Bloomberg relives the Super Micro espionage story it first picked up in 2018. The original story was met with disguise and unequivocal denials from everyone from Apple to the NSA, and the media company was rightly condemned for not providing the evidence or the claim. Today it doubles.
Today’s update claims that spyware chips were found in Super Micro servers at the US Department of Defense …
Background
Here’s how we reported the original story in October 2018.
Bloomberg today released a report claiming that companies, including Amazon and Apple, have found Chinese surveillance chips in their server hardware contracted by Super Micro. Bloomberg claims Apple found these chips on its server motherboards in 2015. Apple strongly refutes this report and sends press releases to various publications, not just to Bloomberg.
Apple said in a statement to CNBC: “We are deeply disappointed that Bloomberg’s reporters in their dealings with us did not disclose the possibility that they or their sources were misinformed or misinformed.”
Denial of the story was quick and overwhelming. Apple said it had fully investigated the claims, and later provided information outside the record of the investigation. I explained at the time the five reasons why I believe Apple, with four more reasons to make it clear that the Cupertino company is telling the truth.
It was not just Apple that denied the claim. The Department of Homeland Security has done the same. One of Bloomberg’s sources told them that the story made no sense. The NSA added its denial. A deep-dive analysis found that the allegations were impossible. A Super Micro audit found no spying chips.
Super Micro spy chip story, take two
Bloomberg today released a new report that initially reads as if it were a completely new story.
In 2010, the U.S. Department of Defense found thousands of its computer servers sending military network data to China – the result of code hidden in chips that handled the boot process of the machines.
In 2014, Intel Corp. discovered that a Chinese hacking group had broken its network through a single server that downloaded malware from a vendor’s update site.
And in 2015, the Federal Bureau of Investigation warned several companies that Chinese companies had hidden an extra disk loaded with backdoor code in the servers of one manufacturer.
Each of these different attacks has two things in common: China and Super Micro Computer Inc., a computer hardware manufacturer in San Jose, California.
Super Micro again denied the report.
In response to detailed questions, Supermicro said it had “never been contacted by the U.S. government, or by any of our customers, about these alleged investigations.” The company said Bloomberg had compiled an accident of divergent and inaccurate allegations that ‘draw advanced conclusions’. Federal agencies, including those described in this article as investigations, are still buying Supermicro products, the company said.
You need to get into the piece a bit before referring to the original reporting.
Bloomberg Businessweek first reported on China’s interference with Supermicro products in October 2018, in an article focusing on the version of additional malicious chips found on server motherboards in 2015. According to the story, Apple and Amazon discovered the chips on equipment they bought. Supermicro, Apple and Amazon have publicly asked to withdraw. U.S. government officials are also disputing the article.
With additional reporting, it is now clear that the Businessweek report captured only a larger portion of a larger series of events in which U.S. officials first suspected China’s repeated manipulation of Supermicro’s products, then investigated, monitored and attempted to drive.
As before, most sources are anonymous, but a few are said to have been told about the allegations, albeit without any initial knowledge.
“In early 2018, two security companies I advise were informed by the FBI’s counterintelligence department about the discovery of the additional malicious chips on Supermicro’s motherboards,” said Mike Janke, a former Navy SEAL co-founder of DataTribe , a venture capital firm, said. “These two companies were then involved in the government’s investigation, where they used advanced hardware forensics on the actual tampered Supermicro boards to confirm the existence of the additional malicious chips.” […]
“It was espionage on the board itself,” Mukul Kumar said. He said he received one of these warnings during an unclassified briefing in 2015 when he was the chief security officer of Altera Corp., a San Jose disk designer. “There was a chip on the board that would not be there, and not to Supermicro, but to China.” […[
Mike Quinn, a cybersecurity executive who served in senior roles at Cisco Systems Inc. and Microsoft Corp., said he was briefed about added chips on Supermicro motherboards by officials from the U.S. Air Force. Quinn was working for a company that was a potential bidder for Air Force contracts, and the officials wanted to ensure that any work would not include Supermicro equipment, he said.
Bloomberg acknowledges the US government denials of its original coverage, and says that the NSA remains befuddled by the claims.
After Bloomberg reported on the added-chip threat in October 2018, officials for the U.S. Department of Homeland Security, the FBI, the Office of the Director of National Intelligence and the NSA made public statements either discounting the report’s validity or saying they had no knowledge of the attack as described. The NSA said at the time it was “befuddled” by Bloomberg’s report and was unable to corroborate it; the agency said last month that it stands by those comments.
You might want to ensure a decent supply of popcorn for the next few days.
Photo by Laura Ockel on Unsplash
FTC: We use income earning auto affiliate links. More.
Check out 9to5Mac on YouTube for more Apple news: