Hacker News Reader

Comment by jstrong | Hacker News Reader

Gruber's article says

> Today’s follow-up from Bloomberg offers no evidence either.

The follow-up article actually has quite a bit of evidence.

e.g.

> “In early 2018, two security companies that I advise were briefed by the FBI’s counterintelligence division investigating this discovery of added malicious chips on Supermicro’s motherboards,” said Mike Janke, a former Navy SEAL who co-founded DataTribe, a venture capital firm.

maybe there are reasons not to believe the testimony of Janke. but saying the article "offers no evidence" is just bunk.

View on HN

The word of someone who's not an expert in the subject, who wasn't in the meetings and only heard about them via an unspecified number of intermediates, and doesn't even work there but "advises" the companies? Forgive me, but for the only sourcing of their main claim, that's a bit too weak to clear my standard of evidence.

it's not the "only" sourcing of the main claim, merely an example. (did you read the article?)

> Alarmed by the devices’ sophistication, officials opted to warn a small number of potential targets in briefings that identified Supermicro by name. Executives from 10 companies and one large municipal utility told Bloomberg News that they’d received such warnings. While most executives asked not to be named to discuss sensitive cybersecurity matters, some agreed to go on the record.

> “This was espionage on the board itself,” said Mukul Kumar, who said he received one such warning during an unclassified briefing in 2015 when he was the chief security officer for Altera Corp., a chip designer in San Jose. “There was a chip on the board that was not supposed to be there that was calling home—not to Supermicro but to China.”

> There was a chip on the board that was not supposed to be there that was calling home—not to Supermicro but to China

An extra chip on the board sounds like pretty solid physical evidence.

What other information do we have about this chip and what it was doing?

Reply on news.ycombinator.com