23 ms·

Super Micro says review found no malicious chips in motherboards

629 points by teddyfrozevelt 8y ago

assblaster 8y ago
The question I have is: is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?
- latentpot 8y ago
  Plausible deniability? Perhaps the ramifications were so huge (maybe for Apple and others) they would have gone bankrupt in lawsuits. So maybe this is a easier way to bail them out. Just using a tinfoil hat here.
- nscalf 8y ago
  It's definitely easier for a reporter to be a little over eager with a story and run it before being fully vetted than it is to co-opt federal agencies and independent auditors. I'm not saying that it's not possible for the situation you described to have happened, just that it would be an extreme outlier.
  - Cyph0n 8y ago
    That's true, but why hasn't Bloomberg retracted the article yet? It's been two months since the piece was published. Given all this attention, don't you think that Bloomberg would have issued a retraction by now if it was simply the case of an overzealous reporter?
    - rincebrain 8y ago
      Given the nature of their doubling down upfront about it, it could be quite problematic for them to admit they were Very Wrong. It's also possibly permanently going to be unclear whether this is factually accurate unless someone discovers a compromised system or the sources for the reporters provide enough information on why they believe what they do to actually investigate.
      - Symmetry 8y ago
        If they were to publicly say they were wrong then suddenly that would be News the way the original reporting was. If they don't then only specialty publications will cover the failure to pan out.
      - kevin_thibedeau 8y ago
        Bloomberg rewards their "journalists" for moving markets and use the promise of market leading scoops as the carrot to win subscriptions. An admission of generating fake news hurts their core business deeply.
- dgzl 8y ago
  Could it be, whoever supplied the information to begin with was just trying to burn the news org? Or possibly the leaker made a horrible mistake regarding facts? Or possibly there is indeed a conspiracy to cover up a hardware backdoor? These are tough times my friend.
- ryanmercer 8y ago
  >is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? Absolutely possible, even somewhat plausible but unlikely. Conspiracies are hard to maintain "2 can keep a secret if 1 of them is dead". You could outright threaten someone with any number of means to get them to comply with your wishes, this is how espionage often works at a state level "ho ho, you like underage boys Mr. Smith, we have these photos of you, you will help us spy on your government!" or "You owe us much monies from your gambling, you can give us information or we make your life very difficult", simply using sex to ease someone into complying (sexpionage both as blackmail and as reward/entrapment. A possible famous case of the blackmail route was with the NSA in 1960, see: https://en.wikipedia.org/wiki/Martin_and_Mitchell_defection https://en.wikipedia.org/wiki/Martin_and_Mitchell_defection ), finding actual irregularities in someone's finances and threatening to go after them for it etc. Again, possible and somewhat plausible but probably just a journalist fabricating a source or being misled by one. Yellow Journalism is a thing after all https://en.wikipedia.org/wiki/Yellow_journalism https://en.wikipedia.org/wiki/Yellow_journalism and if you look at papers in the 19th century you see all sorts of outright fabrications just to sell papers, like the Great Moon Hoax https://en.wikipedia.org/wiki/Great_Moon_Hoax https://en.wikipedia.org/wiki/Great_Moon_Hoax
  - moftz 8y ago
    A US intelligence agency nowadays would just issue a National Security Letter and force you to not say anything otherwise you go to jail. Most people really don't want to go to jail. An intelligence agency would really only resort to blackmail or extortion if they were operating in a foreign country where they couldn't outright bribe someone.
    - ryanmercer 8y ago
      I imagine that is defeated by simply saying "I refuse to lie", which could be career suicide but it's still an option. I can see how legally they could say "you can't reveal that information, it's a matter of national security" but I don't quite think we're at the point in America where they can go "Say this or go to prison".
- blakesterz 8y ago
  I keep asking the same thing "how could a reputable news agency get a report so wrong?" They said they have many sources, they double checked things. But the denials from the various places have been SO 100% unbelievably "NO NEVER HAPPENED" that it's hard to know what's going on. If it really never did happen, why did so many people lie about this to reporters? What was the end game? It seems impossible that the reporters just made it all up, doesn't it? But maybe someone paid them to make it all up! It's just crazy conspiracies all the way down.
- pmorici 8y ago
  I think the most likely explanation is that Bloomberg got played by the sources who perhaps wanted to trade on the price action the story would obviously cause. We don't really know anything about Bloomberg's sources we do know the nature of all the parties denying any of this is true.
  - cm2187 8y ago
    I find that highly unlikely. Since Supermicro was kicked out of the NASDAQ, I would expect their trading to be much thinner. It would be trivial for regulators to spot some inside trades. And if the sources are indeed intelligence officials, I'd expect their financials to be under special scrutiny.
    - newaccoutnas 8y ago
      It wasn't only Supermicro that took a hit but also any company using their products (AWS etc)
    - asdff 8y ago
      Everyone named in the article took a price hit that week. If you knew this article was coming you'd be well positioned for easy profit.
  - jakobegger 8y ago
    Nope. The only named source in the article said on Twitter that the journalist reported speculation about possible attacks as facts. The story was fabricated by the journalist. How it got through fact-checking, I don't know.
    - deleted 8y ago
      [deleted]
    - asdff 8y ago
      That doesn't mean people didn't feed the journalist heavy handed speculation to make a profit from short positions.
- mtgx 8y ago
  What bothers me most about this article is that it's based around what "Super Micro says" -- why would I care about what Supermicro says? They are the ones being accused of having backdoors in their chips. I would've liked to hear this directly from the company doing the audit, without Super Micro's own "interpretation". The second thing that bothers me about this story is that it was Supermicro that paid for the audit. Maybe there was no one else going to do it, or maybe they just thought to get ahead of anyone else trying to review their chips. I don't know, but it doesn't sit well with me. Only recently we saw at least two major tech companies skirt FCC's privacy monitoring by paying themselves for the audits: Google and Facebook. Both had multiple major privacy scandals in the past couple of years, but somehow all of these privacy issues were completely missed by the companies auditing them.
  - notabot 8y ago
    "A person familiar with the analysis told Reuters it had been conducted by global firm Nardello & Co and that customers could ask for more detail on that company’s findings." So I guess yes you can bypass Super Micro if you're a customer.
    - mtgx 8y ago
      I saw that, but it's not nearly enough. Why isn't the report made public? Why do we have to take Super Micro's word for it? I seem to remember a very hostile and skeptical attitude from HN against Binance doing exactly this sort of thing when they announced the results of their paid-for "audit" of Tether financials. Why aren't we treating Super Micro's report of the audit the same way?
      - jessaustin 8y ago
        HN people know that moving off of AWS is going to be a pain.
- majia 8y ago
  It's rather easy for someone to mislead a BP reporter who understands little about the technical details but is very eager to publish something shocking. The reporter may have emailed a few dozen security researchers to verify the story, but those who don't believe in the story are less likely to reply (and the reporter is more likely to ignore them), leading to a sampling bias.
  - joshstrange 8y ago
    And/or the people who did reply gave a response of something along the lines of “Its technically possibly but...” and the author ignored everything after the but.
    - SCHiM 8y ago
      I see how this could have happened yes. Especially if the reporter was not clear on the angle of the questions. It's easy to see how security researchers could go off on a tangent about the insecurities of IMPI and other out of band management systems. Which'd sound like an endorsement to the reporter. Who knows what really happened.
    - hopler 8y ago
      What would go after the but? Third parties don't know whether a board was exploited.
      - joshstrange 8y ago
        "but unless I was able to inspect the board I wouldn't believe it's happening" "but that kind of attack has never been seen in the wild and is highly unlikely" "but large tech companies have teams that vet the hardware they use on a unit by unit basis and would notice something like that"
    - ghaff 8y ago
      TBH if you’re talking to a reporter, thats a bad way to answer a question. “It’s technically possible” is the sort of sound bite someone will grab while ignoring the 5 minute spiel on IPMI and bus interfaces etc. that follows. Be very careful about giving short quotable statements in plain English that you don’t want to see in print.
- sschueller 8y ago
  The media falls for bullshit all the time, Weapons of mass destruction, incubator babies in Kuwait, etc. They are in the business of making money and not getting the story right and since there is hardley any consequences for them why would they care? Bloomberg here will blame its source and take no responsibility.
  - wklauss 8y ago
    > They are in the business of making money and not getting the story right All business are "in the business of making money", that's what being a business is. What sets them apart is how they make it. In the case of media companies is, precisely, by getting the story right. A publisher that doesn't is more likely to lose influence and readership as time goes by. For a publication like Bloomberg, more so. So yeah, they do care. That doesn't mean they don't fall for scams or bad reporting. They do, but it's in their best interest not to do so. In this case, I'm sure Bloomberg is already frantically calling all the reporter sources. They should have done it before the piece was published, sure, and they'll sure blame the reporter and the sources, but I think it's disingenuous to think they just shrug these things off.
    - AsyncAwait 8y ago
      > What sets them apart is how they make it. In the case of media companies is, precisely, by getting the story right. Ideally yes, but nowdays it seems to be rather; by getting the story framed exactly as their corporate owner wants them to frame it. Yes, they'll slowly loose credibility and in fact that is happening, but the process takes decades and is not likely to affect current reporters, if they lied in service of the status quo.
    - usefulcat 8y ago
      > In the case of media companies is, precisely, by getting the story right. Strongly disagree. Media companies make money by publishing stories that people want to hear about.
    - gdy 8y ago
      "In the case of media companies is, precisely, by getting the story right." Almost any article about Russia is a counter example to this.
- entity345 8y ago
  An auditor would not have found anything because the alleged attack occurred several years ago and would most likely have been targeted at a limited number of boards, which would have been seized a long time ago. The result of this audit does not inform about anything related to the allegations published by Bloomberg. I think it's more about re-building confidence by showing that Supermicro products on sale now can be trusted.
- elliekelly 8y ago
  When I worked as an attorney for a bank one of my jobs was to "manage" the audit engagements. When an audit has serious findings you can almost guarantee that's just the tip of the iceberg. On the other hand, an audit or review without any findings just means the company under review had some combination of good lawyers and friendly auditors. In my experience, there are two types of firms you can almost always find "friendly" auditors: law firms and small specialized "boutique" firms (accounting, consulting, etc). Who conducted this review? A boutique law firm.
- scarhill 8y ago
  WRT the how could they get it so wrong question, I guess it's time for the obligatory link to Michael Crichton's essay "Why Speculate?" and his discussion of the "Murray Gell-Mann Amnesia Effect" [1] Money quote: "You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either the facts or the issues. Often, the article is so wrong it actually presents the story backward—reversing cause and effect. I call these the "wet streets cause rain" stories. Paper's full of them. "In any case, you read with exasperation or amusement the multiple errors in a story, and then turn the page to national or international affairs, and read as if the rest of the newspaper was somehow more accurate about Palestine than the baloney you just read. You turn the page, and forget what you know." 1 - http://larvatus.com/michael-crichton-why-speculate/ http://larvatus.com/michael-crichton-why-speculate/
  - suls 8y ago
    Brilliant. Thanks for sharing this.
  - Wowfunhappy 8y ago
    I would expect newspapers to be more knowledgable about politics and international relations than scientific topics like physics. The latter is too broad a category, the former is usually the paper's primary focus.
    - hopler 8y ago
      Politics and International relations are opinion fields, not fact fields. It's impossible to be wrong about things that are impossible to falsify.
      - ufmace 8y ago
        I wouldn't quite say that. Some aspects are opinions, but there's plenty of facts. Such as "House Reps A and B are cooperating on a bill regarding X" - that's a fact. What your position on X is, whether the bill is a good or bad idea, and why A and B are cooperating on it are opinions.
- ineedasername 8y ago
  Or could an auditor simply miss it? If the functionality were part of another legitimate chip?
- John_KZ 8y ago
  Looking back at this after the Huawei scandal, it seems very likely it was a preliminary step to create a negative impression regarding Chinese manufacturing. Bloomberg could have been lied to, or been chosen to deliver false stories for propaganda. Of course it could be irrelevant (there were tensions regardless) but given how everything looks weird, it probably wasn't. Because no matter what the audits say, this article caused a widespread feeling of mistrust towards Chinese-manufactured electronics.
- chipotle_coyote 8y ago
  The problem with this line of reasoning -- "how do we know that each denial isn't just a sign of more coercion from powerful forces" -- isn't that it's impossible. It's that that it's unfalsifiable. I got into a brief argument in comments here not too long ago about the saying "you can't prove a negative" which got bogged down in (what I considered to be) pedantic semantics; what we mean in practice is this kind of "negative." Instead of the conspiracy-minded folks providing proof that powerful, shadowy forces have come out in force against Bloomberg to discredit and suppress their reporting on an actual national security incident, they're demanding that skeptics prove that they haven't. And how can we do this? The complete lack of evidence for this happening might just mean that the shadowy, powerful forces are really good at hiding their tracks. We can posit that if they were really that powerful, they'd have suppressed the original reporting, but we can't prove that Bloomberg didn't just get lucky, or that their diligent, plucky reporters didn't somehow catch the Deep State off-guard for just a moment. We can point out that generally when we see this kind of story, other reporters in other organizations would have corroborated and even expanded the story by now, and that other reporters have said that they've tried and failed to do so. But that might mean the conspiracy is covering their tracks. That they've got to them. That the rest of the journalistic world is IN ON THE CONSPIRACY, MAN. But it's also possible that the reason it increasingly looks like Bloomberg got played is that, well, Bloomberg got played. Like a cigar, sometimes a bad article is just a bad article.
- ggggtez 8y ago
  Could a TLA have silenced the real results? Sure, but that seems pretty unlikely. The US Government is not afraid to call out China for real or perceived threats right now (see tariffs). So the government itself silencing this would be pretty counter-intuitive. I'd believe more that Super Micro is trying to save it's stock value, more than I'd believe government intervention. Of course, it could also just be faulty intelligence. Guess we'll have to wait and see what Bloomberg does with respect to whether they can get their sources on the record.
cannedslime 8y ago
So let me get this straight... Super Micro hired a firm, who then asked the manufacturers, "Hey guys can we please have your design files for your PCBs" and then they looked at the parts list and said, "Nope, no dedicated backdoor chips here" ? They didn't really do a thorough examination of the devices in question, but asked the manufacturer for the CAD files?
- hau 8y ago
  You should really do thorough examination of the article it's really short. They did examine hardware both in production and already sold to Apple and Amazon samples.
  - cannedslime 8y ago
    Well what I was wondering was, what did they examine to be exact? Did they decap chips and reverse engineer them? The article as you say, is really short. Too short, there isn't really any information in it, besides "Trend micro said this, take their word for it"...
    - dracodoc 8y ago
      Why are you keep using "Trend micro"? Did you realize that's a totally different company?
      - cannedslime 8y ago
        Oh, my bad... Doesn't really change much though.
        deleted 8y ago
        [deleted]
- thoughtsimple 8y ago
  From the article: “Nardello tested samples of motherboards in current production and versions that were sold to Apple Inc and Amazon.com Inc, which were both named in the article, the person said.” At some point it is up to Bloomberg to show something. It isn’t possible to show a negative in this case.
cm2187 8y ago
Their stock price increased 30% from the drop after the publication of the article, but still 20% down from before the article. Though most of that is probably tech stocks tanking. So they are probably close to where they would have been without the article.
- asdff 8y ago
  If you were a bad-faith source you would have anticipated this and profited from the movement in both directions. Short when the article is released, then take your profit and buy at an artificially low price.
jamesholden 8y ago
Has Bloomberg even replied to the "Uhm, WTF you talking about Willis" responses from Apple/Amazon? I don't recall seeing one. I wonder what they will say now.. How can they just make up a story like this and it can slide?
- deadbunny 8y ago
  To be super cynical: They got their ad revenue from the story, why would they care?
  - stilky 8y ago
    The reputation hit from being wrong is much bigger than the ad revenue from this one story. Bloomberg has been a very reputable and trusted source and wouldn't willingly throw that away
  - endorphone 8y ago
    The story was given legs because Bloomberg has generally been a credible organization. They are tainted if they don't firmly explain their side, and forever anything they report will be coupled with "they were the ones behind that debunked SuperMicro thing". Clickbait and manufactured stories is a dead end tactic, so they certainly do care, and they certainly have some reasoning. Perhaps they were intentionally mislead.
    - Karunamon 8y ago
      It would be worth mentioning that the particular journalists behind this story (nevermind Bloomberg as a whole) have been caught pushing nonsense before[1]. On top of that, the story itself has a number of technical implausibilities that render it difficult to believe.[2] [1]: https://twitter.com/RobertMLee/status/1049617855396933632 https://twitter.com/RobertMLee/status/1049617855396933632 [2]: https://www.servethehome.com/investigating-implausible-bloomberg-supermicro-stories https://www.servethehome.com/investigating-implausible-bloom...
  - danso 8y ago
    It’s doubtful that the ad revenues on even a highly-clicked story outweighed the cost of paying the reporters for the year they worked on this story, nevermind the costs of the editors and lawyers who pitched in over that year, or the reporting expenses (e.g. travel). Also, it’s well-known that Bloomberg’s news division is heavily subsidized by Bloomberg’s terminal customers.
deuzj 8y ago
This is weird, actually. I mean, a journalist lying for profit? Never happens.
- deleted 8y ago
  [deleted]
ryanmercer 8y ago
People worry about malicious chips in instances like this and I mean it's a valid concern but one method of attack I've always thought would be effective and extremely dangerous is strategic placing a component in a circuit that, if it fails, disables the entire device then you simply need a way to activate it. Radio. Design a circuit, or better something that appears to be a capacitor and functions as a capacitor but has a small internal compartment at say the top so that it performs at less than what it is rated for but has a small circuit that over-volts via a joule thief and causes a failure. Have the trigger be a small receiver that activates at a certain frequency probably in the ELF or SLF range with just a few bits needed as the activation key. Put that into the supply chain of whatever industry and when you want to disrupt to cause economic damage, or even as part of causing a bit of chaos preceding a military attack, fire up your ELF station and start pumping out the few bits of data to activate. ELF will penetrate hundreds of meters of water, it should reach inside most buildings and even if you only had something like a 5% success rate you'd disable a LOT of whatever you'd installed them in. If it's networking hardware, you could likely cripple anything that relies on the internet by causing considerable distributed failures.
- moftz 8y ago
  Only problem with LF stuff is that you need a pretty big antenna. You would be better off designing a chip with an RF section that operates in the GHz range so you can get away with a tiny microstrip antenna or with the antenna inside the chip.
  - ryanmercer 8y ago
    I will admit radio is not my thing, that works too though and then you can make it a much larger activation key, even just bytes instead of bits would exponentially increase odds of not having an accidental activation which should make it not get set off by a router or microwave and you could probably activate it simply by flying over with a slightly modified cargo or passenger aircraft that looks business as normal but just belches high-power bursts of the activation signal.
- heavenlyblue 8y ago
neya 8y ago
Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's story was false, they shouldn't just walk away like that because "it's the free press".
- rincebrain 8y ago
  I believe the current line there, at least in the US, is whether they knowingly ran factually inaccurate information. Given their doubling down, unless we assume they somehow didn't ask their legal department, I would bet they have enough sources for the information that they think they're not at risk of being prosecuted for libel or slander.
  - seanmcdirmid 8y ago
    The bar for libel and slander is very high. I also think it’s civil and not criminal, so there would be no prosecution in any case, they would just get sued.
- Despegar 8y ago
  Bloomberg is in the process of re-reporting the story according to Erik Wemple. They've assigned a new reporter to find out what's going on. https://www.washingtonpost.com/blogs/erik-wemple/wp/2018/11/27/bloomberg-is-still-reporting-on-challenged-story-regarding-china-hardware-hack https://www.washingtonpost.com/blogs/erik-wemple/wp/2018/11/...
- finnthehuman 8y ago
  >What are the consequences for Bloomberg for this incompetence? You, not the general concept of the reader, but you personally neya. You stop trusting Bloomberg's reporting. That's the consequence. Their reputation suffers. Why do threads like this on HN always have such a desire for retribution?
thetricia 8y ago
So correct me if I'm wrong, but the most sinister part of the story in how some might assume SuperMicro is a Chinese or a MainlandChinese-founded company. It came right around the time ZTE, Huawei and others were facing renewed scrutiny. So you can imagine how easy it is to read the story and just think "oh, another Chinese company got busted".
- dijit 8y ago
  It's also easy to read this as a smear campaign against Chinese companies.
  - jessaustin 8y ago
    Arresting CFOs seems to be the more popular technique now... [EDIT:] this is a real thing that happened recently https://www.aljazeera.com/news/2018/12/canada-arrests-cfo-china-huawei-technologies-181205231502520.html https://www.aljazeera.com/news/2018/12/canada-arrests-cfo-ch...
  - thetricia 8y ago
    Well the big difference is it's reasonable to assume a Mainland Chinese company could get banned or sanctioned in some manner. Now just to be fair, from what I read, there was a lot of Super Micro drama going on beforehand which likely magnified the pessimism. Btw if you search for 'supermicro "is a chinese"' you will find some people that do think that.
- Spooky23 8y ago
  Which makes the idea that a US intelligence agency is setting up Supermicro really dumb on its face. The reality is that the company is poorly run and has a lot of resources and background in Taiwan. If there’s a nefarious nation-state plot, it’s more likely a Chinese one intended to demonstrate their ability to disrupt commerce. Any of the big vendors (HP[E], Lenovo, Dell, etc) are toast without their offshore partners.
cfv 8y ago
Are all this people going to bill Bloomberg for the costs of the tests? They prob should
eeZah7Ux 8y ago
The elephant in the room is that detecting hardware backdoors will remain practically impossible due to the closedness and secrecy of the industry. Especially for backdoors installed only on few servers. Yet, open schematics, publicly available hi-resolution pictures and public, peer-reviewed, automated inspection are potentially possible.
creeble 8y ago
Bloomberg reporters clearly need retraining. As I've stated a few times regarding this story, "photo or it didn't happen". It's a pretty simple standard, maybe Bloomberg will think about applying it now. Or maybe someone else will come up with a new conspiracy to punk them.
- catacombs 8y ago
  "Photos or it didn't happen" isn't as easy to obtain as one might think. Best case is obtaining documents that corroborate this whole thing.
usertest1 8y ago
good job
stupidbird 8y ago
There has to be more to this story that we don't know. Bloomberg has a lot to lose by publishing such a harsh claim that's not extremely fact-checked. Reliable newspapers generally don't throw around anonymous government sources without doing background checks on these people. I have little doubt that they got the information from who they say they did. At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. The problem with that is of course that it erodes trust for future sources, and potentially puts these sources at personal risk. But if not doing so starts putting the entire publication into question, that might be a risk they have to take.
- afarah 8y ago
  > Reliable newspapers generally don't throw around anonymous government sources Huh...
- admax88q 8y ago
  > At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. That would be a mistake. Don't just throw your sources to the wolves if you couldn't prove their story. They should press their sources for proof, or stronger evidence. If they can't find any then they should issue a retraction.
  - sixothree 8y ago
    I would love to see a board in hand.
  - e12e 8y ago
    You might, if you can with certainty say: oh, look, this was a propaganda op by these agents of this TLA.
  - crispyambulance 8y ago
    The "should have" pressed the sources for hard proof, or found examples in the wild of adulterated servers before publishing the story. That ship has sailed, of course. But if what was reported was actually true the best thing that can happen now, for Bloomberg and the public, is for their sources to step forward voluntarily with proof. Admittedly, that will take a lot of courage in today's political climate, but if it's not all just bullshit, highly principled people may do it. What I would like to know is what the Bloomberg reporters expected would happen as a result of this story?? Did they think Supermicro and Apple would just admit it? Then what?
subtlefarce 8y ago
>Computer hardware maker Super Micro Computer Inc told customers of course they will
balthasar 8y ago
We have investigated ourselves and found nothing wrong.
- catacombs 8y ago
  YUP. Unless SuperMicro hires an independent, third-party auditor, the ball is still in their court.
  - esmi 8y ago
    First sentance in the linked article. "Computer hardware maker Super Micro Computer Inc told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards." Further down "A person familiar with the analysis told Reuters it had been conducted by global firm Nardello & Co and that customers could ask for more detail on that company’s findings."
    - justtopost 8y ago
      Does that firm have any technical acumen? Or just a supermicro contract for a result?
fallingfrog 8y ago
Not sure I believe this. Would anything bad happen to them if they just lied about it? Probably not. Unless they stepped on some politician's foot somehow.
- danso 8y ago
  Who is “they”?
NedIsakoff 8y ago
"Fake but accurate"?
ineedasername 8y ago
Evaluating this is tricky. On the one hand, Bloomberg claims it's a well sourced article, not a single person's unsubstantiated claim. On the other, Super Micro claims an audit showed nothing, but then they have an incentive to be less than honest, or to have performed a very superficial check. And couldn't an audit simply miss the issue if the malicious functionality were embedded in an otherwise legitimate chip? Either way, it seems like Bloomberg really should have pushed for a particular example, e.g. "look at this on model X boards for confirmation"
- kickopotomus 8y ago
  I am more inclined to believe Super Micro at this point. It is not just them that are denying this. Apple and Amazon have denied it as well and Apple even went so far as to write a letter to Congress[0]. With a hardware attack like the one that Bloomberg reported, there should be some actual physical evidence out in the wild but nothing has been found to date. I think that they really failed with regards to due diligence. [0]: https://www.scribd.com/document/390401381/Letter-October-8th-Version https://www.scribd.com/document/390401381/Letter-October-8th...
- fraudsyndrome 8y ago
  Super Micro didn't perform the audit of themselves (that would be silly), it was done by Nardello & Co as per the article.
  - ineedasername 8y ago
    Yes, but the level of detail requested for the audit would be dictated by Super Micro. For example, if the request was to audit boards against the design specs, the audit would never catch something inserted during the design phase. Nor would it catch malicious functionality inserted as part of a legitimate chip. It seems like the potential number of attack vectors is extremely high if the design &/or manufacture process has been subverted. Alternatively, if there was no attack, it becomes exceedingly difficult to prove the negative. But that also leaves us with the perplexing situation of multiple sources-- 17 from different companies and NSA-- deceiving Bloomberg reporters. Or Bloomberg reporters themselves deceiving everyone. In the later case the motives are clear. It's a career-making story that can't easily be disproved. In the former case the motives are less clear: a desire to smear Super Micro? Who benefits? A desire to stoke anti-China fear? It's all very strange.
jorblumesea 8y ago
Is anyone at all surprised that a company investigated itself and found nothing wrong? It might be true, it might be false, but there's an obvious conflict of interest here.
- kickopotomus 8y ago
  They did not investigate themselves. The audit was performed by Nardella & Co as stated in the article.
lsc 8y ago
I'd be super interested in the follow up, and not just for monetary reasons[1] I mean, my impression is that there has been a lot of news trying to stir up US vs China animosity; I mean, I'm sure that a lot of industrial/state espionage happens, but the renewed focus just seems a little suspicious to me at a time when our government is trying to distract us from possible Russian interference in our election. Makes me wonder about huawei - is this all just our government trying to take the heat off their Russian allies? I mean, it wouldn't even need to be made up in that case, I'm sure that if you looked, you could find plenty of sketchy things Chinese companies are already doing. But that was the weird thing about this supermicro thing... it was really pretty easily disprovable. Like... there are a lot of really smart people in the field looking for this sort of thing. If it was a lie to begin with, why pick one that can be shown to be false, when there are so many other possibilities that can't be proved either way? Man, I hope I live long enough to read good history books about this era. [1]I bought a bunch of SMCI when the story first broke; Aside from buying and using a lot of SuperMicro I simply didn't believe that they would be the only company effected if the story was true. When the story broke, I though that someone had probably found something, and that as people tore apart hardware looking, we would find something from other manufacturers, too. As nobody has found anything yet? I now think the story is just false. I know smart people are looking. (software/firmware compromises may not be as durable, but they are a lot easier to implement.) Either way, my SMCI holdings are up a few grand at a time when the rest of my portfolio is looking pretty sad.
- T-A 8y ago
  > the renewed focus just seems a little suspicious to me at a time when our government is trying to distract us from possible Russian interference in our election That might be a reasonable suspicion if Bloomberg were a pro-Trump publication. It is anything but. Its editorials and opinion pages bash the current administration almost daily, and there have been rumors recently that Michael Bloomberg is preparing to sell his stake in order to run for president in 2020 (after deciding not to run in 2016 because that could have split the opposition to Trump).
  - lsc 8y ago
paraditedc 8y ago
Bloomberg got the ads revenue, and people who read Bloomberg won't stop doing that just because of this. The only thing changed is the lower cosine distance between China and hacking in the English corpus, as well as people's minds.
- bunnycorn 8y ago
  It's much more than that. They have destructed 100's of billions of dollars of capital.
  - user5994461 8y ago
    supermicro was not worth that much.
    - bunnycorn 8y ago
      They have dragged Apple into it, and with Apple, the entire NASDAQ. So, yes, they have destroyed 100s of billions.
stdbrouw 8y ago
> Let's say Super Micro is right Yet we still don't know whether this is the case, so it's not even clear whether "consequences" are in order and whether incompetence is at play. You can't prosecute someone because "if they had stolen money from me, that would be theft."
pasbesoin 8y ago
You know what really kills a relationship? Distrust. Something our intelligence community has been fostering for... Well, what timeframe do I specify? But the past 15 - 20 years have brought something of a nadir. And the corporate world isn't faring much if any better. Reassurances don't seem very reassuring, these days...
exoesquitur 8y ago
From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude and very limited, but it works (only at lower I2C data rates in this case, but hey, it's a cheap hack). A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process. Im not saying that this substantiates the Bloomberg story in any way. Just saying it's a great (black hat) idea, and it works. It would surprise me a little if this weren't used in the wild by somebody.
- antoinealb 8y ago
  Curious about how you implemented this. Could you share the schematic somewhere ? It would be very interesting !
- trhway 8y ago
  >A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process. And sandwich it between the PCB layers. No way to find even upon close up inspection without Xraying the board itself, and even interpreting the Xray image of modern multilayer board would be a nontrivial task. I dont think Supermicro did it, at least for statistically meaningful set of boards.
  - phire 8y ago
    Or just replace one of the existing chips on the i2c bus with an identical but malicious one. I don't know how you would even detect that, short of decapping and scanning the die in.
    - mianos 8y ago
      That would be as easy as getting a same sized chip that is, say, an attiny, a bit of sand-papering and a laser to re-etch the package. If you had access to a wire bonding machine, not difficult, you could mount a second die in a de-capped package and cap it up with a bit of black resin. This would not require state level actors. Bunny Huang type of guys could do it.
kushti 8y ago
These days most of American media stories about China, Russia etc are probable fakes. Only mass boycott of Western MSMs can fix the situation with these terrible weapons of psyops and propaganda.
nyc_pizzadev 8y ago
Seems like a lot of people don't know who to believe. Me too. Hasn't anyone pulled a few Supermicro boards and confirmed that this chip exists? It was reported that the chip might be inside the wafers, but still, that would make finding this a clear smoking gun.
devy 8y ago
Who's this 3rd party Nardello & Co.? A google search leads to a New York based law firm[1]? If so, what's their technical capability to conduct this technical assessment? [1]: https://www.nardelloandco.com/en/ https://www.nardelloandco.com/en/
mtnGoat 8y ago
lets just say what bloomberg claims, was happening, really happened. this audit does nothing to disprove that. considering how many they sell and how many their mentioned clients have. picking a few at random to check is junk science. considering the adversary only needs one to be operating inside the datacenter.
- lysp 8y ago
  That's exactly what I was thinking too. Assuming it did happen, it would have focused on a small batch of servers to a small batch of clients. They wouldn't have been installing this hack on every single server they produced. So unless they pull every server for every major client and check, simply checking their warehouse stock proves nothing.
bhhaskin 8y ago
But did they find malicious chips elsewhere? And what is their definition of motherboard, chips and malicious? All of these statements seem to be pretty well crafted. It is entirely possible that they found components that don't belong, but don't consider them malicious without the underlying payload that gets uploaded.
time-domain0 8y ago
What are the odds that Bloomberg ran this story under pressure/collusion from Supermicro competitor(s) in Taiwan, US fed govt or other business actors trying to tarnish China's image? That they would knowingly run such a big story without commensurate easily verified evidence and reliable sources is irrationally foolish for such a large news shop.
perseusprime11 8y ago
I read this as "We've conducted a thorough review and made sure we've covered all tracks"
lawnchair_larry 8y ago
For what it's worth, no security experts believe the Super Micro story. The reasons have nothing to do with whether or not it would be technically possible. That is irrelevant. The point is that the alleged events did not happen.

The question I have is: is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?

latentpot 8y ago
Plausible deniability? Perhaps the ramifications were so huge (maybe for Apple and others) they would have gone bankrupt in lawsuits. So maybe this is a easier way to bail them out. Just using a tinfoil hat here.
nscalf 8y ago
It's definitely easier for a reporter to be a little over eager with a story and run it before being fully vetted than it is to co-opt federal agencies and independent auditors. I'm not saying that it's not possible for the situation you described to have happened, just that it would be an extreme outlier.
- Cyph0n 8y ago
  That's true, but why hasn't Bloomberg retracted the article yet? It's been two months since the piece was published. Given all this attention, don't you think that Bloomberg would have issued a retraction by now if it was simply the case of an overzealous reporter?
  - rincebrain 8y ago
    Given the nature of their doubling down upfront about it, it could be quite problematic for them to admit they were Very Wrong. It's also possibly permanently going to be unclear whether this is factually accurate unless someone discovers a compromised system or the sources for the reporters provide enough information on why they believe what they do to actually investigate.
    - Symmetry 8y ago
      If they were to publicly say they were wrong then suddenly that would be News the way the original reporting was. If they don't then only specialty publications will cover the failure to pan out.
    - kevin_thibedeau 8y ago
      Bloomberg rewards their "journalists" for moving markets and use the promise of market leading scoops as the carrot to win subscriptions. An admission of generating fake news hurts their core business deeply.
dgzl 8y ago
Could it be, whoever supplied the information to begin with was just trying to burn the news org? Or possibly the leaker made a horrible mistake regarding facts? Or possibly there is indeed a conspiracy to cover up a hardware backdoor? These are tough times my friend.
ryanmercer 8y ago
>is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? Absolutely possible, even somewhat plausible but unlikely. Conspiracies are hard to maintain "2 can keep a secret if 1 of them is dead". You could outright threaten someone with any number of means to get them to comply with your wishes, this is how espionage often works at a state level "ho ho, you like underage boys Mr. Smith, we have these photos of you, you will help us spy on your government!" or "You owe us much monies from your gambling, you can give us information or we make your life very difficult", simply using sex to ease someone into complying (sexpionage both as blackmail and as reward/entrapment. A possible famous case of the blackmail route was with the NSA in 1960, see: https://en.wikipedia.org/wiki/Martin_and_Mitchell_defection https://en.wikipedia.org/wiki/Martin_and_Mitchell_defection ), finding actual irregularities in someone's finances and threatening to go after them for it etc. Again, possible and somewhat plausible but probably just a journalist fabricating a source or being misled by one. Yellow Journalism is a thing after all https://en.wikipedia.org/wiki/Yellow_journalism https://en.wikipedia.org/wiki/Yellow_journalism and if you look at papers in the 19th century you see all sorts of outright fabrications just to sell papers, like the Great Moon Hoax https://en.wikipedia.org/wiki/Great_Moon_Hoax https://en.wikipedia.org/wiki/Great_Moon_Hoax
- moftz 8y ago
  A US intelligence agency nowadays would just issue a National Security Letter and force you to not say anything otherwise you go to jail. Most people really don't want to go to jail. An intelligence agency would really only resort to blackmail or extortion if they were operating in a foreign country where they couldn't outright bribe someone.
  - ryanmercer 8y ago
    I imagine that is defeated by simply saying "I refuse to lie", which could be career suicide but it's still an option. I can see how legally they could say "you can't reveal that information, it's a matter of national security" but I don't quite think we're at the point in America where they can go "Say this or go to prison".
blakesterz 8y ago
I keep asking the same thing "how could a reputable news agency get a report so wrong?" They said they have many sources, they double checked things. But the denials from the various places have been SO 100% unbelievably "NO NEVER HAPPENED" that it's hard to know what's going on. If it really never did happen, why did so many people lie about this to reporters? What was the end game? It seems impossible that the reporters just made it all up, doesn't it? But maybe someone paid them to make it all up! It's just crazy conspiracies all the way down.
pmorici 8y ago
I think the most likely explanation is that Bloomberg got played by the sources who perhaps wanted to trade on the price action the story would obviously cause. We don't really know anything about Bloomberg's sources we do know the nature of all the parties denying any of this is true.
- cm2187 8y ago
  I find that highly unlikely. Since Supermicro was kicked out of the NASDAQ, I would expect their trading to be much thinner. It would be trivial for regulators to spot some inside trades. And if the sources are indeed intelligence officials, I'd expect their financials to be under special scrutiny.
  - newaccoutnas 8y ago
    It wasn't only Supermicro that took a hit but also any company using their products (AWS etc)
  - asdff 8y ago
    Everyone named in the article took a price hit that week. If you knew this article was coming you'd be well positioned for easy profit.
- jakobegger 8y ago
  Nope. The only named source in the article said on Twitter that the journalist reported speculation about possible attacks as facts. The story was fabricated by the journalist. How it got through fact-checking, I don't know.
  - deleted 8y ago
    [deleted]
  - asdff 8y ago
    That doesn't mean people didn't feed the journalist heavy handed speculation to make a profit from short positions.
mtgx 8y ago
What bothers me most about this article is that it's based around what "Super Micro says" -- why would I care about what Supermicro says? They are the ones being accused of having backdoors in their chips. I would've liked to hear this directly from the company doing the audit, without Super Micro's own "interpretation". The second thing that bothers me about this story is that it was Supermicro that paid for the audit. Maybe there was no one else going to do it, or maybe they just thought to get ahead of anyone else trying to review their chips. I don't know, but it doesn't sit well with me. Only recently we saw at least two major tech companies skirt FCC's privacy monitoring by paying themselves for the audits: Google and Facebook. Both had multiple major privacy scandals in the past couple of years, but somehow all of these privacy issues were completely missed by the companies auditing them.
- notabot 8y ago
  "A person familiar with the analysis told Reuters it had been conducted by global firm Nardello & Co and that customers could ask for more detail on that company’s findings." So I guess yes you can bypass Super Micro if you're a customer.
  - mtgx 8y ago
    I saw that, but it's not nearly enough. Why isn't the report made public? Why do we have to take Super Micro's word for it? I seem to remember a very hostile and skeptical attitude from HN against Binance doing exactly this sort of thing when they announced the results of their paid-for "audit" of Tether financials. Why aren't we treating Super Micro's report of the audit the same way?
    - jessaustin 8y ago
      HN people know that moving off of AWS is going to be a pain.
majia 8y ago
It's rather easy for someone to mislead a BP reporter who understands little about the technical details but is very eager to publish something shocking. The reporter may have emailed a few dozen security researchers to verify the story, but those who don't believe in the story are less likely to reply (and the reporter is more likely to ignore them), leading to a sampling bias.
- joshstrange 8y ago
  And/or the people who did reply gave a response of something along the lines of “Its technically possibly but...” and the author ignored everything after the but.
  - SCHiM 8y ago
    I see how this could have happened yes. Especially if the reporter was not clear on the angle of the questions. It's easy to see how security researchers could go off on a tangent about the insecurities of IMPI and other out of band management systems. Which'd sound like an endorsement to the reporter. Who knows what really happened.
  - hopler 8y ago
    What would go after the but? Third parties don't know whether a board was exploited.
    - joshstrange 8y ago
      "but unless I was able to inspect the board I wouldn't believe it's happening" "but that kind of attack has never been seen in the wild and is highly unlikely" "but large tech companies have teams that vet the hardware they use on a unit by unit basis and would notice something like that"
  - ghaff 8y ago
    TBH if you’re talking to a reporter, thats a bad way to answer a question. “It’s technically possible” is the sort of sound bite someone will grab while ignoring the 5 minute spiel on IPMI and bus interfaces etc. that follows. Be very careful about giving short quotable statements in plain English that you don’t want to see in print.
sschueller 8y ago
The media falls for bullshit all the time, Weapons of mass destruction, incubator babies in Kuwait, etc. They are in the business of making money and not getting the story right and since there is hardley any consequences for them why would they care? Bloomberg here will blame its source and take no responsibility.
- wklauss 8y ago
  > They are in the business of making money and not getting the story right All business are "in the business of making money", that's what being a business is. What sets them apart is how they make it. In the case of media companies is, precisely, by getting the story right. A publisher that doesn't is more likely to lose influence and readership as time goes by. For a publication like Bloomberg, more so. So yeah, they do care. That doesn't mean they don't fall for scams or bad reporting. They do, but it's in their best interest not to do so. In this case, I'm sure Bloomberg is already frantically calling all the reporter sources. They should have done it before the piece was published, sure, and they'll sure blame the reporter and the sources, but I think it's disingenuous to think they just shrug these things off.
  - AsyncAwait 8y ago
    > What sets them apart is how they make it. In the case of media companies is, precisely, by getting the story right. Ideally yes, but nowdays it seems to be rather; by getting the story framed exactly as their corporate owner wants them to frame it. Yes, they'll slowly loose credibility and in fact that is happening, but the process takes decades and is not likely to affect current reporters, if they lied in service of the status quo.
  - usefulcat 8y ago
    > In the case of media companies is, precisely, by getting the story right. Strongly disagree. Media companies make money by publishing stories that people want to hear about.
  - gdy 8y ago
    "In the case of media companies is, precisely, by getting the story right." Almost any article about Russia is a counter example to this.
entity345 8y ago
An auditor would not have found anything because the alleged attack occurred several years ago and would most likely have been targeted at a limited number of boards, which would have been seized a long time ago. The result of this audit does not inform about anything related to the allegations published by Bloomberg. I think it's more about re-building confidence by showing that Supermicro products on sale now can be trusted.
elliekelly 8y ago
When I worked as an attorney for a bank one of my jobs was to "manage" the audit engagements. When an audit has serious findings you can almost guarantee that's just the tip of the iceberg. On the other hand, an audit or review without any findings just means the company under review had some combination of good lawyers and friendly auditors. In my experience, there are two types of firms you can almost always find "friendly" auditors: law firms and small specialized "boutique" firms (accounting, consulting, etc). Who conducted this review? A boutique law firm.
scarhill 8y ago
WRT the how could they get it so wrong question, I guess it's time for the obligatory link to Michael Crichton's essay "Why Speculate?" and his discussion of the "Murray Gell-Mann Amnesia Effect" [1] Money quote: "You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either the facts or the issues. Often, the article is so wrong it actually presents the story backward—reversing cause and effect. I call these the "wet streets cause rain" stories. Paper's full of them. "In any case, you read with exasperation or amusement the multiple errors in a story, and then turn the page to national or international affairs, and read as if the rest of the newspaper was somehow more accurate about Palestine than the baloney you just read. You turn the page, and forget what you know." 1 - http://larvatus.com/michael-crichton-why-speculate/ http://larvatus.com/michael-crichton-why-speculate/
- suls 8y ago
  Brilliant. Thanks for sharing this.
- Wowfunhappy 8y ago
  I would expect newspapers to be more knowledgable about politics and international relations than scientific topics like physics. The latter is too broad a category, the former is usually the paper's primary focus.
  - hopler 8y ago
    Politics and International relations are opinion fields, not fact fields. It's impossible to be wrong about things that are impossible to falsify.
    - ufmace 8y ago
      I wouldn't quite say that. Some aspects are opinions, but there's plenty of facts. Such as "House Reps A and B are cooperating on a bill regarding X" - that's a fact. What your position on X is, whether the bill is a good or bad idea, and why A and B are cooperating on it are opinions.
ineedasername 8y ago
Or could an auditor simply miss it? If the functionality were part of another legitimate chip?
John_KZ 8y ago
Looking back at this after the Huawei scandal, it seems very likely it was a preliminary step to create a negative impression regarding Chinese manufacturing. Bloomberg could have been lied to, or been chosen to deliver false stories for propaganda. Of course it could be irrelevant (there were tensions regardless) but given how everything looks weird, it probably wasn't. Because no matter what the audits say, this article caused a widespread feeling of mistrust towards Chinese-manufactured electronics.
chipotle_coyote 8y ago
The problem with this line of reasoning -- "how do we know that each denial isn't just a sign of more coercion from powerful forces" -- isn't that it's impossible. It's that that it's unfalsifiable. I got into a brief argument in comments here not too long ago about the saying "you can't prove a negative" which got bogged down in (what I considered to be) pedantic semantics; what we mean in practice is this kind of "negative." Instead of the conspiracy-minded folks providing proof that powerful, shadowy forces have come out in force against Bloomberg to discredit and suppress their reporting on an actual national security incident, they're demanding that skeptics prove that they haven't. And how can we do this? The complete lack of evidence for this happening might just mean that the shadowy, powerful forces are really good at hiding their tracks. We can posit that if they were really that powerful, they'd have suppressed the original reporting, but we can't prove that Bloomberg didn't just get lucky, or that their diligent, plucky reporters didn't somehow catch the Deep State off-guard for just a moment. We can point out that generally when we see this kind of story, other reporters in other organizations would have corroborated and even expanded the story by now, and that other reporters have said that they've tried and failed to do so. But that might mean the conspiracy is covering their tracks. That they've got to them. That the rest of the journalistic world is IN ON THE CONSPIRACY, MAN. But it's also possible that the reason it increasingly looks like Bloomberg got played is that, well, Bloomberg got played. Like a cigar, sometimes a bad article is just a bad article.
ggggtez 8y ago
Could a TLA have silenced the real results? Sure, but that seems pretty unlikely. The US Government is not afraid to call out China for real or perceived threats right now (see tariffs). So the government itself silencing this would be pretty counter-intuitive. I'd believe more that Super Micro is trying to save it's stock value, more than I'd believe government intervention. Of course, it could also just be faulty intelligence. Guess we'll have to wait and see what Bloomberg does with respect to whether they can get their sources on the record.

cannedslime 8y ago

So let me get this straight... Super Micro hired a firm, who then asked the manufacturers, "Hey guys can we please have your design files for your PCBs" and then they looked at the parts list and said, "Nope, no dedicated backdoor chips here" ? They didn't really do a thorough examination of the devices in question, but asked the manufacturer for the CAD files?

hau 8y ago
You should really do thorough examination of the article it's really short. They did examine hardware both in production and already sold to Apple and Amazon samples.
- cannedslime 8y ago
  Well what I was wondering was, what did they examine to be exact? Did they decap chips and reverse engineer them? The article as you say, is really short. Too short, there isn't really any information in it, besides "Trend micro said this, take their word for it"...
  - dracodoc 8y ago
    Why are you keep using "Trend micro"? Did you realize that's a totally different company?
    - cannedslime 8y ago
      Oh, my bad... Doesn't really change much though.
      - deleted 8y ago
        [deleted]
thoughtsimple 8y ago
From the article: “Nardello tested samples of motherboards in current production and versions that were sold to Apple Inc and Amazon.com Inc, which were both named in the article, the person said.” At some point it is up to Bloomberg to show something. It isn’t possible to show a negative in this case.

cm2187 8y ago

Their stock price increased 30% from the drop after the publication of the article, but still 20% down from before the article. Though most of that is probably tech stocks tanking. So they are probably close to where they would have been without the article.

asdff 8y ago
If you were a bad-faith source you would have anticipated this and profited from the movement in both directions. Short when the article is released, then take your profit and buy at an artificially low price.

jamesholden 8y ago

Has Bloomberg even replied to the "Uhm, WTF you talking about Willis" responses from Apple/Amazon? I don't recall seeing one. I wonder what they will say now.. How can they just make up a story like this and it can slide?

deadbunny 8y ago
To be super cynical: They got their ad revenue from the story, why would they care?
- stilky 8y ago
  The reputation hit from being wrong is much bigger than the ad revenue from this one story. Bloomberg has been a very reputable and trusted source and wouldn't willingly throw that away
- endorphone 8y ago
  The story was given legs because Bloomberg has generally been a credible organization. They are tainted if they don't firmly explain their side, and forever anything they report will be coupled with "they were the ones behind that debunked SuperMicro thing". Clickbait and manufactured stories is a dead end tactic, so they certainly do care, and they certainly have some reasoning. Perhaps they were intentionally mislead.
  - Karunamon 8y ago
    It would be worth mentioning that the particular journalists behind this story (nevermind Bloomberg as a whole) have been caught pushing nonsense before[1]. On top of that, the story itself has a number of technical implausibilities that render it difficult to believe.[2] [1]: https://twitter.com/RobertMLee/status/1049617855396933632 https://twitter.com/RobertMLee/status/1049617855396933632 [2]: https://www.servethehome.com/investigating-implausible-bloomberg-supermicro-stories https://www.servethehome.com/investigating-implausible-bloom...
- danso 8y ago
  It’s doubtful that the ad revenues on even a highly-clicked story outweighed the cost of paying the reporters for the year they worked on this story, nevermind the costs of the editors and lawyers who pitched in over that year, or the reporting expenses (e.g. travel). Also, it’s well-known that Bloomberg’s news division is heavily subsidized by Bloomberg’s terminal customers.

deuzj 8y ago

This is weird, actually. I mean, a journalist lying for profit? Never happens.

deleted 8y ago
[deleted]

ryanmercer 8y ago

People worry about malicious chips in instances like this and I mean it's a valid concern but one method of attack I've always thought would be effective and extremely dangerous is strategic placing a component in a circuit that, if it fails, disables the entire device then you simply need a way to activate it. Radio. Design a circuit, or better something that appears to be a capacitor and functions as a capacitor but has a small internal compartment at say the top so that it performs at less than what it is rated for but has a small circuit that over-volts via a joule thief and causes a failure. Have the trigger be a small receiver that activates at a certain frequency probably in the ELF or SLF range with just a few bits needed as the activation key. Put that into the supply chain of whatever industry and when you want to disrupt to cause economic damage, or even as part of causing a bit of chaos preceding a military attack, fire up your ELF station and start pumping out the few bits of data to activate. ELF will penetrate hundreds of meters of water, it should reach inside most buildings and even if you only had something like a 5% success rate you'd disable a LOT of whatever you'd installed them in. If it's networking hardware, you could likely cripple anything that relies on the internet by causing considerable distributed failures.

moftz 8y ago
Only problem with LF stuff is that you need a pretty big antenna. You would be better off designing a chip with an RF section that operates in the GHz range so you can get away with a tiny microstrip antenna or with the antenna inside the chip.
- ryanmercer 8y ago
  I will admit radio is not my thing, that works too though and then you can make it a much larger activation key, even just bytes instead of bits would exponentially increase odds of not having an accidental activation which should make it not get set off by a router or microwave and you could probably activate it simply by flying over with a slightly modified cargo or passenger aircraft that looks business as normal but just belches high-power bursts of the activation signal.
heavenlyblue 8y ago

neya 8y ago

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's story was false, they shouldn't just walk away like that because "it's the free press".

rincebrain 8y ago
I believe the current line there, at least in the US, is whether they knowingly ran factually inaccurate information. Given their doubling down, unless we assume they somehow didn't ask their legal department, I would bet they have enough sources for the information that they think they're not at risk of being prosecuted for libel or slander.
- seanmcdirmid 8y ago
  The bar for libel and slander is very high. I also think it’s civil and not criminal, so there would be no prosecution in any case, they would just get sued.
Despegar 8y ago
Bloomberg is in the process of re-reporting the story according to Erik Wemple. They've assigned a new reporter to find out what's going on. https://www.washingtonpost.com/blogs/erik-wemple/wp/2018/11/27/bloomberg-is-still-reporting-on-challenged-story-regarding-china-hardware-hack https://www.washingtonpost.com/blogs/erik-wemple/wp/2018/11/...
finnthehuman 8y ago
>What are the consequences for Bloomberg for this incompetence? You, not the general concept of the reader, but you personally neya. You stop trusting Bloomberg's reporting. That's the consequence. Their reputation suffers. Why do threads like this on HN always have such a desire for retribution?

thetricia 8y ago

So correct me if I'm wrong, but the most sinister part of the story in how some might assume SuperMicro is a Chinese or a MainlandChinese-founded company. It came right around the time ZTE, Huawei and others were facing renewed scrutiny. So you can imagine how easy it is to read the story and just think "oh, another Chinese company got busted".

dijit 8y ago
It's also easy to read this as a smear campaign against Chinese companies.
- jessaustin 8y ago
  Arresting CFOs seems to be the more popular technique now... [EDIT:] this is a real thing that happened recently https://www.aljazeera.com/news/2018/12/canada-arrests-cfo-china-huawei-technologies-181205231502520.html https://www.aljazeera.com/news/2018/12/canada-arrests-cfo-ch...
- thetricia 8y ago
  Well the big difference is it's reasonable to assume a Mainland Chinese company could get banned or sanctioned in some manner. Now just to be fair, from what I read, there was a lot of Super Micro drama going on beforehand which likely magnified the pessimism. Btw if you search for 'supermicro "is a chinese"' you will find some people that do think that.
Spooky23 8y ago
Which makes the idea that a US intelligence agency is setting up Supermicro really dumb on its face. The reality is that the company is poorly run and has a lot of resources and background in Taiwan. If there’s a nefarious nation-state plot, it’s more likely a Chinese one intended to demonstrate their ability to disrupt commerce. Any of the big vendors (HP[E], Lenovo, Dell, etc) are toast without their offshore partners.

cfv 8y ago

Are all this people going to bill Bloomberg for the costs of the tests? They prob should

eeZah7Ux 8y ago

The elephant in the room is that detecting hardware backdoors will remain practically impossible due to the closedness and secrecy of the industry. Especially for backdoors installed only on few servers. Yet, open schematics, publicly available hi-resolution pictures and public, peer-reviewed, automated inspection are potentially possible.

creeble 8y ago

Bloomberg reporters clearly need retraining. As I've stated a few times regarding this story, "photo or it didn't happen". It's a pretty simple standard, maybe Bloomberg will think about applying it now. Or maybe someone else will come up with a new conspiracy to punk them.

catacombs 8y ago
"Photos or it didn't happen" isn't as easy to obtain as one might think. Best case is obtaining documents that corroborate this whole thing.

usertest1 8y ago

good job

stupidbird 8y ago

There has to be more to this story that we don't know. Bloomberg has a lot to lose by publishing such a harsh claim that's not extremely fact-checked. Reliable newspapers generally don't throw around anonymous government sources without doing background checks on these people. I have little doubt that they got the information from who they say they did. At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. The problem with that is of course that it erodes trust for future sources, and potentially puts these sources at personal risk. But if not doing so starts putting the entire publication into question, that might be a risk they have to take.

afarah 8y ago
> Reliable newspapers generally don't throw around anonymous government sources Huh...
admax88q 8y ago
> At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. That would be a mistake. Don't just throw your sources to the wolves if you couldn't prove their story. They should press their sources for proof, or stronger evidence. If they can't find any then they should issue a retraction.
- sixothree 8y ago
  I would love to see a board in hand.
- e12e 8y ago
  You might, if you can with certainty say: oh, look, this was a propaganda op by these agents of this TLA.
- crispyambulance 8y ago
  The "should have" pressed the sources for hard proof, or found examples in the wild of adulterated servers before publishing the story. That ship has sailed, of course. But if what was reported was actually true the best thing that can happen now, for Bloomberg and the public, is for their sources to step forward voluntarily with proof. Admittedly, that will take a lot of courage in today's political climate, but if it's not all just bullshit, highly principled people may do it. What I would like to know is what the Bloomberg reporters expected would happen as a result of this story?? Did they think Supermicro and Apple would just admit it? Then what?

subtlefarce 8y ago

>Computer hardware maker Super Micro Computer Inc told customers of course they will

balthasar 8y ago

We have investigated ourselves and found nothing wrong.

catacombs 8y ago
YUP. Unless SuperMicro hires an independent, third-party auditor, the ball is still in their court.
- esmi 8y ago
  First sentance in the linked article. "Computer hardware maker Super Micro Computer Inc told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards." Further down "A person familiar with the analysis told Reuters it had been conducted by global firm Nardello & Co and that customers could ask for more detail on that company’s findings."
  - justtopost 8y ago
    Does that firm have any technical acumen? Or just a supermicro contract for a result?

fallingfrog 8y ago

Not sure I believe this. Would anything bad happen to them if they just lied about it? Probably not. Unless they stepped on some politician's foot somehow.

danso 8y ago
Who is “they”?

NedIsakoff 8y ago

"Fake but accurate"?

ineedasername 8y ago

Evaluating this is tricky. On the one hand, Bloomberg claims it's a well sourced article, not a single person's unsubstantiated claim. On the other, Super Micro claims an audit showed nothing, but then they have an incentive to be less than honest, or to have performed a very superficial check. And couldn't an audit simply miss the issue if the malicious functionality were embedded in an otherwise legitimate chip? Either way, it seems like Bloomberg really should have pushed for a particular example, e.g. "look at this on model X boards for confirmation"

kickopotomus 8y ago
I am more inclined to believe Super Micro at this point. It is not just them that are denying this. Apple and Amazon have denied it as well and Apple even went so far as to write a letter to Congress[0]. With a hardware attack like the one that Bloomberg reported, there should be some actual physical evidence out in the wild but nothing has been found to date. I think that they really failed with regards to due diligence. [0]: https://www.scribd.com/document/390401381/Letter-October-8th-Version https://www.scribd.com/document/390401381/Letter-October-8th...
fraudsyndrome 8y ago
Super Micro didn't perform the audit of themselves (that would be silly), it was done by Nardello & Co as per the article.
- ineedasername 8y ago
  Yes, but the level of detail requested for the audit would be dictated by Super Micro. For example, if the request was to audit boards against the design specs, the audit would never catch something inserted during the design phase. Nor would it catch malicious functionality inserted as part of a legitimate chip. It seems like the potential number of attack vectors is extremely high if the design &/or manufacture process has been subverted. Alternatively, if there was no attack, it becomes exceedingly difficult to prove the negative. But that also leaves us with the perplexing situation of multiple sources-- 17 from different companies and NSA-- deceiving Bloomberg reporters. Or Bloomberg reporters themselves deceiving everyone. In the later case the motives are clear. It's a career-making story that can't easily be disproved. In the former case the motives are less clear: a desire to smear Super Micro? Who benefits? A desire to stoke anti-China fear? It's all very strange.

jorblumesea 8y ago

Is anyone at all surprised that a company investigated itself and found nothing wrong? It might be true, it might be false, but there's an obvious conflict of interest here.

kickopotomus 8y ago
They did not investigate themselves. The audit was performed by Nardella & Co as stated in the article.

lsc 8y ago

I'd be super interested in the follow up, and not just for monetary reasons[1] I mean, my impression is that there has been a lot of news trying to stir up US vs China animosity; I mean, I'm sure that a lot of industrial/state espionage happens, but the renewed focus just seems a little suspicious to me at a time when our government is trying to distract us from possible Russian interference in our election. Makes me wonder about huawei - is this all just our government trying to take the heat off their Russian allies? I mean, it wouldn't even need to be made up in that case, I'm sure that if you looked, you could find plenty of sketchy things Chinese companies are already doing. But that was the weird thing about this supermicro thing... it was really pretty easily disprovable. Like... there are a lot of really smart people in the field looking for this sort of thing. If it was a lie to begin with, why pick one that can be shown to be false, when there are so many other possibilities that can't be proved either way? Man, I hope I live long enough to read good history books about this era. [1]I bought a bunch of SMCI when the story first broke; Aside from buying and using a lot of SuperMicro I simply didn't believe that they would be the only company effected if the story was true. When the story broke, I though that someone had probably found something, and that as people tore apart hardware looking, we would find something from other manufacturers, too. As nobody has found anything yet? I now think the story is just false. I know smart people are looking. (software/firmware compromises may not be as durable, but they are a lot easier to implement.) Either way, my SMCI holdings are up a few grand at a time when the rest of my portfolio is looking pretty sad.

T-A 8y ago
> the renewed focus just seems a little suspicious to me at a time when our government is trying to distract us from possible Russian interference in our election That might be a reasonable suspicion if Bloomberg were a pro-Trump publication. It is anything but. Its editorials and opinion pages bash the current administration almost daily, and there have been rumors recently that Michael Bloomberg is preparing to sell his stake in order to run for president in 2020 (after deciding not to run in 2016 because that could have split the opposition to Trump).
- lsc 8y ago

paraditedc 8y ago

Bloomberg got the ads revenue, and people who read Bloomberg won't stop doing that just because of this. The only thing changed is the lower cosine distance between China and hacking in the English corpus, as well as people's minds.

bunnycorn 8y ago
It's much more than that. They have destructed 100's of billions of dollars of capital.
- user5994461 8y ago
  supermicro was not worth that much.
  - bunnycorn 8y ago
    They have dragged Apple into it, and with Apple, the entire NASDAQ. So, yes, they have destroyed 100s of billions.

stdbrouw 8y ago

> Let's say Super Micro is right Yet we still don't know whether this is the case, so it's not even clear whether "consequences" are in order and whether incompetence is at play. You can't prosecute someone because "if they had stolen money from me, that would be theft."

pasbesoin 8y ago

You know what really kills a relationship? Distrust. Something our intelligence community has been fostering for... Well, what timeframe do I specify? But the past 15 - 20 years have brought something of a nadir. And the corporate world isn't faring much if any better. Reassurances don't seem very reassuring, these days...

exoesquitur 8y ago

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible". Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude and very limited, but it works (only at lower I2C data rates in this case, but hey, it's a cheap hack). A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process. Im not saying that this substantiates the Bloomberg story in any way. Just saying it's a great (black hat) idea, and it works. It would surprise me a little if this weren't used in the wild by somebody.

antoinealb 8y ago
Curious about how you implemented this. Could you share the schematic somewhere ? It would be very interesting !
trhway 8y ago
>A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process. And sandwich it between the PCB layers. No way to find even upon close up inspection without Xraying the board itself, and even interpreting the Xray image of modern multilayer board would be a nontrivial task. I dont think Supermicro did it, at least for statistically meaningful set of boards.
- phire 8y ago
  Or just replace one of the existing chips on the i2c bus with an identical but malicious one. I don't know how you would even detect that, short of decapping and scanning the die in.
  - mianos 8y ago
    That would be as easy as getting a same sized chip that is, say, an attiny, a bit of sand-papering and a laser to re-etch the package. If you had access to a wire bonding machine, not difficult, you could mount a second die in a de-capped package and cap it up with a bit of black resin. This would not require state level actors. Bunny Huang type of guys could do it.

kushti 8y ago

These days most of American media stories about China, Russia etc are probable fakes. Only mass boycott of Western MSMs can fix the situation with these terrible weapons of psyops and propaganda.

nyc_pizzadev 8y ago

Seems like a lot of people don't know who to believe. Me too. Hasn't anyone pulled a few Supermicro boards and confirmed that this chip exists? It was reported that the chip might be inside the wafers, but still, that would make finding this a clear smoking gun.

devy 8y ago

Who's this 3rd party Nardello & Co.? A google search leads to a New York based law firm[1]? If so, what's their technical capability to conduct this technical assessment? [1]: https://www.nardelloandco.com/en/ https://www.nardelloandco.com/en/

mtnGoat 8y ago

lets just say what bloomberg claims, was happening, really happened. this audit does nothing to disprove that. considering how many they sell and how many their mentioned clients have. picking a few at random to check is junk science. considering the adversary only needs one to be operating inside the datacenter.

lysp 8y ago
That's exactly what I was thinking too. Assuming it did happen, it would have focused on a small batch of servers to a small batch of clients. They wouldn't have been installing this hack on every single server they produced. So unless they pull every server for every major client and check, simply checking their warehouse stock proves nothing.

bhhaskin 8y ago

But did they find malicious chips elsewhere? And what is their definition of motherboard, chips and malicious? All of these statements seem to be pretty well crafted. It is entirely possible that they found components that don't belong, but don't consider them malicious without the underlying payload that gets uploaded.

time-domain0 8y ago

What are the odds that Bloomberg ran this story under pressure/collusion from Supermicro competitor(s) in Taiwan, US fed govt or other business actors trying to tarnish China's image? That they would knowingly run such a big story without commensurate easily verified evidence and reliable sources is irrationally foolish for such a large news shop.

perseusprime11 8y ago

I read this as "We've conducted a thorough review and made sure we've covered all tracks"

lawnchair_larry 8y ago

For what it's worth, no security experts believe the Super Micro story. The reasons have nothing to do with whether or not it would be technically possible. That is irrelevant. The point is that the alleged events did not happen.