Bloomberg stands by Chinese chip story as Apple, Amazon ratchet up denials
arstechnica.com
arstechnica.com
https://www.dhs.gov/news/2018/10/06/statement-dhs-press-secr...
To me these are currently only allegations from one source. When a board is given out to security researchers to publish an independent analysis I'll believe it. The perfect way to be credible to me would be to give a talk at some security conference. There's no investigation of the supply chain, which would have been quite interesting.
But the more I think about it, the more I think that all of this, if true, would be much too serious to even publish, really.
What is the connection?
> Without proof (like a board) or the names of actual witnesses or hard documents or something, its basically unverifiable, like claiming Area 51 has aliens.
A Bloomberg article based on a year of reporting, 100 interviews, etc. is as likely as aliens? Hmmm ... I feel I can distinguish it pretty easily.
Otherwise, if Bloomberg have been misled by a concocted story, who has the ability to generate enough false sources/etc to engineer it? Seems like the scale puts it beyond a solid PR effort from a competitor?
Aggressive denials yes, but not at the level of specificity that Apple and Amazon have gone to.
If we want to disregard what Apple’s denial, we can also disregard Bloomberg’s claim until someone sues someone else and an investigation brings out actual facts.
It's unreasonable to expect that they would. Bloomberg News is full of journalists, not security researchers. They gather testimony and documents, not physical evidence.
Furthermore, the servers in question would have been owned by others: Apple, Amazon, the US Government. It's very unlikely that whatever sources Bloomberg talked to would have had the authorization to legally hand over the servers in question.
Is there something I'm missing that makes this difficult?
In the old days an editor would step in at some point to save these ink-stained wretches from themselves, but that's pre-Internet thinking.
Bonus for moving markets -> Incentive to report on highest possible value stories.
High value stories -> Bloomberg gains reputation/highest possible value to stock holders.
BUT you KNEW that they were compromised BEFORE you put them into service,
and you made changes that allowed you to spy back on the spyers..
you would deny that the assets had been compromised in the first place.
It sounds like some researcher found weird traffic, eventually found there is a chip on some of these servers that wasn't in the original gerber files, and this chip is doing something, and beyond that a lot of people are speculating about who and what.
Apple and Amazon deny that the story is correct. That doesn't mean that there isn't a chip there and they now know what it is doing but are prohibited from saying much beyond the story as a published whole is not true.
It’s embedded in ceramic. Such devices need to be fired at very high temperatures which a semiconductor wouldn’t be able to withstand.
It makes no sense for state-level bad guys to create disguised packages and add them to boards at the assembly house. There are any number of other links in the supply chain where they could accomplish the same goal with an actual nonzero chance of getting away with it.
I'm pointing out an advantage in putting the exploit into the supply chain as late as possible, such that it can be selected for based on customer.
Compromising the motherboard may be a good approach if the boards have some amount of customisation for each customer.
You could absolutely use a novel manufacturing technique to make something that looks like the picture in the article.
It wouldn’t make much sense to do so, because that part doesn’t even belong on a computer motherboard, it’s an RF component.
https://www.dhresource.com/0x0s/f2-albu-g5-M01-4D-13-rBVaJFl...
I also don’t understand why you would do that. Given the ceramic part in question doesn’t look like anything that would be on a motherboard, and has been identified as an RF component.