There's denial and there's vehement to the point complete denial from multiple different companies.
It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter that if happened would most likely come up in the future again.
Furthermore if apple and amazon were both notified for comments, there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons, especially so if they made apple and amazon lie about it.
Or ... Bloomberg didn't do their due diligence and were too eager to be duped by agents who wanted to push an agenda to move manufacturing away from china or something similar.
>there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons
The rest of your post aside, the FBI cannot do that. It wouldn't matter if it was secret. It's not even a close call, it's been explicitly and repeatedly slammed down by courts even in extreme cases like classified information being illegitimately leaked, for example with the Pentagon Papers (SCOTUS ruling [1] against prior restraint). It just came up again a few months ago when a federal judge tried to use prior restraint and depublishing against the LA Times over their publication of information about a confidential informant and bargain that was accidentally published in full on PACER. A rung bell cannot be unrung.
Now, if the FBI could find a leaker who had signed an agreement with the Federal government they could go after them in person. If a newspaper broke the law to obtain a story then that separate violation could independently be prosecutable (in public). But none of that means the publicly released information can then be taken back. And even if some random blogger might be intimidated illegally and not find the resources to fight back, that wouldn't be an issue for a major publication.
I don't take issue with your skepticism in general but it's not helpful to ascribe special powers to government that it doesn't actually have either.
> It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter
Like, say, the matter of secret surveillance on the mass scale? I mean, the track record here is not exactly pristine.
> Bloomberg didn't do their due diligence and were too eager
That is a distinct possibility too. But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it.
It is possible that because of the nature of counterintelligence investigations, the individual companies agreed to gag orders while law enforcement does its work.
Also, these companies want to continue to do business in China, and likely do not want to be on the record accusing the government of a massive criminal conspiracy.
They throw out some massive numbers though. You can kinda discount 6 "apparatus" sources (but usually for stuff like this it's just one or two, so it's already unusual), but they also mention several people at Apple, Amazon and the FBI, plus someone else in the "discouragement" meeting. That's a lot of agents.
If it's made up, it's more realistic to believe the publication is complicit in the fabrication.
Could these companies to anything _but_ outright deny it?
Silence would be perceived as confirmation, and claiming to not know would be terrifying to their customers. Confirming it would risk their entire supply chain.
Sure, maybe it's not true... but the only move here is to deny it even if it were true. The corporations involved have a massive amount to lose here.
The FBI is not the only jurisdiction these companies have to follow, if they want to continue to operate internationally. Couldn't such silencing orders come from China or something?
I also feel that the hack described is only borderline technically feasible.
They describe a microcontroller the size of a decoupling capacitor that is installed between the main CPU and main memory (as far as I can tell from the vague description).
I assume this would have to be done without layout changes. On a part of the board that is quite sensitive to layout changes. It just doesn’t seem likely that you’d do a hack like this. You’d need a micro controller or ASIC that was running as fast as main memory. You’d need to make it cope with different kernels... and edit memory such that remote servers could reliablely be contacted.
Why not just swap out some other part? Like the IPMI controller? Or the Ethernet controller? Something that has access to main memory, that would hide the functionality even better, and that would give the attacker more space to work with?
Look at the stock of supermicro, since 2015 (the year of revelation) it's been going down for them - reason might be because none of the companies bought new hardware from them.
Tinfoil hat time. Based on my assertions elsewhere I suspect this is posturing plausible deniability for a more local actor being responsible for implants that may or may not be discovered already.
The vigorous denials from Apple and Amazon are suspiciously against the grain in these situations.
Apple and Amazon probably have a small set of TS/SCI cleared employees who dealt with this mess. It’s likely 99.99% of the employees at those firms had no idea what was going on. The switching out of thousands of compromised servers was probably made to look like routine maintenance or upgrades and the whole affair was kept secret. That is, until some high level government employees intentionally leaked it to the media, probably under direction of the White House to garner support for a more aggressive stance on China - the trade war in particular. Read between the lines.
"Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement."
Bloomberg's article and Apple's statement can't both be right.
>"Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons."
> Bloomberg's article and Apple's statement can't both be right.
Possible that Apple employees with security clearance are the only ones with this knowledge i.e. it's fully possible that even Tim Cook doesn't know about this
A lot of people are unaware of how anonymous sources in a serious news organization work. Here, it means that the multiple high-level intelligence officials described in the article are known to and vetted by Bloomberg. They've looked at their resumes and bona fides, and confirmed their backgrounds. They're just not revealing their names to us.
So which is more likely: that multiple intelligence officials are making this up, or that Apple/Amazon/Supermicro feel obligated to lie because this is an ongoing classified counterintel investigation?
Best line from an otherwise serious and and important piece of reporting:
"Two of Elemental’s biggest early clients were the Mormon church, which used the technology to beam sermons to congregations around the world, and the adult film industry, which did not."
Conspiracy theorists aside, the main new thing that came out of the Snowden revelations was that Google’s physical security for data-center-to-data-center traffic was compromised by the NSA, which Google never denied, and responded by hardening server to server traffic.
Regardless about how you feel about the hack, outsourcing the vast majority of our technology to another country just doesn't seem like the smartest idea. Why would we put our most trusted technology into someone else's hands—just because it's going to save a few bucks? Wouldn't it be worth it to just do these things ourselves?
You should talk about "our technology" only if you are a big stock owner or, maybe, a naive employee. They are not called "global corporations" because of their patriotism.
It's not called "global capital" because it cares where to reproduce.
This is interesting in how vehemently all the companies are denying everything. I am pretty clueless about how the feds work so I'll ask: is it possible they would be violating secrecy laws or leaking classified info if they acknowledge this really happened? Could they already be under NDAs or whatever the equivalent is in the national security world?
Or is it simply a matter of their shareholders having lofty expectations about tapping the biggest market in the world (China) and saying anything that angers China is the worst thing you could possibly do from a PR perspective?
I think the article is implying that the implanted chips might not have been detected due to their low profile design. Given that the bad manufacturers were subcontractors it's likely only a fraction of all the boards manufactured were compromised. It's either that or someone at Supermicro was in on it.
The article alleges (b), and give indications of why it wouldn't necessarily be picked up:
> In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. That generation of chips was smaller than a sharpened pencil tip, the person says. (Amazon denies that AWS knew of servers found in China containing malicious chips.)
I've always wondered if that passive device in the great crest at the US embassy in Moscow had equivalents which got hooked up to consumer devices with high voltage parts (to make people reluctant to play inside)
Remember the furore when Zenith was the last domestic manufacturer of TVs in the USA? We've come a long way since then..
I have not seen anything that indicates how installing this chip would do anything at all without also modifying the trace design and fabrication of the PCB itself.
Also does anyone have information about the "baseboard management controller" mentioned? I would like to understand the complexity required to MiTM a ROM or FLASH memory read by such a controller before concluding the feasibility and number of players in manufacturing chain required for it to work.
One thing I don't see much about in the article is the supposed chip which allegedly compromised Super Micro servers. The cover image of the piece shows a surface mount component with three solder pads balanced on a finger tip. Looks like a very simple SMD part to me.
On top of that Apple, Amazon and Super Micro are flat out denying this - I suspect Bloomberg messed up here.
Can someone point me to the exact laws or cases with precedent that would make Apple and Amazon's statements illegal if the Bloomberg article were true? I'm not doubting it, but I can't find much about this online. Pump and dump schemes, ponzi schemes, and insider trading are illegal, and those aspects of securities fraud are well documented online, but this more general "lying to the public" that these companies may or may not be doing has proved trickier to find precedence for. I am not a lawyer, and my only resource here is google, but I think there is an assumption at play that this form of lying is illegal, and I'm honestly not sure that it is.
I could be wayy of base here, but if its not illegal, than it would be pretty obvious what is going on.
The cost of manufacture is a very small part of the cost of assembling computers. For the iPhone, for instance, it represents less than $10 out of the $240 or so total cost. Thus shifting production to other another locale with higher costs would not significantly increase the price of the product, and in any case labor costs are going up in China as well.
Thus you wonder why more production isn't being shifted from China to, say, Thailand, Indonesia or India. Steve Jobs once said the industrial capacity to do the work simply isn't available outside of China, in terms of skilled people and supply chains, and that may be a big reason why.
[+] [-] Illniyar|7 years ago|reply
It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter that if happened would most likely come up in the future again. Furthermore if apple and amazon were both notified for comments, there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons, especially so if they made apple and amazon lie about it.
Or ... Bloomberg didn't do their due diligence and were too eager to be duped by agents who wanted to push an agenda to move manufacturing away from china or something similar.
[+] [-] xoa|7 years ago|reply
The rest of your post aside, the FBI cannot do that. It wouldn't matter if it was secret. It's not even a close call, it's been explicitly and repeatedly slammed down by courts even in extreme cases like classified information being illegitimately leaked, for example with the Pentagon Papers (SCOTUS ruling [1] against prior restraint). It just came up again a few months ago when a federal judge tried to use prior restraint and depublishing against the LA Times over their publication of information about a confidential informant and bargain that was accidentally published in full on PACER. A rung bell cannot be unrung.
Now, if the FBI could find a leaker who had signed an agreement with the Federal government they could go after them in person. If a newspaper broke the law to obtain a story then that separate violation could independently be prosecutable (in public). But none of that means the publicly released information can then be taken back. And even if some random blogger might be intimidated illegally and not find the resources to fight back, that wouldn't be an issue for a major publication.
I don't take issue with your skepticism in general but it's not helpful to ascribe special powers to government that it doesn't actually have either.
-----
1: https://www.law.cornell.edu/supremecourt/text/403/713#writin...
[+] [-] smsm42|7 years ago|reply
Like, say, the matter of secret surveillance on the mass scale? I mean, the track record here is not exactly pristine.
> Bloomberg didn't do their due diligence and were too eager
That is a distinct possibility too. But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it.
[+] [-] bparsons|7 years ago|reply
Also, these companies want to continue to do business in China, and likely do not want to be on the record accusing the government of a massive criminal conspiracy.
[+] [-] toyg|7 years ago|reply
If it's made up, it's more realistic to believe the publication is complicit in the fabrication.
[+] [-] saudioger|7 years ago|reply
Silence would be perceived as confirmation, and claiming to not know would be terrifying to their customers. Confirming it would risk their entire supply chain.
Sure, maybe it's not true... but the only move here is to deny it even if it were true. The corporations involved have a massive amount to lose here.
[+] [-] kazagistar|7 years ago|reply
[+] [-] xevb3k|7 years ago|reply
They describe a microcontroller the size of a decoupling capacitor that is installed between the main CPU and main memory (as far as I can tell from the vague description).
I assume this would have to be done without layout changes. On a part of the board that is quite sensitive to layout changes. It just doesn’t seem likely that you’d do a hack like this. You’d need a micro controller or ASIC that was running as fast as main memory. You’d need to make it cope with different kernels... and edit memory such that remote servers could reliablely be contacted.
Why not just swap out some other part? Like the IPMI controller? Or the Ethernet controller? Something that has access to main memory, that would hide the functionality even better, and that would give the attacker more space to work with?
I don’t get it.
[+] [-] pbalau|7 years ago|reply
[+] [-] onetimemanytime|7 years ago|reply
If China did this, kudos to them, in the sense that that's their job. Just like it is NSA's to do the same to them.
Apple, Google, Microsoft, Intel, FB and a few other companies can probably match China's expertise and expenditure. What about the rest?
[+] [-] kerng|7 years ago|reply
[+] [-] e40|7 years ago|reply
[+] [-] setquk|7 years ago|reply
The vigorous denials from Apple and Amazon are suspiciously against the grain in these situations.
[+] [-] hendzen|7 years ago|reply
[+] [-] uptown|7 years ago|reply
Bloomberg's article and Apple's statement can't both be right.
[+] [-] actionscripted|7 years ago|reply
>"Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons."
[1]: https://www.bloomberg.com/news/features/2018-10-04/the-big-h...
[+] [-] writepub|7 years ago|reply
Possible that Apple employees with security clearance are the only ones with this knowledge i.e. it's fully possible that even Tim Cook doesn't know about this
[+] [-] baq|7 years ago|reply
[+] [-] PascLeRasc|7 years ago|reply
[+] [-] MrBingley|7 years ago|reply
[+] [-] jnbiche|7 years ago|reply
So which is more likely: that multiple intelligence officials are making this up, or that Apple/Amazon/Supermicro feel obligated to lie because this is an ongoing classified counterintel investigation?
[+] [-] lolc|7 years ago|reply
It's simply too early to tell who's telling the truth, who's mistaken, and who's lying here.
[+] [-] nickelcitymario|7 years ago|reply
"Two of Elemental’s biggest early clients were the Mormon church, which used the technology to beam sermons to congregations around the world, and the adult film industry, which did not."
...which did not.
[+] [-] tSheoghi2|7 years ago|reply
https://googleblog.blogspot.com/2013/06/what.html
[+] [-] mercutio2|7 years ago|reply
Conspiracy theorists aside, the main new thing that came out of the Snowden revelations was that Google’s physical security for data-center-to-data-center traffic was compromised by the NSA, which Google never denied, and responded by hardening server to server traffic.
[+] [-] clubm8|7 years ago|reply
At what point do such denials constitute a deceptive trade practive, enabling the Federal Trade Commission to bring action?
You can't lie in a privacy policy, or a TV commercial. Where is the line?
[+] [-] kevlar1818|7 years ago|reply
Did Bloomberg, a widely renowned and distributed news outlet with immense resources, sacrifice hard evidence for sensationalism and clicks?
Or are these companies, all widely renowned with immense resources, bound to silence due to any multitude of shady reasons?
No matter the facts behind the story and these denials, this whole thing reeks of FUD.
[+] [-] nvahalik|7 years ago|reply
[+] [-] RobertoG|7 years ago|reply
It's not called "global capital" because it cares where to reproduce.
This is the system working as intended.
[+] [-] rajataghi|7 years ago|reply
[+] [-] est|7 years ago|reply
Who's next, Vietnamese?
Did you see the pattern here?
[+] [-] ksec|7 years ago|reply
It is missing the word "offender" somewhere.
I think the question simply comes down to this; Can the Chinese Government be trusted?
[+] [-] ElBarto|7 years ago|reply
The US Government can trust the Chinese Government as much as the Chinese Government can trust the US Government. ;)
The spy game has been played for 4,000 years...
[+] [-] superflyguy|7 years ago|reply
[+] [-] sct202|7 years ago|reply
[+] [-] est|7 years ago|reply
I mean Chinese govn't literally buys intel from Chinese hackers. It's encouraged business until the Obama deal.
[+] [-] crunchlibrarian|7 years ago|reply
Or is it simply a matter of their shareholders having lofty expectations about tapping the biggest market in the world (China) and saying anything that angers China is the worst thing you could possibly do from a PR perspective?
[+] [-] neximo64|7 years ago|reply
It would be whole lot harder to find these modifications if this was on the silicon itself.
[+] [-] setquk|7 years ago|reply
(a) the design process was infiltrated, which would have been done US side thus the nationality of the actors is debatable.
(b) the manufacturing process was infiltrated, which SHOULD have been picked up during design validation and production sampling.
(c) this whole thing is a load of rubbish.
Lots of questions here. This is not a tinfoil hat measure as well; genuine questions from someone who HAS worked in the EE side of things.
I wonder if this is a bunch of pre-emptive finger pointing and ass covering for an implant closer to home?
I don't trust either side of the fence if I'm honest.
[+] [-] abvdasker|7 years ago|reply
[+] [-] ceejayoz|7 years ago|reply
> In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached, according to one person who saw pictures of the chips. That generation of chips was smaller than a sharpened pencil tip, the person says. (Amazon denies that AWS knew of servers found in China containing malicious chips.)
There's plenty of precedent for missing things hidden away in stuff: https://en.wikipedia.org/wiki/The_Thing_(listening_device)
[+] [-] jnbiche|7 years ago|reply
[+] [-] ggm|7 years ago|reply
Remember the furore when Zenith was the last domestic manufacturer of TVs in the USA? We've come a long way since then..
[+] [-] cyphunk|7 years ago|reply
Also does anyone have information about the "baseboard management controller" mentioned? I would like to understand the complexity required to MiTM a ROM or FLASH memory read by such a controller before concluding the feasibility and number of players in manufacturing chain required for it to work.
[+] [-] tsuru|7 years ago|reply
[1] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
[+] [-] DeusExMachina|7 years ago|reply
[+] [-] leonroy|7 years ago|reply
On top of that Apple, Amazon and Super Micro are flat out denying this - I suspect Bloomberg messed up here.
[+] [-] Ditiris|7 years ago|reply
[+] [-] nasseri|7 years ago|reply
I could be wayy of base here, but if its not illegal, than it would be pretty obvious what is going on.
[+] [-] fmajid|7 years ago|reply
Thus you wonder why more production isn't being shifted from China to, say, Thailand, Indonesia or India. Steve Jobs once said the industrial capacity to do the work simply isn't available outside of China, in terms of skilled people and supply chains, and that may be a big reason why.