Cyberwar with China is the current equivalent of the old Cold War scuffles with the USSR in third countries. How many lies were told back then, to cover up the worst mishaps? And then they were "uncovered" when it was safer or more convenient to do so.

If these companies are caught red handed lying on behalf of the Chinese or US governments it would set an absolutely terrible precedent, I don't see why they would risk it when they have so little to gain.

The richest and most powerful American companies, some of whom are critical to national security and/or make their operational security as a critical selling point (the CIA among others), would be found not to be in fundamental control of the essential infrastructure powering their core business. It would trigger expensive large-scale review of every server in the world, and investors would run for the hills. This would be massive, and have heavy repercussions in the markets. FAANG are not protecting the Chinese, they are protecting their own finances - and the authorities will let them get away with it because the alternative is unpalatable.

If you keep it as a denied rumour, there is an official excuse for people to just get on with business as usual - nobody wants to deal with a market crash, not even most traders, and after all newspapers say many things, not all of them true. Maybe Supermicro is compromised, and maybe if you really care about hardware security you should buy elsewhere <wink-wink>; but it's not official, so most people can just pretend nothing is happening and go about their day, until a solution can be found.

> I don't see why they would risk it when they have so little to gain.

They have everything to lose, though.

I'd like try to boil things down a little further for people:

1) Most things in the modern world require high degrees of trust. Once a significant portion of people begin to question the system, it fails.

2) The main goal of most organizations/governments, in general sense, who find themselves in a favorable position is to keep the game going.

3) Though it's impossible to control for all variables, 'we' believe we can manage most common ones. The uncommon (foreseen and unforeseen) often arise in times of crisis (panic behavior) and often are unwieldy.

So... the veracity of the story is generally less important than is managing reactions to it.

4) IANAL, but I worked w/them for many years and have crafted many statements. Communication is an art form open to interpretation.

5) I've long suspected that such "tampering" was standard practice, for any global power. Why? See point 2.

I encourage anyone skeptical about any portion of the story, to don his/her 'megalomania'-cap for a bit. Then everything, at least conceptually, should make sense.

Cheers!

Funny they didn't deny that it happened, just said AWS didn't know about it.

> We’ve found no evidence to support claims of malicious chips or hardware modifications.

That's about as good a denial as you'll get from somebody with a lawyer.

This is fun.

In this case, if a cleared employee is asked: is this information true, is there such an investigation? Then simply by saying they can't comment on the question, they reveal the info to be true.

I think most people with high-level clearances would play it safe in such situations and just deny any knowledge of the situation.

I worked at Defense Science & Technology for a year, and there were levels of classification I wasn't even cleared to know about.

It was very common for someone to be working on something they could not tell their direct boss about, because their boss was not cleared for it.

The existence of it is important. I can't tell the content of x letter sent from China's Amb to the mother ship but I can tell you that we intercepted the letter. How was it intercepted? That in itself means a lot.

This whole thing wreaks. Is it fake news? Are the statements from Amazon and Apple expertly crafted to fool people who aren't very good at reading comprehension (most people)?

So one must think about "Where did this information come from?"

It is at least a plausible theory that the story is largely true (though as I posted in another thread, I'd bet money it's not all entirely true), and that the denials are either made by people who are unaware of the truth, or are being made deliberately. (Actually, the people who literally prepared those statements almost certainly believe the truth of the statements. One of the most plausible ways for a group of people to lie is for all communication to come from individuals who genuinely believe the lies; no body language tells or any other such leakage about it not being true.)

It is also plausible that the denials are in fact true, in which case one is left with the very interesting question of "Where did all that information come from and why is it wrong?"

As a couple of people have also said, there's also the option that the story is largely true, and the denials are true if you parse and read them like a lawyer, but meant to mislead anybody who doesn't. I can't say I've examined them for that, but it's definitely a possibility to consider.

I'd actually suggest "propaganda" isn't a great explanation; propaganda does not generally depend on making lots of specific, refutable claims, and certainly not followed up by refutations immediately. It is usually designed to speak directly to people's emotions and fan pre-existing flames in ways specifically designed to not be refutable. If this really was government propaganda (note how that is more specific than my previous unqualified "propaganda", because anybody can propagandize, not just governments), I would expect the American companies would be strong-armed into agreeing with the story for the propaganda's purposes, or that the story would never run at all if they couldn't be sure the companies weren't going to back them.

An alternate theory that might fit all the facts is industrial espionage. Let's say the story is completely untrue, the denials completely true. What is the result of this story? Supermicro in particular stands to lose some business. Perhaps someone who benefits from that planted this story.

Another alternative is stock market shenanigans. As I write this, the delayed feeds aren't showing it yet, but Supermicro stock (SMCI) just took a 31% bath overnight. Who benefits? Short sellers, put option traders.

I have no idea myself. "Unknown unknown" is still a pretty large chunk of my personal probability estimates.

EDIT: I read the volume amount incorrectly - it's more like 6m of volume which is not too bad. Someone could probably make money shorting it but again since its delisted already it would be difficult/risky to do so.

Whatever is going on with whatever stock is being traded is now visible even in the delayed listings; you can see it on https://finance.yahoo.com/quote/SMCI?p=SMCI&.tsrc=fin-srch or your choice of provider.

> We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures.

Does that mean they did uncover some "usual" vulnerabilities?

These companies churn out some truly horrible software with little consideration for security.

It's often difficult to automate firmware updates, so they tend to stay vulnerable.

It's a similar situation to webcams: https://youtu.be/B8DjTcANBx0

Similarly no security team is going to say "There are no vulnerabilities in the servers we purchased." It's just not true, they're always there and expected.

In this context, "unusual" vulnerabilities would be evidence of a deliberate attack, rather than just common security mistakes.

The original article directly addressed this: "The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."

It is entirely likely that the companies affected were directed by the IC agencies working on this not to discuss or reveal their knowledge of the hack. Often in intelligence operations it is important and useful to not alert your adversary that you are aware of their intrusions until you are fully ready to take action against them, or have fully removed the danger.

I don't see any reason to take the companies' categorical denials as evidence that this did not happen or that they were not targeted. Those statements are what one would expect in a national security incident and investigation of this magnitude, with such serious implications.