How the Chinese Quietly Launched a Massive Cyber Attack

It seems all this information comes from "unnamed sources", why would that be the case, if this was true? Surely the independent security company(unnamed) in Canada would stand behind their findings....Surely the US government would make a statement....

https://www.cnbc.com/2018/10/04/chinese-spy-chips-are-said-to-be-found-in-hardware-used-by-apple-amazon-apple-denies-the-bloomberg-businessweek-report.html

Is there a point here?

A question?

Probably belongs in the Break Room.

This is certainly engineering related....and is presented as a topic of discussion in case that's not clear...that's why it's posted in "General Discussion"....

"Is this fake news? Did Bloomberg make all this up?"

"It seems all this information comes from "unnamed sources", why would that be the case, if this was true?"

"Surely the independent security company(unnamed)"

Bull!

Take it to the Break Room!

Media literacy is an immense, growing issue around the world. Not just in our country.

Just being able to think critically about news sources, being able to suss out bias and identify 'facts' that just feel wrong is not taught very well throughout primary education here in the U.S. I'm blessed to have a journalism degree and work in a somewhat-related field, so it is second nature.

Consider all of the individuals who don't have this ability. They are the dolts who believe every Twitter post or Facebook rant as gospel. It isn't necessarily their fault. People from impoverished backgrounds don't have access to the same educational resources and are more likely to fall victim to credible reporting.

Bloomberg has a track record of reliable reporting. It's their job.

Amazon, Apple, et al have varying track records of protecting user privacy.

There is more to this story than has been published, that is for sure.

I encourage readers to ask, "Who has what to lose?"

(That said, we all know "fake news" is a charged topic. Let's keep it on discussion.)

Apple? Amazon? You do realize you are talking about Mega Corps. It is time we understand that the rules, laws, morals that we people function under are very different than what Mega corps do. I work for one and I can tell you they will lie, cheat, and steal if it increases their bottom line. So long as they don't get sued then it's all good. Legal? not important unless cuaght. Honest? only if there's money in it. Ethics? Ends justifies the means.

And I thought gaslighting was bad in the domestic violence arena. Abusers can't hold a candle to mega corps.

Engineering360 just today published an article about using AI to identify fake news:

http://electronics360.globalspec.com/article/12928/using-artificial-intelligence-to-sniff-out-fake-news-at-its-source

Back when I was a reference librarian one of my jobs was to explain the difference between reliable and unreliable information sources and how to tell if an unfamiliar source can be trusted. I got out of the biz before the internet became the only necessary imprimatur any piece of information needed to be considered accurate ("It's published on the internet so it must be OK). Even venerable newspapers like the NY Times and the Guardian make mistakes, but authoritative sources prove over and over again that they are overwhelmingly reliable.

I think this is an important topic, can these large companies like Amazon and Apple and other(some 30 here) be trusted with our information, they have access to our money, our accounts....If they are being hacked and know about it, but are denying it to the public, this is a major issue...not to mention our national security and intellectual property...now China has been accused of stealing and spying and lying about it numerous times in the last few years, and we have what some consider as a reliable source saying this is so in a big way....I want to know the truth...because somebody here is lying, they can't both be telling the truth...

Apple and Amazon have an incentive to not admit it's true. That could be because it's not true...or it could be because if it were true and they admitted it, there might be undesirable consequences to their company and shareholders.

What was Volkswagen's initial response when it they were discovered to have cheated on the emission tests? Denial or 'Yup, we're guilty, so sorry folks'?

There could be other forces at work here, such as short sellers...Shorting a company's stock, then starting rumors about impending doom, is a tactic used by ruthless traders...Seems strange that all these claims come from only one source (Jordan Robertson and Michael Riley) ok two guys......China is the perfect villain...

https://www.lawfareblog.com/china-supermicro-hack-about-bloomberg-report

Amazon cannot be trusted with information. They obliterated their discussion forums, which is perhaps a greater loss than all combined historical book-burnings.

With the exception of BestInShow'S post nothing here has anything to do with topics other than conspiracy theories.

I've submitted the question to Snopes....we'll see where they stand....if they take one...

It's not like these sorts of attacks are rare, indeed they happen all the time....in fact the numbers are staggering...62 attacks listed here just in 2018 so far...China is the main offender and the US is the main victim...

"This timeline records significant cyber incidents since 2006. We focus on cyber attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars."

https://www.csis.org/programs/cybersecurity-and-governance/technology-policy-program/other-projects-cybersecurity

"In 2014, five Chinese military hackers were indicted for offenses that included computer hacking and economic espionage, targeting Americans in industries such as nuclear and solar power. It was the first time criminal charges were brought against Chinese military hackers for cyberattacks. But they never went to trial.

The individuals were part of the People’s Liberation Army Unit 61398, one of 22 known operations bureaus under the Third Department of the General Staff Department—the warfighting branch of the Chinese military. Each of these bureaus is involved with different forms of cyber operations, many of which target the United States and other countries."

https://www.theepochtimes.com/you-cant-understand-cyberattacks-without-understanding-chinese-spies_2675300.html

http://theconversation.com/how-the-chinese-cyberthreat-has-evolved-82469

Why do they need to add a special chip? Don't they make all the motherboards and many of the chips in China anyway?
We don't know what's on the silicon in any of the dozens of chips on any given motherboard.
There could be dozens of back doors.

I wonder how these people managed to bypass the security protocol?

Denial is a standard initial response, done so the person can hope the question disappears or have time to counter it in some way. "Plausible Deniability" is a well-used approach by governments and agencies. Questioning the reliability of sources is an easy way to dispute a report without directly commenting on it. We see all of these far too frequently.

I have read the entire bloomberg report and find sufficient discussion within it to rank it as credible.

--JMM

Not easy to spot...

https://www.jfe-tec.co.jp/en/electronic-component/testing.html

And, BTW, I have absolutely no doubt it happened.

A digital-electronic "Tojan Horse"...

..."Luckily, we're likely to know the answer one way or the other in the coming days. If the Bloomberg story is true, there are thousands of compromised motherboards out there, and companies will be scouring their data centers for them. People have already identified the specific circuit board featured in the graphic at the top of the Bloomberg article, though it's not clear if this is a real photograph or a Bloomberg-made mockup. If the story is accurate, sooner or later someone will produce a compromised board and do a public teardown."...

So true, somebody will find one of these boards if they exist...because if it's true all these boards are still out there and the boards have been identified...

..." found the specific #supermicro blade that was referenced in the @business article. aka "MBI-6128R-T2/T2X MicroBlade module unit" and where the rice grain would need to be. "...

https://twitter.com/jamesdotcuff/status/1048221163607007233

https://arstechnica.com/tech-policy/2018/10/bloomberg-stands-by-chinese-chip-story-as-apple-amazon-ratchet-up-denials/

Nice, attached to the Bios chips. Very few would even look there.

Sounds like a VERY good reason to halt ALL "off-shore" electronics fabrication that once was only made in USA.

That would be great if we didn't have any spies here in the US...but foreign agents are everywhere...

Well if Amazon and Apple and others don't sue this news org for libel, then we'll know they're lying about this story being false....Congress should appoint a special prosecutor, and launch an investigation....I'd like to see if they are willing to deny this under oath....Lying to the public is cheap and easy, lying to a prosecutor in a court of law, is quite different....

Apple Again Denies Chinese Spy Chip Story, This Time to Congress

..."Apple wrote a letter of denial to members of Congress—which Reuters reported yesterday—and as of Monday the full letter is now online. “In light of your important leadership roles in Congress, we want to assure you that a recent report in Bloomberg Businessweek alleging the compromise of our servers is not true,” Apple’s vice president of information security George Stathakopoulos wrote in the letter. “You should know that Bloomberg provided us with no evidence to substantiate their claims and our internal investigations concluded their claims were simply wrong.”"...

https://gizmodo.com/apple-again-denies-chinese-spy-chip-story-this-time-to-1829602490

When you consider the legal liability they would be saddled with you really don't expect them to come clean do you?

I mean look at the lengths GM went to hide their ignition switch decision. Look at how little was done to them as a company for willfully killing Americans for profit. Last I checked, Barra and company are not sitting in jail like the VW execs who killed no one.

Take a lesson from our forefathers who fought the revolution against England AND the East India company who was actually charged with collecting the taxes that prompted the Boston Tea Party, for a fee of course, paid by us and they were also being paid to providing "security" in the colonies. We fought this battle once before. It is a shame we haven't become any smarter in the intervening 200 years.

"When you consider the legal liability they would be saddled with you really don't expect them to come clean do you?"

All they need to do is make it more expensive and damaging to lie than to tell the truth...that's the prosecutors job....

Although the mfg and addition would have been in china, is it possible that this chip was added under the authority of another entity. Many agencies both foreign and domestic would want access to the type of data that could be gathered. Perhaps some sort of don't look, don't tell, don't admit it, blame it on someone else loop hole. Just a theory to ponder.

They left footprints though....the chips dialed back to Chinese IP addresses...

Another attack is being reported today on a major telecom by Bloomberg again...

..."Five days after Bloomberg stunned the world with still-unconfirmed allegations that Chinese spies embedded data-sniffing chips in hardware used by Apple, Amazon, and dozens of other companies, the news organization is doubling down. Bloomberg is now reporting that a different factory-seeded manipulation from the previously described one was discovered in August inside the network of a major US telecommunications company.

Bloomberg didn't name the company, citing a non-disclosure agreement between the unnamed telecom and the security firm it hired to scan its data centers. AT&T, Sprint and T-Mobile all told Ars they weren't the telecom mentioned in the Bloomberg post. Verizon and CenturyLink also denied finding backdoored Supermicro hardware in their datacenters, Motherboard reported.

Tuesday’s report cites documents, analysis, and other evidence provided by Yossi Appleboum, who is co-CEO of a hardware security firm called Sepio Systems. Bloomberg said that, while Sepio was scanning servers belonging to the unnamed telecom, the firm detected unusual communications from a server designed by Supermicro. Supermicro, according to last week’s Bloomberg report, is the hardware manufacturer whose motherboards were modified in the factory to include a tiny microchip that caused attached servers to come under the control of a previously unreported division of China’s People’s Liberation Army. Supermicro told Bloomberg it had no knowledge of the implant, marking the second time the hardware maker has denied knowing anything about the reported manipulations.

The Supermicro backdoor reported Tuesday was also the result of malicious hardware secretly implanted during its manufacture. But this time, the addition was made to the ethernet connector of the server used by the telecom company."...

https://arstechnica.com/gadgets/2018/10/new-bloomberg-report-says-backdoored-supermicro-hardware-infiltrated-major-us-telecom/

The debate rages on....

https://9to5mac.com/2018/10/09/bloomberg/

So it appears to be fake news, probably as a result of incompetence at Bloomberg. Too many of these news agencies print stories without any corroboration.

Now that is totally incorrect and I will challenge you to support it with evidence.

Major news outlets are legally responsible for their content. Unlike 45, they can be sued for false stories. They are also dependant on financial support from people who read/watch them making it very hard to stay in business and be wrong. Fox is the exception because they never claimed to be an actual new source. They are an entertainment company and so fiction is acceptable. They can't be sued. However the market corrected as it is supposed to and they lost their number one spot and a large number of advertisers when it became obvious that they lie, alot.

So, please, support your contention that major news outlets are not to be trusted.

I voted it OT, also.

Everybody, 'still looking into it'...

https://www.cnbc.com/2018/10/10/fbi-director-wray-on-super-micro-servers-be-careful-what-you-read.html

You know it seems to me after reading this article, that Supermicro is just a straight up spying operation....either that or they are just completely incompetent beyond belief...

https://arstechnica.com/information-technology/2018/10/supermicro-boards-were-so-bug-ridden-why-would-hackers-ever-need-implants/

So it isn't just Bloomberg and news agencies that have incompetent persons, they're everywhere. "Incompetence everywhere" was my buzzword for many year when I was working. It sounds like it's not getting any better.

IEEE Spectrum posted an article on the subject:

https://spectrum.ieee.org/riskfactor/computing/hardware/this-tech-would-have-spotted-the-secret-chinese-chip-in-seconds?utm_source=techalert&utm_campaign=techalert-10-11-18&utm_medium=email

Personally, I think it's very possible for a circuit to be embedded on a motherboard to conduct malicious intent. It would likely not be a single chip. There would be the difficulty of using the onboard network ports to transmit data without being detected. There's a lot to consider, but when you look at how many data centers and server operators don't maintain and update their security, it becomes less unlikely that this kind of attack might work.

Think about how Stuxnet was spread, hidden on thumb drives and self-replicating. It doesn't seem likely to succeed, but it did.

The Chinese are very different than us. If Supermicro has any government involvement then it is most likely a spy op. disguised as a legit business.

On our end, If the price is low enough who would look that close right? Bean counters and comptrollers are not engineers yet often overide engineering desicions on the most dubious of grounds. Profit.

Yes the American way, chose the cheapest bidder who can deliver the goods....easy pickings for the Chinese government to be that contractor...

It seems to me that the Chinese approach is to embed spyware in every form they can imagine, as a continuing and ongoing effort...Throwing a spaghetti like mix at the wall to see what sticks...and also testing our ability to detect all these different methods....

It's a technological race just like every battle that has ever been fought....of course it's what they do with the information they acquire, that paints the picture...They probably just stockpile it, like a weapon that may become useful at some point in time....M.A.D. 2.0 ?

World War Three has already begun.

More like the 'information cold war'......information does have an expiration date though, and I might add, can be manipulated...like guns with no firing pins, false information instead of a satisfying POP! leaves one instead with egg on face ...

...and possibly a good laugh...