Replies

Can you provide a link or two that convinced you that the Bloomberg story was wrong? I really don’t trust places like The Verve and such. This is quite a claim against Bloomberg, which as far as I know, has not published a correction or retraction. We’re on the same team, my friend. I just want to know what you know.

Sure can, aside from the in-depth research I did independently myself, here’s a FR article (which unfortunately linked to NASDAQ, that doesn’t keep it’s stories), in which the US company involved had it’s logic boards audited by an independent third party which found nothing awry.

Here’s another earlier FR article, citing even US government officials in NSA who found NO SUCH BOGUS PARTS in the logic boards in the Bloomberg article.

"I've got all sorts of commercial industry freaking out and just losing their minds about this concern, and nobody's found anything," Joyce added.
Joyce, a former White House cybersecurity coordinator, noted that all of the companies named in the Bloomberg Businessweek report have issued strong denials, including Apple, Amazon, and Supermicro. He said those companies would "suffer a world of hurt" if regulators later determine that they lied.

Here is a link to Apple’s official statement denying the entire Bloomberg article’s contentions. In part Apple’s spokesperson stated:

On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.

Bloomberg based its entire article on a single source, Yossi Appelbaum, a man who owns a company which has as it’s reason for existence selling a device to scan logic boards for what the company says may be spurious software and hardware added to the boards. HE claims his device can locate additional hardware added to any PC board added by bad actors, and used his discovery of the so-called spurious chip on the Supermicro logic boards as proof to the totally clueless, non-technologically oriented Bloomberg article authors and editors, who ran with their “bombshell” story. One expert categorically stated “This makes no sense,” a comment that was left out of the story.

Bloomberg was even challenged by their own experts they cited in their article, who were aghast when they saw the final article and found they were quoted out of context, most often with the qualifying statement that it “might be theoretically possible to add a chip” but not at all practical to do so.

I posted my initial analysis of the events surrounding the Bloomberg Claims also on FR back when the article was published:

SOMETHING SMELLS LIKE BLOOMBERG'S DIRTY SOX. Apple was going to use the hardware in their iTunes Streaming video/movie service they were installing back in 2015-2016 order 30,000 rack mounted servers from Elemental Systems who had their servers made by Supermicro. However, even Bloomberg BusinessNews states that Apple cancelled the order when their engineers discovered the malicious IC chip on the motherboard of test units they received.
The more I think about this the less sense it makes for several very good reasons.

Both Amazon and Apple supposedly discovered this malicious IC chip in 2015, three years ago.
Nothing was said about it in any security bulletin to the industry warning about security problems with servers made in China.
IN THREE YEARS! Seriously?
Software could have been developed to disable or block transmission of the stolen data back to China since it was known. Really? The URL of the target server had to be available.
The revelation about this malicious chip comes from a single main stream media news source which cites only anonymous sources both in the impacted government and the two major companies, Amazon and Apple, the two largest companies in the world by market cap. Yet we hear crickets.
Other companies are vaguely mentioned but not by name.
Amazon, Apple, and Supermicro vigorously deny any such chip exists and that any such events happened.
Amazon acquired Elemental Systems in late 2015 and continued ordering Supermicro servers for use in their Amazon Web Service (AWS) cloud and for Amazon Prime streaming video / movie service
AWS CEO independently said there were no spurious hardware installed in or on the Supermicro motherboards.
Apple did not break off doing business with Supermicro until sometime in 2016, selecting another supplier, perhaps due to the increased demand Amazon was placing on Supermicro due to growth of Amazon Prime.
Altering the design of a motherboard to add another chip is not an easy thing to due and must be done from engineering on. . . especially on a multilayered board.
None of the articles have shown this IC chip in situ on a motherboard, instead they show a photo of a generic miniature grain of wheat chip perched on a finger tip. Why not show one in situ?
No one has described how this tiny chip accomplishes what it accomplishes with the various scenarios a server environments that might be encountered. It just is.
The denial by both Apple management and Amazon management is backed by the fact that they face penalties if they are lying imposed by the Sarbanes Oxley Act of 2002 which imposes PERSONAL fines of from $10 million to $20 million and imprisonment in a Federal institution for ten to twenty years. What incentive do these managers and officers have to lie. In Apple's case, they never even USED the products involved, cancelling the order.
Bloomberg has published FAKE NEWS before.

Given all that, something here doesn't smell right. . . my BS o'meter is almost pegged at 100%!