With the government’s involvement in this international matter, especially considering it’s China, is it possible that there’s a gag order preventing them from saying anything?

Their strenuous, detailed denials, personally given by individual senior officers seem to go very far beyond what a gag order would require.

Given project/ biz structures at least with amazon and the gov cloud efforts, their response could be entirely true and false at the same time. Ie. amazon didn’t have modified hardware but the joint business venture did.

Whether or not there was a gag order they're still unlikely to want to admit to being hacked.

So detailed they sounded suspicious to some: https://tvtropes.org/pmwiki/pmwiki.php/Main/SuspiciouslySpec...

> There is no new information,

It links to the Cambridge university security team blog and they say Bloomberg's claim passes the sniff test.

https://www.lightbluetouchpaper.org/2018/10/05/making-sense-...

Which has been discussed before https://news.ycombinator.com/item?id=18148749

So whether that's new information or not depends on how much time you waste on HN ;)

Im not familiar with this Cambridge researcher, but they seem very far off the mark and I do not think the original article passes the smell test.

Let's make multiple very serious and not reasonable assumptions and jump to the end: a compromised bmc on the network.

It is still non-trivial to get anything accomplished. Either you pass traffic through the likely sinkholed DNS (https://en.m.wikipedia.org/wiki/OpenDNS) or make hard coded calls likely to be flagged by ips/ids. Even if you don't get caught immediately, the number of firewalls with access rules to wan to lan traffic back to your ilo/idrac has got to be effectively 0. Even if the access rules are in place, I'd bet Nat isn't - even reverse ssh tunnels require Nat. There are file integrity solutions to check for OS compromises ( https://www.tripwire.com/solutions/file-integrity-and-change...)

The idea that these were shipped randomly globally to Enterprise environments and no one ever figured it out is basically impossible. Maybe there is some grey area and the CTOs and CISOs just never got told what the Frontline admins didn't think was a big deal.

Something else is going on. Maybe this is FUD with China in the title to fuel some political economic maneuvering. Maybe everything about the attack is real except Russia did it to hurt China.