Replies

Still not clear, who is telling the truth here...

It's easy to tell. Bloomberg has a reputation of publishing FAKE NEWS, and not a single story on this has another source except Bloomberg who used anonymous sources.

Not a single Supermicro motherboard has been found with a bogus chip on it. . . out of millions made. Not one. . . except for Bloomberg's claim they found them. Ergo, it never happened.
In the original Bloomberg article announcing the discovery of malicious Chinese spy chips, Bloomberg's reporters who are NOT technically inclined, claimed that both Amazon and Apple discovered the malicious chips in the summer of 2015 when they were examining sample rack mounted servers from SuperMicro which they had purchased as part of their due diligence testing before buying a lot more for their respective cloud systems, Amazon Cloud and iCloud. The story relates how Apple, according to anonymous sources within Apple, cancelled a 30,000 unit order from Supermicro for rack mounted servers and severed its relationship with Supermicro after discovering the malicious chip on a Supermicro motherboard in the summer of 2015. The fact is that Apple did no such thing. First of all, both Amazn and Apple were ordering their servers from Elemental Systems Inc. which USED Supermicro motherboards in its rack mounted servers. Both Amazon and Apple continued doing business with Elemental. Ergo, it never happened.
In fact, Amazon BOUGHT Elemental Systems Inc. lock, stock, and SuperMicro Inc. contract barrel, in the Autumn of 2015, to assure a locked in source of high quality rack mounted servers for their new Amazon Web Service company, (AWS). Elemental began extricating itself from other third-party contracts, including its contract with Apple. Apple purchased between 2,000 and 5,000 Elemental Systems rack mounted servers for use in its iTunes streaming movie/video service. . . but not for iCloud. . . because they were specifically designed for high speed streaming. Apple finally severed its relationship with Elemental and SuperMicro in the summer of 2016, ONE YEAR after they were, according to Bloomberg, supposed to have found the surreptitious spy chip on the SuperMicro motherboard in an Elemental server. Ergo, it never happened.
Amazon, for it's part, certainly would NOT have purchased Elemental AND it's contract with SuperMicro had they found such a suspicious spy chip in their due diligence examination for just an order, much less acquiring the entire company. Ergo, it never happened.
By Federal law, BOTH Apple and Amazon are REQUIRED to report any such security vulnerability immediately on discovery. THERE IS NO SUCH REPORT. The purpose of such a report is to CLOSE THE VULNERABILITY as quickly as possible. . . yet Bloomberg would have us believe this was allowed to fester for THREE YEARS! Ergo, it never happened.
SuperMicro, is based in San Jose, California. It DESIGNS its own motherboards in California, not relying on reference board designs like most motherboard manufacturers, and is responsible for its own Quality Control. These motherboards are six to eight layer laminates, with circuitry on both sides of the laminae. To add an additional Integrated Circuit to the surface of the motherboard would require RE-DESIGNING and RE-ENGINEERING of every layer of the motherboard from the ground up, not an inexpensive or trivial task, nor an easy thing to hide. The IC and the changes to the motherboard would stand out on a QC comparison, which is done by SuperMicro, raising huge RED FLAGS and AHOOGA KLAXONS ALARMS saying this motherboard does NOT MATCH the design criteria. Ergo, it never happened.
The ONLY photograph of the claimed IC used in the Bloomberg article is one of an IC perched on the tip of a finger. However, that IC is not what they claim it to be. It is, according to one of the expert designers, and also to FR experts on such things, a mere common "coupler" used by the dozens on circuit boards and not anything that can do anything like what was claimed. Not once has Bloomberg shown one of these compromised motherboards with the Chinese spy ICs in situ. NO PHOTO EVIDENCE, NO CHIP. Ergo, it never happened.
The FBI, the NSA, and the UK's GSHQ (their equivalent of the CIA and NSA) all released official statements they have no reports and no evidence that such a thing occurred. Ergo, it never happened.
Finally, Bloomberg has been pushing a company called Sepio Inc., which sells a software scanning system for servers which has the sole purpose of finding surreptitious hardware ICs installed on the motherboards and daughterboards. The co-CEO, Yossi Appleboum, has been working with Bloomberg's reporters on these stories for the past year. . . and appears to be the sole real source for the stories. This smacks of previous hoax stories from companies with such anti-virus software to sell who suddenly find a infestation of the systems their software is designed to protect. The 600,000 MacBot hoax from a Russian anti-virus company just at the time they were releasing their first anti-virus for business comes to mind, where not a single infected Mac was ever found in the wild. Sepio wants to sell its products. Bloomberg is pushing the company which was formed in 2016. Ergo, it never happened.
Keep in mind, that not a single Apple or Amazon product is accused of being compromised. . . it has to do with the VIDEO servers used to stream their Amazon Prime and Apple's iTunes movies and video content, because that is what SuperMicro motherboards are specialized for. What are the Chinese going to get? Reruns of "I love Lucy?" The ability to pirate just released to BlueRay movies, or original Amazon and Apple iTunes content? Unlikely in 2015. Ergo, it never happened.