Have they seen any actual hard evidence? Noone is disputing that the described attack vector is possible, but if Bloomberg has not properly verified if it actually has happened, then their article becomes a lie; and if they have properly verified it (as opposed to blindly trusting unnamed sources), why are they seemingly unable to show any hard evidence or details to the public?
Ah, the Mockingbird sings...
> High Confidence:
> Iraq is continuing, and in some areas is expanding, its chemical, biological, nuclear and missile programs contrary to UN resolution.
> Iraq could make a nuclear weapons in months to a year if it acquired sufficient weapons-grade fissile material.
https://www.scribd.com/doc/259216899/Iraq-October-2002-NIE-o...
I'm not sure where this "the IC is this blameless group that only looks like they screw up because of those pesky politicians" meme came from, but it has no basis in reality.
Time and again, we see the CIA, and other of US' TLA-agencies, directly causing world turmoil - and yet a blind eye is turned, because "at least its our guys doing it", etc.
The world would be a much, much better place if American citizens paid more attention to what their spy masters are doing in the world. Secrecy is the lynchpin of all corruption: the fact that American's worship their secret-keeping institutions as beyond reproach, the reason we have so much turmoil in the world.
It doesn't work like that... "at least its our guys doing it" isn't some honest maxim we spout off in American fervor. It's akin to Winston knowing that when the 2-minutes-hate starts, whether you are into it or not, you stand up and blend in. Otherwise, those spy masters you mention make your life very uncomfortable, or take it away entirely. We just live here man, you don't think we actually are in charge and can make any difference...do you?
Is it a democracy or not? Are you a brave people, or are you really a nation of cowards?
The world burns while Americans do everything they can to not take responsibility for their government.
The talking heads you see on TV telling you "America thinks XYZ", or "America won't stand for <foo>!", are just that...talking heads. They aren't us, we don't know them, they don't come over and share meals...they are just a few elite that can't shut their mouth in front of a camera. It's just as shitty here as it is where you are from, most likely.
Now we have lots of propaganda. You know, like the USSR and North Korean propaganda... mantras that say we are the bravest, most "free", most prestigious people on the planet. It's just propaganda though, no one that lives here believes that nonsense. If they do, they just got off the boat...give them a year and their tune will change.
disclaimer: I'm an unhappy veteran.
As the draft NIE went up the intelligence chain of command, the conclusions were treated increasingly definitively. Only the summary of the NIE was partially declassified, and it omitted most of the reservations and nonconforming evidence. The fact that the NIE concluded that there was no operational tie between Saddam and al Qaeda did not offset this alarming assessment."
https://www.rand.org/content/dam/rand/pubs/research_reports/...
I wouldn't call the IC or even the CIA "blameless" for Iraq either and I don't appreciate you putting the word in my mouth (we also probably share a generally sour view of the CIA - they have done too many godawful destabilizing things around the world). The IC weren't the ones ordering the troops to invade any country on flimsy politically-massaged evidence though.
What? The allegations are against super micro boards produced in China.
One of the allegations was that special purpose video encoder boards from a hardware startup that Amazon acquired (Elemental) were targeted. These aren't off the shelf boards that anyone can buy.
What details and evidence about these boards have these sources provided to Bloomberg? Are there any details or evidence?
How about no.
There's next to no way that Bloomberg's sources would still have access to the boards, and that should be considered given all of the calls here to see them.
The informant may have perfectly accurate information but be completely unable to provide physical evidence. For instance: they could have been briefed on the matter, but still have no physical access to the datacenter or to the location where the compromised servers were taken to.
A lot of the demands for physical proof make the false assumption that someone who knew about the spy chips and talked to Bloomberg would have had physical access to an example. That's simply not the case. How many of us work as software engineers in Fortune 500 companies, and how many of us could walk into one of our employer's datacenters and take a photo of the motherboard of a particular machine that we frequently work with? Not many, I'd imagine.
See: Joseph Nacchio and Qwest
What if it's the Chinese government that's putting pressure on Apple and Amazon? What would Tim Cook do if he was told on no uncertain terms that Apple would be kicked out of China and its iPhone production lines shuttered if it confirmed this story? Even if the chance they'd go through with their threats is small, it's an enormous risk to Apple and taking it would be hard to justify to its shareholders. FAANG companies are clamoring for access to the Chinese market, and that gives the Chinese government a lot of leverage.
I don't think it likely though because such a nuclear option from the CN government would have the effect of basically destroying their position in the global supply chain.
I could believe it if the denials so far felt incomplete or ambiguously worded as if they were tiptoeing around something that they were not allowed to disclose. I could believe it if all we had coming from Apple and Amazon was the usual lawyer-speak "I won't confirm of deny" bullshit. Instead we've had completely unambiguous "this is completely false and never happened". If it turns out to be a lie it's going to be devastating for the trust in Apple or Amazon.
I mean think about it, if for some reason the US or Chinese agencies wanted to downplay or shift the blame they had so many easier ways to do it that would put them in an awkward position if somebody manages to prove the existence of these backdoored mobos. If the best spin they could come up with was "just deny everything and make sure to do so at a regular interval so people are constantly aware of our denial" they really need better PR people.
Well, at this point everybody is watching for weasel words, so a categorical denial is the only thing the government can demand that wouldn't provoke suspicion.
> If it turns out to be a lie it's going to be devastating for the trust in Apple or Amazon.
Oh, please. Companies have had millions of credit card numbers stolen, and nothing happens.
Apple and Amazon would get a bit of bad press. The tech folks wouldn't trust them any less than they already do. And it would blow over in a couple weeks at worst.
At this point, my Bayesian priors are lowering on Bloomberg, but they are not necessarily going up on Amazon or Apple.
since when taking a photo of the claimed motherboard with a foreign spy chip on it is considered as "dismantle" company property?
> discredit your employer knowing that it's likely to damage them and ruin you
I thought those huge number AAPL and AMZN investors deserve some truth.
But it doesn't matter - this is happening 100% guaranteed.
'We' do it and China has become far more aggressive in these areas these days ... so if they could be doing it, they would be.
Someone should come up with a bit of proof though.
" this is happening 100% guaranteed."
I don't know what brave new world we have entered where journalists, or even online users for that matter, make confident claims about things for which there is no physical evidence.
I worked at a large high-tech firm with business in the middle east, including content-filtering solutions and we were basically 'required' to work with Western governmental entities of a 'security nature'.
The US has massive clandestine projects in this regard and some of them are not so secret - consider the recent Wikileaks: [1]
"The US intelligence agency has been involved in a concerted effort to write various kinds of malware to spy on just about every piece of electronic equipment that people use. That includes iPhones, Androids and computers running Windows, macOS and Linux."
[1] https://www.independent.co.uk/life-style/gadgets-and-tech/ne...
All countries with active spy/clandestine agencies are spying on one another using malware, spyware, hardware hacking, phishing, social engineering, whatever. And many firms are complicit to one degree or another.
That Apple or AWS etc. may have been compromised with a specific attack makes for a really weird story - but that this is happening in general is a non-story - of course it is. It's not about this specific attack really.
What's the logic in this? This is like saying Saudis must be Christians because we are Christians as well
More specifically though, the Snowden docs showed how the usa does this kind of stuff on a one-off basis.
Also, I gave up hunting karma on HN a while back, i'd rather speak my mind honestly than be artificially censored by chasing a number.
I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in.
Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines.
I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things.
I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)
Why are you in this thread at all then?
I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.
What you said is not a conspiracy theory.
Of course this event is a conspiracy.
The phone companies all denied providing metadata to the NSA when the story first came out. I couldn't find the WaPo article from the same week, which I remembering reading in hardcopy, but here's a cite for the same from NPR: https://www.npr.org/templates/story/story.php?storyId=540913.... Did the SEC sue Verizon here?
Compare that with Apple's statement, which is forcefully blunt and has no wiggle room:
On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
All of that said, the BMC on supermicro boxes is running a super old unpatched Linux and is absolutely chock full of exploits:
https://www.cvedetails.com/google-search-results.php?q=super...
I had to root one several years ago to fix a broken server we couldn't take out of service for $reasons.
I'm waiting for the libel lawsuit. The absence of one is something I can't reconcile and leads me to thinking perhaps Apple doesn't want to through the discovery process for such a lawsuit which leads me to wonder why they wouldn't...
They're very careful to say that they never turned phone records over to the NSA - who's to say they didn't turn phone records over to the DoJ, FBI, or any other agency, which then bounced them over to the NSA? I think they do have an out here. Plus, I'm not certain the SEC would sue over a matter of national security, even if Verizon was directly lying.
That such a potentially damaging allegation has not been met with a more forceful (read: lawyerly) response is "weird". That this dropped in one publication with quite a bit of detail is "weird". The timing of the responses, the rumors of trouble at SuperMicro, the timeframe of the alleged compromised boards. It's all weird.
I'm waiting for the other shoe to drop on this one.
No comment is the proper action for no admission. However, Tim Cook and Andy Jassy put out public statements if they were willingly lying, they will be prosecuted by SEC
No, the boards would be selectively hacked.
And we know it happens because 'we' do it as well.
Surely there is evidence floating around but it's also unlikely that companies would want to admit the breach.
I kind of believe Apple and Amazon though, there's too much risk if they were to be caught lying.
This is a weird one ...