5 ms·

I noticed that it's commonly accepted that Bloomberg's 2018 stories on the Supermicro hack were bogus, costing them a huge amount of reputational damage. Howeve

I noticed that it's commonly accepted that Bloomberg's 2018 stories on the Supermicro hack were bogus, costing them a huge amount of reputational damage. However, Bloomberg stood by the stories. I'm very curious to see how this one will be received. I was never quite convinced by the naysayers or the denials by the government, Apple, or Amazon. I think it's quite likely that Bloomberg will be proven right in the end, this story having been accurate but suppressed for "secrecy" reasons all along. Notably, one of the criticisms at the time was that Bloomberg didn't name credible sources with first-hand accounts of the events — understandably given the sensitivity. This time, it seems they have been able to do so. Either way, I'm thrilled to see an outlet do original reporting and stand by their work in the face of universal condemnation. We are better off for having strong dissenting views informing us and expanding the narrative. I'm finding myself increasingly distrustful of the work of journalism outlets, but this (and those gone independent on Substack) gives me hope.

DyslexicAtheist 6y ago
telecom engineer here (not on a Huawei/ZTE payroll). the reason why the original piece is extremely unlikely is the cost of keeping a conspiracy involving this many entities and requiring collaboration between them under wraps. you do not need hardware implants or even sw based backdoors when the system is fragile enough to get the same undocumented functionality without. it is not needed because the quality of Huawei/ZTE and all the Chinese based tech vendors is so shockingly bad that no such backdoors are needed to achieve their objectives. shitty quality gives much better plausible deniability than a well designed backdoor in thoroughly tested code. The big and only story IMO is that Huawei steals shit from other companies. I had my own work for control-plane on eNodeB stolen by colleagues in our Chinese site that then moved to Huawei. The company should be sanctioned all around the world and their CFO hopefully will rot in a US prison.
- acct776 6y ago
  > the reason why the original piece is extremely unlikely is the cost of keeping a conspiracy involving this many entities and requiring collaboration between them under wraps. https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure... https://en.wikipedia.org/wiki/Manhattan_Project https://en.wikipedia.org/wiki/Manhattan_Project etc
minikites 6y ago
>I was never quite convinced by the naysayers or the denials by the government, Apple, or Amazon. When you say "naysayers" are you including other organizations who tried and failed to corroborate the original story? It's difficult to prove a negative but the Bloomberg story seems bogus to me because not a single other organization was able to find anything of the sort. If the hacking was this widespread, I tend to think someone else would be able to find something.
notional 6y ago
FWIW this is written by the same authors as the 2018 pieces. https://twitter.com/jordanr1000/status/1049684795448537088 https://twitter.com/jordanr1000/status/1049684795448537088 https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom?srnd=premium https://www.bloomberg.com/news/articles/2018-10-09/new-evide...
- notional 6y ago
  Possibly debunked already, https://twitter.com/pwnallthethings/status/1360232753623629824 https://twitter.com/pwnallthethings/status/13602327536236298...
ocdtrekkie 6y ago
Either these Bloomberg reporters are excellent and stick to principles in the face of condemnation or terrible hacks unwilling to take a loss. I guess someday we'll know for sure.
smsm42 6y ago
> it's commonly accepted that Bloomberg's 2018 stories on the Supermicro hack were bogus Somebody owes a little apology here I think - if Bloomberg story confirms, which I now give a very good chance. Especially the "experts" that were so uniformly wrong. Schneier did recognize he was wrong, but only very matter-of-factly. I think there's more work to be done to figure out why so many people got so huge a story so wrong. I do not call for public shamings or anything, God forbid, but there should be some more work on this done than "ok, I was wrong, never mind", if turns out we had so many people get it wrong. There's a lot of trust placed in "experts" - in fact, disagreeing once with "experts" are now the grounds for a permanent ban from many platforms - and if they are getting things so wrong, we're finding ourselves in a very bad situation, information-wise.

DyslexicAtheist 6y ago

telecom engineer here (not on a Huawei/ZTE payroll). the reason why the original piece is extremely unlikely is the cost of keeping a conspiracy involving this many entities and requiring collaboration between them under wraps. you do not need hardware implants or even sw based backdoors when the system is fragile enough to get the same undocumented functionality without. it is not needed because the quality of Huawei/ZTE and all the Chinese based tech vendors is so shockingly bad that no such backdoors are needed to achieve their objectives. shitty quality gives much better plausible deniability than a well designed backdoor in thoroughly tested code. The big and only story IMO is that Huawei steals shit from other companies. I had my own work for control-plane on eNodeB stolen by colleagues in our Chinese site that then moved to Huawei. The company should be sanctioned all around the world and their CFO hopefully will rot in a US prison.

acct776 6y ago
> the reason why the original piece is extremely unlikely is the cost of keeping a conspiracy involving this many entities and requiring collaboration between them under wraps. https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure... https://en.wikipedia.org/wiki/Manhattan_Project https://en.wikipedia.org/wiki/Manhattan_Project etc

minikites 6y ago

>I was never quite convinced by the naysayers or the denials by the government, Apple, or Amazon. When you say "naysayers" are you including other organizations who tried and failed to corroborate the original story? It's difficult to prove a negative but the Bloomberg story seems bogus to me because not a single other organization was able to find anything of the sort. If the hacking was this widespread, I tend to think someone else would be able to find something.

notional 6y ago

FWIW this is written by the same authors as the 2018 pieces. https://twitter.com/jordanr1000/status/1049684795448537088 https://twitter.com/jordanr1000/status/1049684795448537088 https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom?srnd=premium https://www.bloomberg.com/news/articles/2018-10-09/new-evide...

notional 6y ago
Possibly debunked already, https://twitter.com/pwnallthethings/status/1360232753623629824 https://twitter.com/pwnallthethings/status/13602327536236298...

ocdtrekkie 6y ago

Either these Bloomberg reporters are excellent and stick to principles in the face of condemnation or terrible hacks unwilling to take a loss. I guess someday we'll know for sure.

smsm42 6y ago

> it's commonly accepted that Bloomberg's 2018 stories on the Supermicro hack were bogus Somebody owes a little apology here I think - if Bloomberg story confirms, which I now give a very good chance. Especially the "experts" that were so uniformly wrong. Schneier did recognize he was wrong, but only very matter-of-factly. I think there's more work to be done to figure out why so many people got so huge a story so wrong. I do not call for public shamings or anything, God forbid, but there should be some more work on this done than "ok, I was wrong, never mind", if turns out we had so many people get it wrong. There's a lot of trust placed in "experts" - in fact, disagreeing once with "experts" are now the grounds for a permanent ban from many platforms - and if they are getting things so wrong, we're finding ourselves in a very bad situation, information-wise.