Agency is known to intercept and modify equipment before it reaches the hands of its intended customers." ... "The report comes as Apple fights the US government over whether it should have to write new software to help investigators unlock an iPhone used by a terrorist."
simonh 8y ago
Dodgy firmware is nothing new, it’s just compromised code after all.
- krn 8y ago
  According to Bloomberg, that's how everything started: > Apple made its discovery of suspicious chips inside Supermicro servers around May 2015, after detecting odd network activity and firmware problems, according to a person familiar with the timeline. Two of the senior Apple insiders say the company reported the incident to the FBI but kept details about what it had detected tightly held, even internally. Government investigators were still chasing clues on their own when Amazon made its discovery and gave them access to sabotaged hardware, according to one U.S. official. This created an invaluable opportunity for intelligence agencies and the FBI—by then running a full investigation led by its cyber- and counterintelligence teams—to see what the chips looked like and how they worked. If this was true, the public denials wouldn't surprise me at all.

fanzhang 8y ago

The lack of confirming evidence is a strong sign the Bloomberg reporters were played. It's interesting to wonder who might have done that though -- US businesses who might gain? Those from within the administration? Regardless of the truthfulness of the report, the damage is done and the hack story fits in well for the protectionist trajectory the US is taking.

deleted 8y ago
[deleted]
lallysingh 8y ago
Supermicro short sellers?
- deleted 8y ago
  [deleted]
noobermin 8y ago
There's no need to think so big. The people who thought they might gain might have very well been Bloomberg reporters, who really wanted to believe their story was true because it would have been the scoop of a lifetime. They really should have done their homework properly instead of trying to craft a story. Of course, if it turns out they deliberately mislead, then that makes it worse, and it was very imprudent thinking that they wouldn't be caught.
leoc 8y ago
It's certainly not the case that the US government has been above disinformation campaigns aimed at its own citizens even in the recent https://www.wired.co.uk/article/mirage-men https://www.wired.co.uk/article/mirage-men https://www.dailygrail.com/2013/06/a-fractured-hall-of-mirrors/ https://www.dailygrail.com/2013/06/a-fractured-hall-of-mirro... or very recent https://www.nytimes.com/2017/12/16/us/politics/pentagon-program-ufo-harry-reid.html https://www.nytimes.com/2017/12/16/us/politics/pentagon-prog... past. Though of course there would be much more political risk in lying to Bloomberg News than in using up and throwing away an old ufologist loser like Paul Bennewitz. (Still, it's even a little suprising how, in a country which avows military patriotism as strongly as the USA, the USAF can contribute to the destruction of a patriotic WWII veteran, then publicly gloat about it afterwards, and absolutely no-one gives two shits.)

clamprecht 8y ago

If Bloomberg ends up retracting the story, then the new question, for me, is how did this happen? Was it simply Bloomberg trying to get views? Or is it more interesting, like did their "sources" intentionally give them a fake story in order to hurt their credibility? Or was it to cast doubt on the anti-China stories in general?

jahlove 8y ago
It should be pointed out that Bloomberg authors get bonuses if they write stories that move the market: https://www.businessinsider.com/bloomberg-reporters-compensation-2013-12 https://www.businessinsider.com/bloomberg-reporters-compensa... Not saying that was necessarily a motivation here, but it's worth pointing out.
- deleted 8y ago
  [deleted]
- justtopost 8y ago
  Keep parroting this if you want, but that ended in 2014.
spydum 8y ago
I can’t help resist the thought: this was planted for political purposes. 1. If people buy the narrative, it works as anti-China talking points and we continue to villanize China and look for US to step up manufacturing of tech. 2. If it blows up and backfires, we get to villanize journalism as a profession and push for government takeover of media to ensure honest and integrity above profit (eg fakenews). By planted story, I mean insiders or impostors feeding lies to journalists- tho I would hope Bloomberg would know how to vet a source?
- 5minbreak 8y ago
  Agree on 2. If only someone in the US administration really hated what he calls "Fake News" by established media and "Made-up anonymous sources". "Won't anybody think of the poor economy! These unfounded stories are doing direct damage. Disclose your sources to the government or lose your Real News License."

fredgrott 8y ago

are they aware statements like this confirm it? If it were false the case would fall under libel and slander. Someone is obfuscating truths here

panopticon 8y ago
Libel and defamation lawsuits are tricky because one would need to prove that Bloomberg ran the story knowing it was false or ran the story with "reckless disregard" for the factual accuracy of the reporting and prove that the article resulted in damage to the plaintiff. Many dubious articles go unchallenged because it's often not worth pursuing legal action.
- CosmicShadow 8y ago
  It's not like these companies don't have the money or legal resources to do it though.

markoutso 8y ago

With the "trade war" going on I wouldn't be surprised if this was intentionally put out in order to reduce the us dependency on china.

techntoke 8y ago
Overpriced corrupt vendors are likely hurting to open compute designs and hardware.

buttholesurfer 8y ago

BuzzFeed is fake news run by idiots. Look at the article (s) they have now on their front page... It's nothing but college age "editors" who are "googling" things and looking at Twitter for content. I know it'll be an unpopular opinion on here but they are a huge source of bullshit on the internet.

Overtonwindow 8y ago

That’s well and good and all...but it’s in Amazon and Apple’s best interest to deny everything.

greglindahl 8y ago
It is? They're both public companies. If they get caught having strongly denied something that's true, that's worse than no comment, and the inevitable stock market motion and shareholder lawsuits that will result.
simias 8y ago
I still haven't heard a compelling argument for that. The only plausible reasons I've heard for Apple and Amazon lying about that are because they're being pressured by the American and/or Chinese governments. And if that's what's going on they're really going the extra mile with these calls for retraction. I don't really buy it, if they really wanted to gaslight Bloomberg they could do it more subtly and without putting themselves in such an awkward position if strong contradicting evidence came to light.

code4tee 8y ago

It’s really starting to smell like Bloomberg got played hard here. To preserve their journalistic integrity they either need to produce some supporting evidence real fast or admit they screwed up and retract the story.

kristianov 8y ago
Smells more and more like something 4chan would do.

ariwilson 8y ago

Why was Google not affected by these Supermicro motherboards?

trhway 8y ago
From my scouring some time ago on Ebay Google seems to use board designs modified and produces to their specs from some Taywan nonames. So while they also can potentially be similarly attacked, it wouldn't be the same attack. Wrt. the subj of the Bloomberg story - back in 90ies Russian FSB would comb through the internals of every PCs they bought for their use. That though was before Intel ME :)

williesleg 8y ago

Well that took a long time.

simonebrunozzi 8y ago

(disclaimer: I worked at AWS from 2008 to 2014 as Technology Evangelist, and know Andy Jassy personally) I know nothing specific about the issue per se, but I am convinced that Andy Jassy is speaking the truth here, for two reasons: 1) I've never seen a company as obsessed with security as AWS, and/or with such a big budget for security. 2) There's so many actors/employees involved in the audits, security, etc, that convincing some of them to "hide" a fact like this would be just too risky for a company that big. If that were really the case, I would rather work on a contingency plan, assuming that sooner or later the "leak" would come out. There is a tiny chance that something bad happened, and that Amazon's magic PR twist managed to still provide a truthful statement (Steve Schmidt) while hiding that. "A chance", because of the various back and forth business between AWS and Chinese companies. "Tiny", because other scenarios are much more probable and plausible. This looks like a very poor example of journalism, on Bloomberg's side. On a different note, I still believe that weird/illegal stuff keeps going on between companies and governments worldwide, for the simple reason that these things keep coming up when there's a new leak, or when secrecy on certain classified documents gets lifted or expires.

wpdev_63 8y ago
If you can disclose, what kind of security audits do you perform on your server hardware?
- VectorLock 8y ago
  I'd like to know this as well. Not many can match the resources that AWS has so what actual checks are they doing of the hardware they receive from overseas suppliers? There is going to be "don't tip your security hand" reticence to share so I doubt we'll get any straight answers.
smokeyj 8y ago
https://en.wikipedia.org/wiki/Alex_Stamos#Yahoo https://en.wikipedia.org/wiki/Alex_Stamos#Yahoo! Any move like this would start with the CEO. We have no idea if it’s a “hack” or a hush-hush back door provided by the feds. Let Bezos the pentagon lapdog give official statements instead.

abalone 8y ago

Gruber doesn't get posted on HN much for some reason but he found a great tidbit on this: The reporters were flippantly dismissive of the (strong and repeated) company denials.[1] Jordan Robertson was on TV saying companies have no "advantage" in "confirming" his reporting because "no consumer data [was] stolen." He seems to take very casually the distinction between "not disclosing" something and outright lying and engaging in an industry-wide conspiracy about it. He later tried to walk back that line but it's an interesting window into their mindset. It doesn't strike me as particularly strong journalistic reasoning. [1] https://daringfireball.net/linked/2018/10/22/jassy-bloomberg-should-retract https://daringfireball.net/linked/2018/10/22/jassy-bloomberg...

jonbronson 8y ago

What's more plausible in this scenario: One or two journalists run a fake story, possibly for financial gain or simply notoriety, or that hundreds and even thousands of engineers and managers across multiple tech companies are all complicit in the most elaborate and coordinated corporate conspiracy in history, all just to hide the fact that they were breached...

panda888888 8y ago
It's possible that the hack wasn't that big (targeted to only certain boards) and that the higher-ups at the companies don't know the details

duxup 8y ago

Any reason for these calls for retraction? It's not like there aren't false stories about what happens at Apple or Amazon regularly, not that they're usually about hacking but the public calls for retraction seem somewhat as unique as the story.

panda888888 8y ago
Agreed. The pointed denials make the whole thing even weirder.
creeble 8y ago
But this is about hacking / being hacked. You would be sure to see a denial in that case.

newscracker 8y ago

I said it recently in different words and I'll say it again. There is no good ending for Bloomberg in this story, or at least for the reporters on the story and the editor who let it run. The longer it digs its heels in adamantly and doesn't retract this story, the worse it's going to get. Its deep pockets can handle a huge scandal and embarrassment for a while, but it'll face the ignominy of being ignored by sources in many circles if it doesn't act quickly (one of the ways, perhaps, would be to reveal more information that can be verified by third parties). It's as sticky a situation as it gets, and it will define/decimate Bloomberg for the future.

sbr464 8y ago

I’m curious how the internal meeting (at the newspaper) goes, when they have no actual proof, such as an actual compromised device. How could you possibly publish such a huge/important story without that smoking gun? We live in too much of a scientific/fact driven period of time to allow this to be taken seriously in my opinion.

Paraesthetic 8y ago

Sounds like they are running scared? Could this be a cover up do you think?

tinkerteller 8y ago

What's up with calling these division leads as "CEO"? Do they only answer to the board elected by shareholders?

the_other_guy 8y ago

It's not fake news unless you hurt me!

nova22033 8y ago

This story probably came from someone in the national security establishment who has zero understanding of the underlying technology but has a vested interest in the red scare..