Hacker News Reader

> this means that they are lying in these statements.

Cyberwar with China is the current equivalent of the old Cold War scuffles with the USSR in third countries. How many lies were told back then, to cover up the worst mishaps? And then they were "uncovered" when it was safer or more convenient to do so.

I can totally believe that there are tons of actual conspiracies regarding the tumultuous relationships between China and the USA but in what configuration does this particular one make sense? As far as I can tell the only people who come out badly out of this are the Chinese intelligence agencies and the complicit Chinese manufacturers. Why would the Apple and Amazon go out of their way to protect them? I can imagine that the US government could coerce them into doing that but to what end?

If these companies are caught red handed lying on behalf of the Chinese or US governments it would set an absolutely terrible precedent, I don't see why they would risk it when they have so little to gain.

> As far as I can tell the only people who come out badly out of this are the Chinese intelligence agencies

The richest and most powerful American companies, some of whom are critical to national security and/or make their operational security as a critical selling point (the CIA among others), would be found not to be in fundamental control of the essential infrastructure powering their core business. It would trigger expensive large-scale review of every server in the world, and investors would run for the hills. This would be massive, and have heavy repercussions in the markets. FAANG are not protecting the Chinese, they are protecting their own finances - and the authorities will let them get away with it because the alternative is unpalatable.

If you keep it as a denied rumour, there is an official excuse for people to just get on with business as usual - nobody wants to deal with a market crash, not even most traders, and after all newspapers say many things, not all of them true. Maybe Supermicro is compromised, and maybe if you really care about hardware security you should buy elsewhere <wink-wink>; but it's not official, so most people can just pretend nothing is happening and go about their day, until a solution can be found.

> I don't see why they would risk it when they have so little to gain.

They have everything to lose, though.

Just wanted to thank you for posting this, as I [self-censor].

I'd like try to boil things down a little further for people:

1) Most things in the modern world require high degrees of trust. Once a significant portion of people begin to question the system, it fails.

2) The main goal of most organizations/governments, in general sense, who find themselves in a favorable position is to keep the game going.

3) Though it's impossible to control for all variables, 'we' believe we can manage most common ones. The uncommon (foreseen and unforeseen) often arise in times of crisis (panic behavior) and often are unwieldy.

So... the veracity of the story is generally less important than is managing reactions to it.

4) IANAL, but I worked w/them for many years and have crafted many statements. Communication is an art form open to interpretation.

5) I've long suspected that such "tampering" was standard practice, for any global power. Why? See point 2.

I encourage anyone skeptical about any portion of the story, to don his/her 'megalomania'-cap for a bit. Then everything, at least conceptually, should make sense.

Cheers!

Great, this means humans are going to Mars now.

Those employees wouldn't be authorized to talk about the information to anyone not cleared. Which includes the PR department or anyone tasked with crafting a statement.

>> >It’s untrue that AWS knew about a supply chain compromise

Funny they didn't deny that it happened, just said AWS didn't know about it.

Same paragraph, they state:

> We’ve found no evidence to support claims of malicious chips or hardware modifications.

That's about as good a denial as you'll get from somebody with a lawyer.

“We’ve found no evidence” ⇒ Somebody else found the evidence.

This is fun.

You can read any sentence to mean anything else if you want, but all you'll get is a degree in literature.

“AWS didn't know about it” ⇒ The relevant part of Amazon is not in the AWS organization.

Exactly, this type of weasle word shit is littered throughout all of the statements.

I mean... yeah of course. There's always a chance that something happens and you don't know about it.

Any TS/SCI cleared employees must deny the existence, even to their manager or even the CEO, unless they are also TS/SCI cleared.

That's not how TS/SCI works. You've been watching too many movies. Source: was TS/SCI cleared for 15 years. Information being classified just means you can't divulge the information, not that you can't divulge the existence of the info.

That's a bit misleading. There are code word programs and classified investigations where just revealing the existence of the info would be a serious violation.

In this case, if a cleared employee is asked: is this information true, is there such an investigation? Then simply by saying they can't comment on the question, they reveal the info to be true.

I think most people with high-level clearances would play it safe in such situations and just deny any knowledge of the situation.

I can't comment is exactly what they can and do say very frequently. Apple could have not commented on any investigation or not responded to a request for comment. This would have been completely normal. "That's not something I can talk about" is a very common phrase.

Frequently is not the same as always. And, if true, this situation would almost certainly fall outside the common scenario.

Absolutely correct, but extraordinary claims require proof. I'm certainly willing to be proven wrong, and of course I could be, but there is no indication that this is anything other than Bloomberg being misled at this point. Location of clearly exploited hardware, acknowledgement by anyone involved, or analysis of traffic from one of these boards would all corroborate the story.

I would say it depends on the thing.

I worked at Defense Science & Technology for a year, and there were levels of classification I wasn't even cleared to know about.

It was very common for someone to be working on something they could not tell their direct boss about, because their boss was not cleared for it.

>>just means you can't divulge the information, not that you can't divulge the existence of the info.

The existence of it is important. I can't tell the content of x letter sent from China's Amb to the mother ship but I can tell you that we intercepted the letter. How was it intercepted? That in itself means a lot.

It'd be interesting to know how that interweaves with things like SEC requirements to disclose material information.

Generally (and unfortunately) "national security" tends to override everything else.

Where did you get that from? This is well known to not be true in the US, the government can't even stop you from publishing nuclear secrets or the Pentagon Papers. See New York Times v. United States (1971) and United States of America v. Progressive, Inc.

The language is not very explicit. They allow the reader to interpret thier statement through an implied explicit denial. Great liars if not just plainly unclear.

This whole thing wreaks. Is it fake news? Are the statements from Amazon and Apple expertly crafted to fool people who aren't very good at reading comprehension (most people)?

An "implied explicit denial"? How does that work? Can you point out how these statements leave open the possibility that they know about this attack?

See, this is how FUD works. It works.

There is a lot of information in the Bloomberg story, which I mean in the information-theoretic sense, and not in the sense that it must be "true" information for any definition of "true". A lot of very specific claims. Those claims did not come from the reporter writing the story, which is about 99.9999% likely to be incapable of making up such a plausible story with such details.

So one must think about "Where did this information come from?"

It is at least a plausible theory that the story is largely true (though as I posted in another thread, I'd bet money it's not all entirely true), and that the denials are either made by people who are unaware of the truth, or are being made deliberately. (Actually, the people who literally prepared those statements almost certainly believe the truth of the statements. One of the most plausible ways for a group of people to lie is for all communication to come from individuals who genuinely believe the lies; no body language tells or any other such leakage about it not being true.)

It is also plausible that the denials are in fact true, in which case one is left with the very interesting question of "Where did all that information come from and why is it wrong?"

As a couple of people have also said, there's also the option that the story is largely true, and the denials are true if you parse and read them like a lawyer, but meant to mislead anybody who doesn't. I can't say I've examined them for that, but it's definitely a possibility to consider.

I'd actually suggest "propaganda" isn't a great explanation; propaganda does not generally depend on making lots of specific, refutable claims, and certainly not followed up by refutations immediately. It is usually designed to speak directly to people's emotions and fan pre-existing flames in ways specifically designed to not be refutable. If this really was government propaganda (note how that is more specific than my previous unqualified "propaganda", because anybody can propagandize, not just governments), I would expect the American companies would be strong-armed into agreeing with the story for the propaganda's purposes, or that the story would never run at all if they couldn't be sure the companies weren't going to back them.

An alternate theory that might fit all the facts is industrial espionage. Let's say the story is completely untrue, the denials completely true. What is the result of this story? Supermicro in particular stands to lose some business. Perhaps someone who benefits from that planted this story.

Another alternative is stock market shenanigans. As I write this, the delayed feeds aren't showing it yet, but Supermicro stock (SMCI) just took a 31% bath overnight. Who benefits? Short sellers, put option traders.

I have no idea myself. "Unknown unknown" is still a pretty large chunk of my personal probability estimates.

Supermicro was already delisted prior to this article and had about $370k of US dollar trading volume yesterday in the OTC markets. Don't think people will make much money shorting it as this point, since it is already so illiquid. Highly doubt that is the explanation for the article.

EDIT: I read the volume amount incorrectly - it's more like 6m of volume which is not too bad. Someone could probably make money shorting it but again since its delisted already it would be difficult/risky to do so.

Thank you. I was trying to make sense of the news stories listed below the stock listing.

Whatever is going on with whatever stock is being traded is now visible even in the delayed listings; you can see it on https://finance.yahoo.com/quote/SMCI?p=SMCI&.tsrc=fin-srch or your choice of provider.

I wonder if their delisting is related to this hack, or if it's a sign that they have poor internal controls and the company is just poorly controlled every where from accounting to engineering.

I found this wording interesting:

> We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures.

Does that mean they did uncover some "usual" vulnerabilities?

Most of the out-of-band management systems (aka IPMI/DRAC/LOM) that server vendors use are built by the same 2-3 companies and rebranded.

These companies churn out some truly horrible software with little consideration for security.

It's often difficult to automate firmware updates, so they tend to stay vulnerable.

It's a similar situation to webcams: https://youtu.be/B8DjTcANBx0

Typically yes. This is base hardening. The usual vulnerabilities can be just default configuration options or unwanted firmware/software features.

Similarly no security team is going to say "There are no vulnerabilities in the servers we purchased." It's just not true, they're always there and expected.

There's enough "usual" vulnerabilities that the practice of fixing them has a name: hardening. For supermicro motherboards specifically, "open services with really shitty default credentials" is apparently one of them — definitely one that is common in a lot of other contexts.

In this context, "unusual" vulnerabilities would be evidence of a deliberate attack, rather than just common security mistakes.

or they uncovered it using non-standard procedures?

> Or at least have testimonies by employees in these company

The original article directly addressed this: "The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."

It is entirely likely that the companies affected were directed by the IC agencies working on this not to discuss or reveal their knowledge of the hack. Often in intelligence operations it is important and useful to not alert your adversary that you are aware of their intrusions until you are fully ready to take action against them, or have fully removed the danger.

I don't see any reason to take the companies' categorical denials as evidence that this did not happen or that they were not targeted. Those statements are what one would expect in a national security incident and investigation of this magnitude, with such serious implications.