Hacker News Reader

Comment by ckastner | Hacker News Reader

> If any of the reported details cited above were true, we would have every interest—economic, regulatory, and ethical—to be forthcoming about it.

That's the key argument.

This isn't just a "your word against mine" type of thing. Were this issue true, then it could represent a significant legal risk to Apple.

Categorically denying something that can easily be proven by an external audit (a scenario that they cannot rule out might happen), as strongly worded as they did (excerpt below), would open them up to a huge legal liability in addition to the security issue itself, and for no real upside.

> In the end, our internal investigations directly contradict every consequential assertion made in the article—some of which, we note, were based on a single anonymous source. Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server.

View on HN

They're already on the hook for an enormous liability if it's true, so lying about it isn't really the worst option if there's even a small chance it avoids the issue.

After seeing what VW did with emissions, I wouldn't say any huge corporate cover-up is out of the question. Especially considering this situation would be very bad even if did happen and they were 100% truthful about it (it would create huge problems with China for them and their supply chain).

We just can't reasonably make conclusions either way yet.

Not even the same. The VW coverup was to coverup a specific, fraudulent behavior by the company in an attempt to commit fraud.

The Apple situation is basically a reporter with no named sources saying that Apple itself was fooled by outside sources. There's a HUGE difference between willful fraud (VW) and corporate embarrassment (Apple IF it was true).

Well my point is that it could be corporate embarrassment AND willful fraud to cover up the corporate embarrassment. They have a huge incentive to lie, because even if they were truthful from the beginning and this did happen... it would be very bad for them.

I also think this goes far beyond "embarrassment" — this is something that could potentially destroy Apple's supply chain.

> They're already on the hook for an enormous liability if it's true

Correct, but this liability would (most probably) be based on showing some kind of negligence.

> so lying about it isn't really the worst option if there's even a small chance it avoids the issue

Deliberately lying about it would be fraud. Getting caught with that would dramatically increase the liability.

Since you used the VW example: do you really think it would have cost VW something around the order of $30bn if some foreign power had manipulated their emissions test without their knowledge? Or that executives would have been arrested?

> After seeing what VW did with emissions, I wouldn't say any huge corporate cover-up

This isn't a cover-up, though. This is Apple expressly addressing the issue, and categorically denying every part of it. To everyone, up to and including Congress, no less.

Let's assume it's true: Does Apple have a choice other than cover-up?

Let's say this was the first they're hearing about it, and it turns out to be true.

Can they publicly state the truth, point the finger at China in the process, and risk having to immediately uproot their entire supply chain?

Is there a course of action that's better than outright public denial?

>Let's assume it's true: Does Apple have a choice other than cover-up?

Yes, they can state that they detected a hardware based security intrusion and have mitigated it.

Bear in mind according to the Bloomberg article the government and several other companies know all about this already as well. If the Bloomberg article is true there are thousands of these compromised motherboards out in the wild at multiple companies. There is no way on earth Apple could ever get away with a denial, so why do it?

> Is there a course of action that's better than outright public denial?

Sure. "We are currently investigating this issue and cannot comment until the investigation has concluded and we have determined the attackers, their motives, and possible mitigations".

> Can they publicly state the truth, point the finger at China in the process, and risk having to immediately uproot their entire supply chain?

Note that there is no reason to point the finger at China yet, only suspicion, but even if this were the case: I think China would stand to lose more from any uprooting.

This would affect Apple short-term, but Apple has, for all practical purposes and intents, unlimited amounts of cash, and they could build up a new supply chain. Weren't they keen to move production back to the US anyway?

China, on the other hand, would permanently lose this production line, and access to all the IP that comes with it.

>> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server.

Then where are they buying their hardware? Every company that I've talked to who purchases electronics from China has had issues. Stuff isn't as ordered. Strange boards are added. You have to rigorously inspect everything. Nobody has told me about rice-sized stealth chips, but malware, old firmware (ie with known/public vulnerabilities) and under-spec parts are a norm in the industry.

What seems odd about this Bloomberg story is the difference in intent. Rather than a supplier trying to save a few bucks, or a wayward employee inserting something to harvest CC details, they ascribe this to government conspiracy, to a cold war battle between secret squirrels.

The reason I'm skeptical of the story is that the people inspecting hardware at Apple are at least as smart as I am. If I would do a certain thing to inspect hardware and firmware, then that means Apple would do at least that thing.

Those are brilliant hardware guys. I'm having a hard time seeing how you sneak something by them. I think maybe in the firmware? (But probably not. They've also got the most brilliant firmware security guys on the planet.)

And on the off chance that this thing did slip by, a picture was provided of the purported part. It would have been a simple matter to go back through all of your audits looking for that part. Because if I'm smart enough to catalog and record my hardware audits, that means that Apple was doing so a looong time before I was.

I don't know man?

I'm getting more and more skeptical of this story by the day.

>> I'm having a hard time seeing how you sneak something by them.

Apple orders in bulk. They aren't x-raying every server bound for their latest datacenter. I've worked with companies that do examine for every tiny imperfection. It costs thousands per-server and means significant and often random delays (defense industry). If apple, a publicly-traded company, were so rigorous they wouldn't be able to hide the costs. So we know they aren't.

I'm sure that apple does inspect systems that it deems vital to its internal systems, but servers meant for customer use are too numerous.

That chip picture is apparently a 'coupler' example photograph provided by Fitzpatrick, the security consultant. In the podcast mentioned below, he apparently was very astonished to find it as it means Bloomberg never saw the chip itself

I’d assume it’s a sampling problem. Do they fully inspect every board? If they ship three modified boards for an entire data warehouse could that be sufficient?

I don't understand why you are confused. It's the difference in intent that you mention in your last paragraph that Apple is referring to when they say 'purposefully planted'. That's they key allegation by Bloomberg, that these are demonstrably purposeful malicious hardware features.

Reply on news.ycombinator.com