3 ms·

first, I don't understand how this quote squares with your overall description -- it's specific, first-hand, from a named source, who should (on its face) know

first, I don't understand how this quote squares with your overall description -- it's specific, first-hand, from a named source, who should (on its face) know what he is talking about: > “This was espionage on the board itself,” said Mukul Kumar, who said he received one such warning during an unclassified briefing in 2015 when he was the chief security officer for Altera Corp., a chip designer in San Jose. “There was a chip on the board that was not supposed to be there that was calling home—not to Supermicro but to China.” second, the article presents a plausible scenario for why it would be difficult to get additional details: the U.S. govt's strategy for dealing with this was to let it play out, so they could learn more about the nature of the threat. any public disclosures about this are at odds with the strategy of the U.S. government in combating it. it seems like a very realistic scenario to me that some of the details of what happened became "lost in translation" - but that there is a real underlying truth. the first article wasn't convincing to me, but this one is very difficult to dismiss.

michaelt 6y ago
> first, I don't understand how this quote squares with your overall description A person who "received a warning in an unclassified briefing" isn't first-hand. At best it's second-hand, if whoever analysed the hardware implant was going out giving briefings in person. More likely it's third-hand. > it seems like a very realistic scenario to me that some of the details of what happened became "lost in translation" If the claim was an evil driver update, or a backdoored BIOS, that would be completely believable. Indeed, most of the details of this attack could just be a miscommunication about a BIOS backdoor - supply chain attack, malicious, code that shouldn't have been there, stored in an eeprom on the motherboard, undetectable by visual inspection. But the much more astonishing claim of a malicious hardware implant between layers of a PCB? Something that surprising needs the testimony of an electronics expert, not a cop or a C-suite officer. Especially after the purported victims from the first article denied knowing anything about it.
- jstrong 6y ago
  "first hand" as in, 'the govt told me that china bugged supermicro motherboards,' as opposed to, 'I was told the govt briefed tech companies about how china bugged supermicro motherboards.' honestly, describing the testimony I quoted as "third hand", simply because the person doing the briefing for the govt was not the same person to have discovered the breach, is completely ridiculous. do you agree the article establishes that the U.S. govt repeatedly warned private sector companies that supermicro servers had been bugged by china? maybe the us govt was wrong about that! could be! but it's still a huge story and much more than what was established by the first bloomberg article.
  - michaelt 6y ago
    > do you agree the article establishes that the U.S. govt repeatedly warned private sector companies that supermicro servers had been bugged by china? I agree the article establishes that unnamed sources in government are giving out briefings. But I don't think that was ever in doubt. Even when the first article was written, I could easily believe the journalist's claim they were told what they wrote by some sketchy anonymous government source. I just think they didn't demonstrate the truth of their source's claim. There's always some anonymous "senior government official" ready to tell a journalist that Iraq has weapons of mass destruction (but they can't show the evidence as it's classified) or whatever other narrative they're pushing at the time. It's a journalist's responsibility to apply due skepticism.
    - jstrong 6y ago
      > some sketchy anonymous government source for whatever reason, you are refusing to grapple with the fact that the second, just-released article, does not rely on the testimony of anonymous government sources, "sketchy" or otherwise, but on multiple, named, private sector sources. the people who are quoted have reputations that are important to them. they are claiming to have participated in concrete events. it's a very different category of testimony than "government sources say."
      - michaelt 6y ago

michaelt 6y ago

> first, I don't understand how this quote squares with your overall description A person who "received a warning in an unclassified briefing" isn't first-hand. At best it's second-hand, if whoever analysed the hardware implant was going out giving briefings in person. More likely it's third-hand. > it seems like a very realistic scenario to me that some of the details of what happened became "lost in translation" If the claim was an evil driver update, or a backdoored BIOS, that would be completely believable. Indeed, most of the details of this attack could just be a miscommunication about a BIOS backdoor - supply chain attack, malicious, code that shouldn't have been there, stored in an eeprom on the motherboard, undetectable by visual inspection. But the much more astonishing claim of a malicious hardware implant between layers of a PCB? Something that surprising needs the testimony of an electronics expert, not a cop or a C-suite officer. Especially after the purported victims from the first article denied knowing anything about it.

jstrong 6y ago
"first hand" as in, 'the govt told me that china bugged supermicro motherboards,' as opposed to, 'I was told the govt briefed tech companies about how china bugged supermicro motherboards.' honestly, describing the testimony I quoted as "third hand", simply because the person doing the briefing for the govt was not the same person to have discovered the breach, is completely ridiculous. do you agree the article establishes that the U.S. govt repeatedly warned private sector companies that supermicro servers had been bugged by china? maybe the us govt was wrong about that! could be! but it's still a huge story and much more than what was established by the first bloomberg article.
- michaelt 6y ago
  > do you agree the article establishes that the U.S. govt repeatedly warned private sector companies that supermicro servers had been bugged by china? I agree the article establishes that unnamed sources in government are giving out briefings. But I don't think that was ever in doubt. Even when the first article was written, I could easily believe the journalist's claim they were told what they wrote by some sketchy anonymous government source. I just think they didn't demonstrate the truth of their source's claim. There's always some anonymous "senior government official" ready to tell a journalist that Iraq has weapons of mass destruction (but they can't show the evidence as it's classified) or whatever other narrative they're pushing at the time. It's a journalist's responsibility to apply due skepticism.
  - jstrong 6y ago
    > some sketchy anonymous government source for whatever reason, you are refusing to grapple with the fact that the second, just-released article, does not rely on the testimony of anonymous government sources, "sketchy" or otherwise, but on multiple, named, private sector sources. the people who are quoted have reputations that are important to them. they are claiming to have participated in concrete events. it's a very different category of testimony than "government sources say."
    - michaelt 6y ago