Slashdot Mirror
Apple Insiders Say Nobody Internally Knows What's Going On With Bloomberg's China Hack Story (buzzfeednews.com)
An anonymous reader quotes a report from BuzzFeed News: Multiple senior Apple executives, speaking with BuzzFeed News on the condition of anonymity so that they could speak freely all denied and expressed confusion with a report earlier this week that the company's servers had been compromised by a Chinese intelligence operation. On Thursday morning, Bloomberg Businessweek published a bombshell investigation. The report -- the result of more than a year of reporting and over 100 interviews with intelligence and company sources -- alleged that Chinese spies compromised and infiltrated almost 30 U.S. companies including Apple and Amazon by embedding a tiny microchip inside company servers. Both Amazon and Apple issued uncharacteristically strong and detailed denials of Bloomberg's claims.
Reached by BuzzFeed News multiple Apple sources -- three of them very senior executives who work on the security and legal teams -- said that they are at a loss as to how to explain the allegations. These people described a massive, granular, and siloed investigation into not just the claims made in the story, but into unrelated incidents that might have inspired them. A senior security engineer directly involved in Apple's internal investigation described it as "endoscopic," noting they had never seen a chip like the one described in the story, let alone found one. "I don't know if something like this even exists," this person said, noting that Apple was not provided with a malicious chip or motherboard to examine. "We were given nothing. No hardware. No chips. No emails." Equally puzzling to Apple execs is the assertion that it was party to an FBI investigation -- Bloomberg wrote that Apple "reported the incident to the FBI." A senior Apple legal official told BuzzFeed News the company had not contacted the FBI, nor had it been contacted by the FBI, the CIA, the NSA or any government agency in regards to the incidents described in the Bloomberg report. This person's purview and responsibilities are of such a high level that it's unlikely they would not have been aware of government outreach.
Reached by BuzzFeed News multiple Apple sources -- three of them very senior executives who work on the security and legal teams -- said that they are at a loss as to how to explain the allegations. These people described a massive, granular, and siloed investigation into not just the claims made in the story, but into unrelated incidents that might have inspired them. A senior security engineer directly involved in Apple's internal investigation described it as "endoscopic," noting they had never seen a chip like the one described in the story, let alone found one. "I don't know if something like this even exists," this person said, noting that Apple was not provided with a malicious chip or motherboard to examine. "We were given nothing. No hardware. No chips. No emails." Equally puzzling to Apple execs is the assertion that it was party to an FBI investigation -- Bloomberg wrote that Apple "reported the incident to the FBI." A senior Apple legal official told BuzzFeed News the company had not contacted the FBI, nor had it been contacted by the FBI, the CIA, the NSA or any government agency in regards to the incidents described in the Bloomberg report. This person's purview and responsibilities are of such a high level that it's unlikely they would not have been aware of government outreach.
My colleagues and I were discussing this story last week. My research group has done some work in secure computing, and we were frankly surprised that someone would bother to add a compromised piece of hardware to a motherboard.
Software intrusions always provide plausible deniability to the attacker, which is critical to state-sponsored espionage. But a hardware hack, where someone succeeds in adding a component to a motherboard without the knowledge of the designer, is far more difficult and far more dangerous. A device in hand can be reverse-engineered, and forensics performed to determine exactly when and how it was inserted into the manufacturing chain. Experts can even determine the exact IC fab in which the chip was manufactured.
On top of that, a company that allows its manufacturing process to be compromised has essentially ruined itself. What customer would trust it again? Sure, it is possible that the Chinese government would be willing to spend the money to create a company that could be sacrificed to a state espionage effort, but the problem remains that if the espionage is uncovered, no one will trust any installed hardware purchased from them.
Software intrusions remain extremely successful. The Chinese purportedly breached the OPM and copied all of the personnel files for every U.S. citizen with a security clearance back in 2014, but to this day no one can be entirely sure who was behind it. Likewise, Russia constantly denies its own state-sponsored hacks. For that matter, so does the U.S.A., and everyone else. Why give up such a successful exploit vector in favor of one that provides an undeniable trail back to the perpetrator?
So exactly what is the story behind this Bloomberg article, and where is the proof that the hack actually happened? Someone needs to produce some hardware as proof. This story is definitely becoming even more interesting.
Quite frankly, Bloomberg got fooled by a bunch of people who, for whatever reason, gave them this story.
Why would people do this? I can think of a bunch of reasons off the top of my head:
* someone wanted SuperMicro to play ball, and they refused. This is payback.
* someone wanted SuperMicro's stock to fall, and fall a lot.
* someone wanted to demonstrate they could get the press to print anything, no matter how ridiculous.
* someone wanted to teach Bloomberg a lesson
* someone wanted to throw doubt on the Chinese supply chain. The one that supplies like all the electronics to the US.
* someone wanted China to share some of the attention
It could be all of the above. But really, the story is bullshit. The superchip is a story cooked up to fool reporters, reporters who are smart enough fool themselves into thinking they understand how computers work.
What I'm surprised at is that they didn't ask anyone in the industry about the details. You can always theoretically wire something into a mobo and hide it. You can't practically get something that small to do everything they said it could do. Even James Patterson could tell the difference.
If there's one thing i like about Apple it's their intense hatred for either doing the government's bidding or funding their attempts to do so.
If there's one thing I like about the Feds it's ... ok, there's nothing I like about the Feds but one can at least recognize that the powerful interests scratch each other's backs and Michael "Disarm the Jews" Bloomberg would be happy to help the FBI, et. al. build their case that Apple /must/ be /compelled/ to make iOS spy on its users for them, because "Apple can't even be trusted with its own security."
Look for natural alliances and opportunities to harm their common enemy. Apple isn't making me buy their walled-garden shit so on this one they're an ally of the people who want privacy and personal freedom.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Here's a couple possible scenarios.
1. The source of this is some spooky agency but they don't want people to know it was them that figured it out. SO the attribution went to Amazon discovering it. A plausible cover story at first as long as no one scratched too deep. the story was socialized within the government enough that every one believed it to be true so that's all bloomberg heard was this succefully engineered echo chamber of a story everyone believed was true. The chip part being true and the cover story of it's origin obfuscated.
The reason this would happen in this hasty way is that for obvious reasons the Trump administration needed to get out a story that shows china is a bad trading partner. SO timing was rushed. The three letter agency would not want it's discovery revealed because it like to shield sources and methods. So the compromise was blame it on amazon.
2. For whatever reason apple and amazon dumped some server farms or strategies. Later they realized they had dodged a bullet when the chip issue or mal frimware showed up in supermicro. They have to be really careful here because they could be sued for bad faith in the sales contracts and failure to disclose if it could be made to look like they knew for sure the Supermicro was poison. So they are trying very hard to say they had no knowledge of this (at the time) so this doesn't become a contractual issue.
Both of these stories might be true
Some drink at the fountain of knowledge. Others just gargle.
Two comments back.
1. The servers in question aren't Apple hardware (that isn't set out in the article) as an AC pointed out. Doing a bit of research, the servers in question are Teradata "Extreme Data Appliances".
2. When I was at Celestica, I was part of the team responsible for building Apple products - as a sub, you don't mess with the BoMs, much less the schematic/PCB layout without Apple review and approval without facing HUGE penalties (the least of which is losing the business). This is true for any Tier 1 vendor.
Mimetics Inc. Twitter