Slashdot Mirror
Super Micro Says Review Found No Malicious Chips in Motherboards (reuters.com)
Computer hardware maker Super Micro Computer told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards. From a report: In a letter to customers, the San Jose, California, company said it was not surprised by the result of the review it commissioned in October after a Bloomberg article reported that spies for the Chinese government had tainted Super Micro equipment to eavesdrop on its clients.
There's no proving a negative. Burden of proof is on Bloomberg and they don't have it. People who believe the Bloomberg story aren't going to be convinced of anything otherwise. It's like trying to argue a person's religious belief is 'not true'.
Exactly. Supposedly thousands of motherboards were compromised, and sold to multiple customers. The failure of Bloomberg (or anyone else) to produce a single compromised piece of hardware, or even a die photo of the supposed spy chip, says it all. There's no evidence to be found because it doesn't exist.
Conspiracy believers aren't going to change their minds. But for everyone else in the industry, it has become blatantly clear that Bloomberg screwed up royally with this story.
I seem to remember a news story from almost a decade ago about a surreptitious monitoring chip installed in a laptop, connected to the laptop's keyboard. This may have been a targeted attack, and not an infiltration of the supply line. Personally, I believe the unknown keyboard chip wasn't any kind of listening device, but rather some compatibility device to make the keyboard work.
I have some doubts about how a tiny "grain of rice sized chip" can both send and receive data on the wired ethernet port (differential signals) without actually BREAKING the lines and inserting itself into the path. Also, it wouldn't magically have FULL CONTROL of the PC, but would be able to only retransmit the data that was coming in/going out of the ethernet port to another ip address.