6 ms·

The article mentions Bloomberg’s 2018 piece where they claimed to have evidence of an extra chip being inserted into a motherboard. From memory, Bloomberg’s act

The article mentions Bloomberg’s 2018 piece where they claimed to have evidence of an extra chip being inserted into a motherboard. From memory, Bloomberg’s actual evidence was shaky at best. Does anyone know if they ever actually showed the motherboard they claimed to have to anyone for verification? Apple made an official statement that the claims were, well, bullshit and that no such chips have ever been found. Amazon published a signed statement from its chief security officer saying that the Bloomberg article was “so full of inaccuracies ... that they’re hard to count” and that after their own security team and an external security team had gone into the claims in detail they found them to be untrue. So, I have to ask, does anyone know if Bloomberg actually published the evidence they claimed they would release?

count 6y ago
From what I remember, the evidence wasn't shaky, it was non-existent.
shakna 6y ago
> So, I have to ask, does anyone know if Bloomberg actually published the evidence they claimed they would release? In the first article, Bloomberg quoted Joe Fitzpatrick. 5 days later [0] he said his quotes were taken out of context. In the second article, Bloomberg quoted Yossi Appleboum, who on the same day the article broke suggested that he was misrepresented. [1] Apple, Amazon, Homeland Security, and others have all said there was no evidence at all, and called for a retraction. As it stands... Bloomberg were talking about something they didn't understand. There were and are some theoretical problems in hardware security. But the story as they broke it is completely false. [0] https://risky.biz/RB517_feature/ https://risky.biz/RB517_feature/ [1] https://www.servethehome.com/yossi-appleboum-disagrees-bloomberg-is-positioning-his-research-against-supermicro/ https://www.servethehome.com/yossi-appleboum-disagrees-bloom...
- rmrfstar 6y ago
  It's worth noting that Apple and Amazon can't lie about their business without opening themselves up to potential criminal liability under securities laws. [1] That means Apple and Amazon are more credible in this case, unless there is some super secret NatSec exception to securities law that we don't know about. [1] Specifically, SEC Rule 14a-9 in conjunction with Section 32(a) of the Exchange Act.
  - snypher 6y ago
    If it was true, would they disclose, even if they could? It's not a secret exemption, it's all in the law, Section 505 of the PATRIOT Act.
    - deleted 6y ago
      [deleted]
    - deleted 6y ago
      [deleted]
  - roenxi 6y ago
    > unless there is some super secret NatSec exception to securities law that we don't know about. Did you not hear about the phonetapping business [0]? There is no way that a government-sponsored secret hardware backdoor would get any executives in trouble. SEC rules are not a reasonable protection - or even consideration - when dealing with the US spying apparatus. If there was a hardware backdoor program: (1) There would be a secret exemption to SEC rules. (2) There would probably be a secret "we will end you" threat if the execs revealed details. Snowden & Assange would be mentioned. (3) Even ignoring those two points, the rules would be ignored and changed later if there were any legal difficulties. [0] https://www.cnet.com/news/senate-endorses-retroactive-fisa-immunity-for-warrantless-wiretapping/ https://www.cnet.com/news/senate-endorses-retroactive-fisa-i...
    - deleted 6y ago
      [deleted]
GeorgeTirebiter 6y ago
I believe the matter is unsettled: https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom https://www.bloomberg.com/news/articles/2018-10-09/new-evide...
- shakna 6y ago
  The named source in that one, like the named source in the one before, came out and said that the article was a misrepresentation of what they had said. In fact, in the article you've linked, they disagreed with it the same day the article broke. [0] https://www.servethehome.com/yossi-appleboum-disagrees-bloomberg-is-positioning-his-research-against-supermicro/ https://www.servethehome.com/yossi-appleboum-disagrees-bloom...
GeorgeTirebiter 6y ago
Let me ask a question: it is possible? I think it is. Has the NSA / CIA / some other TLA done this? If it's possible, and it's useful for their 'mission' -- hard for me to believe they have NOT done this, or something like it. Paranoid? maybe; but I've seen too much, heard too much.
- alasdair_ 6y ago
  From random articles I once read (i.e. hardly authoritative) the US TLAs focused heavily on intercepting packages in transit, modifying them, then forwarding them on rather than rooting the entire production line. But obviously that's just the stuff that was publicized.
- henryfjordan 6y ago
  For a secret chip in a server to be useful, it needs to emit a signal, send data over the network, or be manually retrieved. If that were happening at any scale, someone would notice (especially in a data center). If secret chips were going to be used, they'd be very targeted in nature (like a fake Comcast modem that they give to a specific target) rather than something general.
  - rmrfstar 6y ago
    I wouldn't be so confident. If you have something running in the BMC, you can do literally anything. In this case "anything" might mean transmitting a single bit of information that "this is an interesting box, come take a look".
- deleted 6y ago
  [deleted]

count 6y ago

From what I remember, the evidence wasn't shaky, it was non-existent.

shakna 6y ago

> So, I have to ask, does anyone know if Bloomberg actually published the evidence they claimed they would release? In the first article, Bloomberg quoted Joe Fitzpatrick. 5 days later [0] he said his quotes were taken out of context. In the second article, Bloomberg quoted Yossi Appleboum, who on the same day the article broke suggested that he was misrepresented. [1] Apple, Amazon, Homeland Security, and others have all said there was no evidence at all, and called for a retraction. As it stands... Bloomberg were talking about something they didn't understand. There were and are some theoretical problems in hardware security. But the story as they broke it is completely false. [0] https://risky.biz/RB517_feature/ https://risky.biz/RB517_feature/ [1] https://www.servethehome.com/yossi-appleboum-disagrees-bloomberg-is-positioning-his-research-against-supermicro/ https://www.servethehome.com/yossi-appleboum-disagrees-bloom...

rmrfstar 6y ago
It's worth noting that Apple and Amazon can't lie about their business without opening themselves up to potential criminal liability under securities laws. [1] That means Apple and Amazon are more credible in this case, unless there is some super secret NatSec exception to securities law that we don't know about. [1] Specifically, SEC Rule 14a-9 in conjunction with Section 32(a) of the Exchange Act.
- snypher 6y ago
  If it was true, would they disclose, even if they could? It's not a secret exemption, it's all in the law, Section 505 of the PATRIOT Act.
  - deleted 6y ago
    [deleted]
  - deleted 6y ago
    [deleted]
- roenxi 6y ago
  > unless there is some super secret NatSec exception to securities law that we don't know about. Did you not hear about the phonetapping business [0]? There is no way that a government-sponsored secret hardware backdoor would get any executives in trouble. SEC rules are not a reasonable protection - or even consideration - when dealing with the US spying apparatus. If there was a hardware backdoor program: (1) There would be a secret exemption to SEC rules. (2) There would probably be a secret "we will end you" threat if the execs revealed details. Snowden & Assange would be mentioned. (3) Even ignoring those two points, the rules would be ignored and changed later if there were any legal difficulties. [0] https://www.cnet.com/news/senate-endorses-retroactive-fisa-immunity-for-warrantless-wiretapping/ https://www.cnet.com/news/senate-endorses-retroactive-fisa-i...
  - deleted 6y ago
    [deleted]

GeorgeTirebiter 6y ago

I believe the matter is unsettled: https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom https://www.bloomberg.com/news/articles/2018-10-09/new-evide...

shakna 6y ago
The named source in that one, like the named source in the one before, came out and said that the article was a misrepresentation of what they had said. In fact, in the article you've linked, they disagreed with it the same day the article broke. [0] https://www.servethehome.com/yossi-appleboum-disagrees-bloomberg-is-positioning-his-research-against-supermicro/ https://www.servethehome.com/yossi-appleboum-disagrees-bloom...

GeorgeTirebiter 6y ago

Let me ask a question: it is possible? I think it is. Has the NSA / CIA / some other TLA done this? If it's possible, and it's useful for their 'mission' -- hard for me to believe they have NOT done this, or something like it. Paranoid? maybe; but I've seen too much, heard too much.

alasdair_ 6y ago
From random articles I once read (i.e. hardly authoritative) the US TLAs focused heavily on intercepting packages in transit, modifying them, then forwarding them on rather than rooting the entire production line. But obviously that's just the stuff that was publicized.
henryfjordan 6y ago
For a secret chip in a server to be useful, it needs to emit a signal, send data over the network, or be manually retrieved. If that were happening at any scale, someone would notice (especially in a data center). If secret chips were going to be used, they'd be very targeted in nature (like a fake Comcast modem that they give to a specific target) rather than something general.
- rmrfstar 6y ago
  I wouldn't be so confident. If you have something running in the BMC, you can do literally anything. In this case "anything" might mean transmitting a single bit of information that "this is an interesting box, come take a look".
deleted 6y ago
[deleted]