From this morning’s Bloomberg report titled The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies:
Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design. Amazon reported the discovery to U.S. authorities, sending a shudder through the intelligence community. Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. And Elemental was just one of hundreds of Supermicro customers.
And:
One official says investigators found that it eventually affected almost 30 companies, including a major bank, government contractors, and the world’s most valuable company, Apple Inc. Apple was an important Supermicro customer and had planned to order more than 30,000 of its servers in two years for a new global network of data centers. Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons.
Apple’s response to Bloomberg:
“On this we can be very clear: Apple has never found malicious chips, ‘hardware manipulations’ or vulnerabilities purposely planted in any server,” Apple wrote. “We remain unaware of any such investigation,” wrote a spokesman for Supermicro, Perry Hayes. The Chinese government didn’t directly address questions about manipulation of Supermicro servers, issuing a statement that read, in part, “Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.” The FBI and the Office of the Director of National Intelligence, representing the CIA and NSA, declined to comment.
And another Apple reply, from this CNBC article:
Apple has issued strong denials of the report, stating: “We are deeply disappointed that in their dealings with us, Bloomberg’s reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple.”
The Bloomberg article is a fascinating read. Scary possibilities, and amazing that someone figured this out.
Why does this headline break from the usual style, where the external link matches the underlying article?
Not sure what you mean. When I click on the headline, I go to the Bloomberg article. Where does it take you? And feel free to continue conversation via Twitter (@davemark)
I recall stories from 2016 regarding Apple’s concerns about supply chain compromises. Seems China went after the hardware, Russia the software as well as the political parties. That this is just now a big story, and that we have been doing very little about Russian hacking, shows how vulnerable we still are.
No I mean the headline has a different title than the Bloomberg article, which is in the body. This is different than usual, e.g. “The Apple Watch faces its toughest challenge yet: grandma and grandpa” or “In Praise of Mediocrity”.
When The Loop has previously been accused of editorializing in headlines, you point that you’re just putting the article headline in. Instead, the Apple denial gets top billing, despite Apple not being the main subject of the story.
Yes, it was specifically about Supermicro. Sorry I had to break the link otherwise, I go to into the penalty box.
https://arstechnica.
com/information-technology/2017/02/apple-axed-supermicro-servers-from-datacenters-because-of-bad-firmware-update/
continuing the conversation on Twitter is dumb, the conversation is happening here, on your own website, in the article’s own comments. twitter is not a suitable or appropriate venue.
i would guess that’s reserved for posts where all the quotes and content are from that single source, whereas this is from several. the first is the bloomberg story, and is cited with title. the subsequent paragraphs are from apple and CNBC sources. so the post’s title is about the controversy and the he said/she said, not bloomberg’s story alone.
that would be my guess.
I found the Bloomberg article painful to read. It jumps all over the place and feels like it was just a SEO keyword stuff piece. Plus it sounds like they were kind of wrong.